Pin rust version with toolchain file

[kl]

As part of enabling reproducible builds we need to build a given commit with a pinned Rust version.

This commit adds a minimal rust-toolchain.toml file that specifies this version (this Rust version is enforced by rustup when invoking a cargo command).

In the container we extract the version that is specified in rust-toolchain.toml to ensure that the container is pre-built with the correct Rust version (so that when buildling in the container we do not need to download the right Rust version).

This PR sets the Rust version to 1.83.0.

---

This change is 

[linear]

DES-554 Pin Rust version and allow automatic install of right version

[albin-mullvad]

Reviewed 3 of 5 files at r1.
Reviewable status: 3 of 5 files reviewed, 1 unresolved discussion (waiting on @kl)

---

building/build-and-publish-container-image.sh line 38 at r1 (raw file):

full_container_name="$REGISTRY_HOST/$REGISTRY_ORG/$container_name"

RUST_VERSION=$(rg -o "channel = \"(.*)\"" -r '$1' "$REPO_DIR/rust-toolchain.toml")

We need to do the same in android/fdroid-build/init.sh

Code quote:

RUST_VERSION=$(rg -o "channel = \"(.*)\"" -r '$1' "$REPO_DIR/rust-toolchain.toml")

[albin-mullvad]

Reviewable status: 2 of 8 files reviewed, all discussions resolved

---

building/build-and-publish-container-image.sh line 38 at r1 (raw file):

Previously, albin-mullvad wrote…

We need to do the same in android/fdroid-build/init.sh

NVM, that should be handled by the combination of the rust-toolchain.toml file and the init script adding targets during the build process.

[albin-mullvad]

Reviewed 1 of 5 files at r1, 1 of 4 files at r2.
Reviewable status: 4 of 8 files reviewed, all discussions resolved

[faern]

Reviewable status: 4 of 8 files reviewed, 1 unresolved discussion (waiting on @kl)

---

a discussion (no related file):
We probably need to update a few more CI workflows. Search for rustup default in the .github/ directory. All those CI jobs set up a default toolchain and expect all subsequent Rust invocation to use that toolchain. But rust-toolchain.toml will override it. This has to be solved in a different way.

We do want to continue running CI against beta and nightly. So those CI jobs need have their overrides fixed to work. Maybe they can just locally delete rust-toolchain.toml before building anything?

[kl]

Reviewable status: 3 of 21 files reviewed, 1 unresolved discussion (waiting on @albin-mullvad and @faern)

---

a discussion (no related file):

Previously, faern (Linus Färnstrand) wrote…

We probably need to update a few more CI workflows. Search for rustup default in the .github/ directory. All those CI jobs set up a default toolchain and expect all subsequent Rust invocation to use that toolchain. But rust-toolchain.toml will override it. This has to be solved in a different way.

We do want to continue running CI against beta and nightly. So those CI jobs need have their overrides fixed to work. Maybe they can just locally delete rust-toolchain.toml before building anything?

Solved by using explicit rustup override set which has precedence over rust-toolchain.toml. As of the this PR only some iOS actions still use rustup default. Just to make sure, these need to be changed as well, correct?

For example (workflows/ios.yml):

      - name: Configure Rust
        # Since the https://github.com/actions/runner-images/releases/tag/macos-13-arm64%2F20240721.1 release
        # Brew does not install tools at the correct location anymore
        # This update broke the rust build script which was assuming the cargo binary was located in ~/.cargo/bin/cargo
        # The workaround is to fix brew paths by running brew bundle dump, and then brew bundle
        # WARNING: This has to be the last brew "upgrade" commands that is ran,
        # otherwise the brew path will be broken again.
        run: |
          brew bundle dump
          brew bundle
          rustup default stable
          rustup update stable
          rustup target add aarch64-apple-ios-sim

[kl]

Reviewable status: 3 of 27 files reviewed, 1 unresolved discussion (waiting on @albin-mullvad and @faern)

---

a discussion (no related file):

Previously, kl (Kalle Lindström) wrote…

Solved by using explicit rustup override set which has precedence over rust-toolchain.toml. As of the this PR only some iOS actions still use rustup default. Just to make sure, these need to be changed as well, correct?

For example (workflows/ios.yml):

      - name: Configure Rust
        # Since the https://github.com/actions/runner-images/releases/tag/macos-13-arm64%2F20240721.1 release
        # Brew does not install tools at the correct location anymore
        # This update broke the rust build script which was assuming the cargo binary was located in ~/.cargo/bin/cargo
        # The workaround is to fix brew paths by running brew bundle dump, and then brew bundle
        # WARNING: This has to be the last brew "upgrade" commands that is ran,
        # otherwise the brew path will be broken again.
        run: |
          brew bundle dump
          brew bundle
          rustup default stable
          rustup update stable
          rustup target add aarch64-apple-ios-sim

Checked with Emils and have now removed all occurrences of rustup default.

[albin-mullvad]

Reviewed 10 of 18 files at r4, 6 of 6 files at r6, all commit messages.
Reviewable status: 19 of 27 files reviewed, 2 unresolved discussions (waiting on @faern and @kl)

---

.github/workflows/ios-screenshots-creation.yml line 37 at r6 (raw file):

      - name: Configure Rust
        run: |
          rustup default stable

nit: maybe change to a single run: line no that multiline isn't needed? Applies to more steps as well.

