Fix OUT_DIR sanitization in cargo_build_script - #4050
Merged
Conversation
UebelAndre
force-pushed
the
path_mapping
branch
3 times, most recently
from
May 19, 2026 17:54
5b0ce7a to
c8782cd
Compare
slackito
approved these changes
May 21, 2026
| _transitive_out_dir_subst_test = analysistest.make( | ||
| _transitive_out_dir_subst_test_impl, | ||
| doc = """\ | ||
| Test that `--subst` values were used passed which is used to dereference command line |
Collaborator
There was a problem hiding this comment.
I'm having trouble parsing this first line, around "values were used passed". Is there a typo somewhere?
Collaborator
Author
There was a problem hiding this comment.
Wow yeah, I totally lost my way in this sentence. Fixed docs!
UebelAndre
enabled auto-merge
May 21, 2026 13:56
github-merge-queue Bot
pushed a commit
that referenced
this pull request
Jul 5, 2026
### The bug Since the `OUT_DIR` sanitization work (#4050 / #4011, first released in 0.71.x), `outputs_to_dep_env` redacts the producer's `out_dir` to the generic `${out_dir}` substitution token, the same way `outputs_to_env` does. That redaction is only correct for `_bs.env` files, which are consumed by the target that directly owns the build script (where `process_wrapper`'s `--out-dir` resolves the token to the right directory). Dep env (`DEP_*`) files, however, are consumed by *downstream* crates' build scripts: their runner only substitutes `${pwd}`, and their own `out_dir` points to a different directory. The token is therefore left unresolved, or would resolve to the wrong directory. Real-world failure: `libssh2-sys`'s build script fails to find `zlib.h` because `libz-sys`'s `DEP_Z_INCLUDE` contains a literal `${out_dir}` path component. Found while upgrading `rules_rust` to 0.71.3 in dfinity/ic (see dfinity/ic#10632, where this fix is currently carried as a patch). ### The fix Only substitute the exec root in dep env files and keep the real `out_dir` path. That path is valid for consumers: the producer's `out_dir` is a declared input of downstream build script actions. ### Tests * Unit test `out_dir_in_dep_env_value_is_not_redacted_to_substitution_token` in `cargo/private/cargo_build_script_runner/lib.rs`. * End-to-end regression test `//cargo/tests/dep_env:build_read_out_dir` mirroring the libz-sys → libssh2-sys scenario: a producer build script advertises `cargo:include=$OUT_DIR/include` and the consumer build script asserts `DEP_Z_INCLUDE` points at an existing directory. Fails without the fix, passes with it. --- Assisted-by: GitHub Copilot
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
closes #4045