Include SBOM outputs in fingerprints#17216
Merged
Merged
Conversation
rustbot
added
A-rebuild-detection
Collaborator
|
Thanks for the pull request, and welcome! The Rust Project is excited to review your changes, and you should hear from @ehuss (or someone else) some time within the next two weeks. Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (
Why was this reviewer chosen?The reviewer was selected based on:
|
weihanglo
reviewed
Jul 14, 2026
Member
There was a problem hiding this comment.
Hi, we normally follow the pattern C-TEST described in this doc. The basic idea is that your first commit becomes a reproduction of the buggy behavior, and your second commit contains the diff that shows the behavior change. With that we can make sure we are not fixing a non-existing issue. Mind tweaking your git commits a bit?
TorinAsakura
force-pushed
the
fix/sbom-fingerprint
branch
from
July 14, 2026 22:13
f44c0e6 to
9beeb7b
Compare
weihanglo
reviewed
Jul 16, 2026
Comment on lines
+109
to
+112
| p.cargo("build -Zsbom") | ||
| .env("CARGO_BUILD_SBOM", "true") | ||
| .masquerade_as_nightly_cargo(&["sbom"]) | ||
| .run(); |
Member
There was a problem hiding this comment.
Could you add .with_stderr_data(…) to assert something was actually recompiled?
Member
There was a problem hiding this comment.
Could you again follow the C-TEST pattern? Feel free to rebase and clean up history
Contributor
Author
There was a problem hiding this comment.
Ah, sorry — I’m still getting used to the C-TEST convention. bd1b857
| .masquerade_as_nightly_cargo(&["sbom"]) | ||
| .run(); | ||
|
|
||
| assert!(file.is_file()); |
Member
There was a problem hiding this comment.
Should we fire another CARGO_BUILD_SBOM=true cargo build to make sure the fingerprint working correctly and no surprising rebuild?
TorinAsakura
force-pushed
the
fix/sbom-fingerprint
branch
from
July 16, 2026 17:05
54241b9 to
bd1b857
Compare
weihanglo
approved these changes
Jul 16, 2026
rustbot
removed
the
S-waiting-on-review
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Jul 18, 2026
Update cargo submodule 29 commits in 59800466c5c41c444d264b1010b4d57e85a7117f..3efb1f477e99b42974b982d939fd100303cdf7db 2026-07-07 15:52:22 +0000 to 2026-07-17 23:53:19 +0000 - refactor(context): normalize in `homedir` instead (rust-lang/cargo#17222) - chore(ci): reflect doc folder move in book deployment (rust-lang/cargo#17235) - refactor(ops): Have cargo-metadata's ops match the command name (rust-lang/cargo#17233) - chore: Flatten src (rust-lang/cargo#17231) - chore: Flatten `src` (rust-lang/cargo#17230) - chore(ci): remove stale libsecret packages (rust-lang/cargo#17229) - perf: Lazily initialize git2 fetch transports (rust-lang/cargo#17226) - test(trim-paths): re-enable lldb debugger tests (rust-lang/cargo#17223) - Include SBOM outputs in fingerprints (rust-lang/cargo#17216) - Update cfg_aliases to 0.2.2 (rust-lang/cargo#17225) - test(trim-paths): exercise GDB on windows-gnu (rust-lang/cargo#17221) - feat(profile): Disable incremental compilation under CI by default (rust-lang/cargo#17220) - Remove myself from review rotation (rust-lang/cargo#17219) - Fix typo in comment in sync (rust-lang/cargo#17217) - docs(ref): Improve handing of built-in profiles (rust-lang/cargo#17213) - fix: dont apply host-config gating to stable behavior (rust-lang/cargo#17198) - chore(deps): update msrv (rust-lang/cargo#17192) - test: fix race in cargo_compile_with_invalid_code_in_deps (rust-lang/cargo#17203) - Rename `-Zno-embed-metadata` to `-Zembed-metadata=no` (rust-lang/cargo#17149) - fix(source): incorrect duplicate package warning (rust-lang/cargo#17204) - Fix manifest schema generation: `TomlDebugInfo` enum-variants doesn't