[albin-mullvad]

Reviewed 5 of 18 files at r4, 3 of 3 files at r5.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @faern and @kl)

---

.github/workflows/rustfmt.yml line 23 at r6 (raw file):

        run: git submodule update --init --depth=1 wireguard-go-rs

      - name: Install nightly Rust

I guess the name (nightly) and toolchain (stable) were out-of-sync as of before?

[faern]

Reviewed 1 of 5 files at r1, 5 of 18 files at r4, 2 of 3 files at r5, 2 of 6 files at r6.
Reviewable status: all files reviewed, 8 unresolved discussions (waiting on @kl)

---

android/docker/Dockerfile line 22 at r6 (raw file):

# repo: https://git.zx2c4.com/wireguard-android/tree/tunnel/tools/libwg-go.
# It's also important to keep the go path in sync.
FROM ghcr.io/kl/mullvadvpn-app-build:set-explicit-toolchain-v2

Should not be in this PR

---

.github/workflows/daemon.yml line 83 at r6 (raw file):

          git submodule update --init --recursive --depth=1 wireguard-go-rs

      # The container image already has rustup and Rust, but only the stable toolchain

Nit, but this comment is now outdated (the "stable" part)

---

building/build-and-publish-container-image.sh line 38 at r6 (raw file):

full_container_name="$REGISTRY_HOST/$REGISTRY_ORG/$container_name"

RUST_VERSION=$(rg -o "channel = \"(.*)\"" -r '$1' "$REPO_DIR/rust-toolchain.toml")

I believe that ripgrep is a new dependency? This is fine. I much rather add this to our build server setup instructions than trying to rework this to regular grep. I have added it to our build server setup instructions.

---

building/linux-container-image.txt line 1 at r6 (raw file):

ghcr.io/kl/mullvadvpn-app-build:set-explicit-toolchain-v2

Should not be in this PR

---

.github/workflows/rust-unused-dependencies.yml line 94 at r6 (raw file):

      - name: Check for unused dependencies
        run: cargo +${{ env.RUST_NIGHTLY_TOOLCHAIN }} udeps --target aarch64-linux-android --package mullvad-jni

I know I was the one adding this. But maybe it was a bit overly careful. Since the override is set, it will be used anyway. I think we should remove this, since we don't do it this explicitly anywhere else.

---

building/android-container-image.txt line 1 at r6 (raw file):

ghcr.io/kl/mullvadvpn-app-build-android:set-explicit-toolchain-v2

Should not be in this PR

[faern]

Reviewed 1 of 5 files at r1, 1 of 18 files at r4, 3 of 6 files at r6.
Reviewable status: all files reviewed, 8 unresolved discussions (waiting on @kl)

[kl]

Reviewable status: 20 of 29 files reviewed, 8 unresolved discussions (waiting on @albin-mullvad and @faern)

---

.github/workflows/ios-screenshots-creation.yml line 37 at r6 (raw file):

Previously, albin-mullvad wrote…

nit: maybe change to a single run: line no that multiline isn't needed? Applies to more steps as well.

Fixed

[kl]

Reviewable status: 19 of 29 files reviewed, 8 unresolved discussions (waiting on @albin-mullvad and @faern)

---

.github/workflows/daemon.yml line 83 at r6 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Nit, but this comment is now outdated (the "stable" part)

Fixed

---

.github/workflows/rust-unused-dependencies.yml line 94 at r6 (raw file):

Previously, faern (Linus Färnstrand) wrote…

I know I was the one adding this. But maybe it was a bit overly careful. Since the override is set, it will be used anyway. I think we should remove this, since we don't do it this explicitly anywhere else.

Fixed

[kl]

Reviewable status: 19 of 29 files reviewed, 7 unresolved discussions (waiting on @albin-mullvad and @faern)

---

.github/workflows/rustfmt.yml line 23 at r6 (raw file):

Previously, albin-mullvad wrote…

I guess the name (nightly) and toolchain (stable) were out-of-sync as of before?

Yes, I believe the previous name was wrong.

[albin-mullvad]

Reviewed 8 of 9 files at r7, 2 of 2 files at r8, all commit messages.
Reviewable status: all files reviewed, 6 unresolved discussions (waiting on @faern and @kl)

[faern]

Reviewed 1 of 2 files at r8.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @kl)

[faern]

Reviewed 6 of 18 files at r4, 5 of 9 files at r7, 1 of 2 files at r8.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @kl)

[albin-mullvad]

Reviewed 1 of 1 files at r9, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @kl)

[kl]

Reviewable status: 26 of 29 files reviewed, 3 unresolved discussions (waiting on @albin-mullvad and @faern)

---

android/docker/Dockerfile line 22 at r6 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Should not be in this PR

Done.

---

building/android-container-image.txt line 1 at r6 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Should not be in this PR

Done.

---

building/linux-container-image.txt line 1 at r6 (raw file):

Previously, faern (Linus Färnstrand) wrote…

Should not be in this PR

Done.

[albin-mullvad]

Reviewed 3 of 3 files at r10, all commit messages.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on @faern)

[faern]

Reviewed 3 of 9 files at r7, 1 of 1 files at r9.
Reviewable status: 26 of 33 files reviewed, all discussions resolved (waiting on @albin-mullvad)

[github-actions]

🚨 End to end tests failed. Please check the failed workflow run.