employer
/
tame
1
0
Fork 0
Code Packages Releases Activity
tame/tamer/bootstrap

37 lines
1.4 KiB
Plaintext
Raw Normal View History

TAMER: Initial commit
2019-11-14 16:43:07 -05:00
#!/bin/bash
# Bootstrap from source repository
#
Copyright year and name update Ryan Specialty Group (RSG) rebranded to Ryan Specialty after its IPO.
2023-01-17 23:09:25 -05:00
# Copyright (C) 2014-2023 Ryan Specialty, LLC.
Copyright year 2020 update
2020-03-06 11:05:18 -05:00
#
# This file is part of TAME.
TAMER: Initial commit
2019-11-14 16:43:07 -05:00
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
tamer: cargo --frozen --offline Cargo's default behavior is unfortunately to issue network calls each time it is invoke in order to check for dependencies updates. This is not only bad for reproducibility and privacy, but it's also a concern for supply chain attacks, since most developers are unaware that this is occurring. Instead, we pin to the lockfile. Installing dependencies can be done with `cargo fetch` and updating dependencies must be explicitly done by the developer, with the lockfile updated.
2021-12-02 11:34:56 -05:00
#
# This script should be run _once_ after an initial checkout, otherwise it
# may overwrite any subsequent configuration you may have done.
TAMER: Initial commit
2019-11-14 16:43:07 -05:00
##
set -euo pipefail
tamer: Support nightly Rust toolchain pinning I had never intended to avoid pinning nightly. This is an unfortunate thing to have to do---require a _specific_ version of a compiler to build your software; it's madness. But the unstable features utilized by TAMER (as rationalized in `src/lib.rs`) are still worth the effort. It's not _actually_ that case that we need a specific version of the compiler, granted; this is outlined in `rust-toolchain.toml`'s rationale. You should look there for more information; my approach still utilizes explicit channels via cargo. Unfortunately, I had hard-coded it previously, putting me in a bit of a bind an unable to override the behavior without modifying the software. The reason for this change is that `adt_const_params` has a BC break involving the introduction of `ConstParamTy`. This is only the second time I've been bitten by a nightly BC break; the other was the renaming of `int_log`'s API, as mentioned in 709291b1073bf0bb7898d2437fbeff5bef18820b. This pinning will in fact mitigate those future issues---TAMER will be able to resolve the issue at its leisure, and will further be able to continue to build earlier commits in the future by simply re-bootstrapping with the committed nightly version. If you're curious of my rationale for wanting to inhibit toolchain downloading during build, or use system libraries, have a look at GNU Guix's approach to building software safely and reproducibly. In particular, dependencies are also built from source (rather than downloading binaries from external sources), and builds take place in network-isolated containers. The `TAMER_RUST_TOOLCHAIN` configure parameter is meant to facilitate these situations by giving more flexibility to packagers. DEV-14476
2023-06-05 15:58:26 -04:00
# Invoke cargo both to output version information to the log and to trigger
# rustup based on `rust-toolchain.toml`, if the user happens to use rustup.
# This will allow `cargo` commands to work in the usual way, though `make`
# should still be preferred.
which cargo &>/dev/null && cargo --version
tamer: cargo --frozen --offline Cargo's default behavior is unfortunately to issue network calls each time it is invoke in order to check for dependencies updates. This is not only bad for reproducibility and privacy, but it's also a concern for supply chain attacks, since most developers are unaware that this is occurring. Instead, we pin to the lockfile. Installing dependencies can be done with `cargo fetch` and updating dependencies must be explicitly done by the developer, with the lockfile updated.
2021-12-02 11:34:56 -05:00
# This will apply a default configuration, which will be used to perform a
# fetch of the dependencies. You are of course free to reconfigure after.
./autogen.sh && ./configure && make fetch
TAMER: Initial commit
2019-11-14 16:43:07 -05:00