renamed (rust-lang/cargo#17202) - Reduce library search path length in new build dir layout (rust-lang/cargo#17191) - fix(install): Move --debug to Compilation options (rust-lang/cargo#17199) - chore(ci): dogfood `build.warnings` (rust-lang/cargo#17195) - docs(lints): Better match clippy in lint section titles (rust-lang/cargo#17190) - chore: bump to 0.100.0; update changelog (rust-lang/cargo#17189) - docs(ref): Clarify MSRV for lints (rust-lang/cargo#17184) - docs(report): add missing entry for `cargo report future-incompatibilities` (rust-lang/cargo#17188) - Reduce rustc `-L` args used in the new `build-dir` layout (rust-lang/cargo#17168)
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Jul 18, 2026
Update cargo submodule 29 commits in 59800466c5c41c444d264b1010b4d57e85a7117f..3efb1f477e99b42974b982d939fd100303cdf7db 2026-07-07 15:52:22 +0000 to 2026-07-17 23:53:19 +0000 - refactor(context): normalize in `homedir` instead (rust-lang/cargo#17222) - chore(ci): reflect doc folder move in book deployment (rust-lang/cargo#17235) - refactor(ops): Have cargo-metadata's ops match the command name (rust-lang/cargo#17233) - chore: Flatten src (rust-lang/cargo#17231) - chore: Flatten `src` (rust-lang/cargo#17230) - chore(ci): remove stale libsecret packages (rust-lang/cargo#17229) - perf: Lazily initialize git2 fetch transports (rust-lang/cargo#17226) - test(trim-paths): re-enable lldb debugger tests (rust-lang/cargo#17223) - Include SBOM outputs in fingerprints (rust-lang/cargo#17216) - Update cfg_aliases to 0.2.2 (rust-lang/cargo#17225) - test(trim-paths): exercise GDB on windows-gnu (rust-lang/cargo#17221) - feat(profile): Disable incremental compilation under CI by default (rust-lang/cargo#17220) - Remove myself from review rotation (rust-lang/cargo#17219) - Fix typo in comment in sync (rust-lang/cargo#17217) - docs(ref): Improve handing of built-in profiles (rust-lang/cargo#17213) - fix: dont apply host-config gating to stable behavior (rust-lang/cargo#17198) - chore(deps): update msrv (rust-lang/cargo#17192) - test: fix race in cargo_compile_with_invalid_code_in_deps (rust-lang/cargo#17203) - Rename `-Zno-embed-metadata` to `-Zembed-metadata=no` (rust-lang/cargo#17149) - fix(source): incorrect duplicate package warning (rust-lang/cargo#17204) - Fix manifest schema generation: `TomlDebugInfo` enum-variants doesn't renamed (rust-lang/cargo#17202) - Reduce library search path length in new build dir layout (rust-lang/cargo#17191) - fix(install): Move --debug to Compilation options (rust-lang/cargo#17199) - chore(ci): dogfood `build.warnings` (rust-lang/cargo#17195) - docs(lints): Better match clippy in lint section titles (rust-lang/cargo#17190) - chore: bump to 0.100.0; update changelog (rust-lang/cargo#17189) - docs(ref): Clarify MSRV for lints (rust-lang/cargo#17184) - docs(report): add missing entry for `cargo report future-incompatibilities` (rust-lang/cargo#17188) - Reduce rustc `-L` args used in the new `build-dir` layout (rust-lang/cargo#17168)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR try to resolve?
Cargo currently excludes SBOM outputs when calculating a unit fingerprint. After a build without SBOM, rebuilding the same unit with
CARGO_BUILD_SBOM=trueand-Zsbomcan reuse the cached unit and leave the expected SBOM precursor missing.This keeps the existing unit output and uplift path, but includes SBOM in the output set used for fingerprints so enabling SBOM invalidates the earlier build.
Close #15695
How to test and review this PR?
The regression test builds once without SBOM, enables it for the next build, and checks that the precursor appears in the top-level target output. The complete SBOM test module passes.