Mirror rust-lang/rust kernel artifacts used by CI jobs#41
Closed
jieyouxu wants to merge 1 commit into
Closed
Conversation
Member
Author
|
Closing since we should source from official git exports: #t-infra > kernel.org is borked @ 💬 |
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Jul 4, 2026
Mirror kernel archives in `ci-mirrors` to not depend on currently unavailable kernel mirror sources ## Summary (Tempoarily) closes #158718. See [#t-infra > kernel.org is borked](https://rust-lang.zulipchat.com/#narrow/channel/242791-t-infra/topic/kernel.2Eorg.20is.20borked/with/608182062). Currently rust-lang/rust CI is borked because: 1. `armhf-gnu` directly tries to download kernel v4.x artifacts from kernel.org mirror, and 2. certain `dist-*` jobs tries to download kernel v3.x and v4.x artifacts from kernel.org mirror indirectly via crosstools-ng ("CT-NG") [^1]. [^1]: Add v5.x but those are already recovered. However, kernel.org mirror sync infra has an active incident (ref: https://status.linuxfoundation.org/incidents/3y1k8b4ky71t) where not all files are available. In particular, v3.x and v4.x kernel artifacts are not recovered yet as of time of writing (check <https://mirrors.edge.kernel.org/pub/linux/kernel/>). ### Mitigation This PR tries to mitigate this by using our own mirrored kernel artifacts from `ci-mirrors` (see rust-lang/ci-mirrors#41, rust-lang/ci-mirrors#42, rust-lang/ci-mirrors#43), such that `linux-$A.$B.$C.tar.gz` artifacts become available as search locations to CT-NG. We carry a patch to CT-NG to use our own `ci-mirrors` artifact SHA256 checksums, the checksum mismatches are as far as we know due to compression setting differences (`ci-mirrors` source archives from <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/snapshot/>). ## Notes - `armhf-gnu` still has artifacts from third-party mirrors/sources (busybox, ubuntu-base-22.04.2). Not in scope of this PR. - It looks like `3.*` kernel series are considered obselete by CT-NG, and need `CT_OBSOLETE=y` config. - CT-NG checks for known-good kernel versions and checksums against the provided mirror. ### CT-NG known good versions Re. latest kernel versions in each release versus what CT-NG 1.28.0 considers a known good version w/ checksum: Kernel LTS release series | Last release in the series | CT-NG 1.28.0 known good kernel version w/ checksum -- | -- | -- 3.2.* | 3.2.102 | **3.2.101** 3.10.* | 3.10.108 | 3.10.108 4.4.* | 4.4.302 | 4.4.302 4.19.* | 4.19.325 | 4.19.325 4.20.* | 4.20.17 | 4.20.17 5.19.* | 5.19.17 | **5.19.16** (**Bold** CT-NG known good version indicates not latest in release series.) ### `ci-mirrors` kernal tarball SHA256 checksums Refer to https://github.com/rust-lang/ci-mirrors/blob/b474b4bb35108dab668907172c858854f209c809/files/rustc/kernel.toml: | **Kernel Version** | **SHA256** | | ------------------ | ------------------------------------------------------------------ | | 3.2.101 | `93e8391e029f131d5ba4b7ad76cc34b12f2c2244059604042f2297c4bde093f7` | | 3.10.108 | `b1711610cf3faf7194156dacdb98c63c1b7ffd02377269d7f75df63d823ccbba` | | 4.4.302 | `a22ceab143d40f511203265e5a70d6cc5ec39163cd54fa281346d19176f64451` | | 4.19.325 | `8753443636e475b506e08abd40059ec9b84904a115d206014f0c856dfe13a25e` | | 4.20.17 | `313b7bebb46084efbfcaf75f4ea6faf2e14c8cbc1711fcba483dc0a036c9acc1` | | 5.19.16 | `bbf0ead65559250e0784c13d4f9716b7f917a1d3a4e00f671f3994cc6990bb02` | --- try-job: armhf-gnu try-job: dist-armhf-linux try-job: dist-arm-linux-gnueabi try-job: dist-powerpc64le-linux-musl try-job: dist-loongarch64-musl try-job: dist-riscv64-linux try-job: dist-powerpc64le-linux-gnu try-job: dist-powerpc64-linux-musl try-job: dist-armv7-linux try-job: dist-powerpc-linux try-job: dist-loongarch64-linux try-job: dist-s390x-linux try-job: dist-i586-gnu-i586-i686-musl try-job: dist-powerpc64-linux-gnu
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Jul 4, 2026
Mirror kernel archives in `ci-mirrors` to not depend on currently unavailable kernel mirror sources ## Summary (Tempoarily) closes #158718. See [#t-infra > kernel.org is borked](https://rust-lang.zulipchat.com/#narrow/channel/242791-t-infra/topic/kernel.2Eorg.20is.20borked/with/608182062). Currently rust-lang/rust CI is borked because: 1. `armhf-gnu` directly tries to download kernel v4.x artifacts from kernel.org mirror, and 2. certain `dist-*` jobs tries to download kernel v3.x and v4.x artifacts from kernel.org mirror indirectly via crosstools-ng ("CT-NG") [^1]. [^1]: Add v5.x but those are already recovered. However, kernel.org mirror sync infra has an active incident (ref: https://status.linuxfoundation.org/incidents/3y1k8b4ky71t) where not all files are available. In particular, v3.x and v4.x kernel artifacts are not recovered yet as of time of writing (check <https://mirrors.edge.kernel.org/pub/linux/kernel/>). ### Mitigation This PR tries to mitigate this by using our own mirrored kernel artifacts from `ci-mirrors` (see rust-lang/ci-mirrors#41, rust-lang/ci-mirrors#42, rust-lang/ci-mirrors#43), such that `linux-$A.$B.$C.tar.gz` artifacts become available as search locations to CT-NG. We carry a patch to CT-NG to use our own `ci-mirrors` artifact SHA256 checksums, the checksum mismatches are as far as we know due to compression setting differences (`ci-mirrors` source archives from <https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/snapshot/>). ## Notes - `armhf-gnu` still has artifacts from third-party mirrors/sources (busybox, ubuntu-base-22.04.2). Not in scope of this PR. - It looks like `3.*` kernel series are considered obselete by CT-NG, and need `CT_OBSOLETE=y` config. - CT-NG checks for known-good kernel versions and checksums against the provided mirror. ### CT-NG known good versions Re. latest kernel versions in each release versus what CT-NG 1.28.0 considers a known good version w/ checksum: Kernel LTS release series | Last release in the series | CT-NG 1.28.0 known good kernel version w/ checksum -- | -- | -- 3.2.* | 3.2.102 | **3.2.101** 3.10.* | 3.10.108 | 3.10.108 4.4.* | 4.4.302 | 4.4.302 4.19.* | 4.19.325 | 4.19.325 4.20.* | 4.20.17 | 4.20.17 5.19.* | 5.19.17 | **5.19.16** (**Bold** CT-NG known good version indicates not latest in release series.) ### `ci-mirrors` kernal tarball SHA256 checksums Refer to https://github.com/rust-lang/ci-mirrors/blob/b474b4bb35108dab668907172c858854f209c809/files/rustc/kernel.toml: | **Kernel Version** | **SHA256** | | ------------------ | ------------------------------------------------------------------ | | 3.2.101 | `93e8391e029f131d5ba4b7ad76cc34b12f2c2244059604042f2297c4bde093f7` | | 3.10.108 | `b1711610cf3faf7194156dacdb98c63c1b7ffd02377269d7f75df63d823ccbba` | | 4.4.302 | `a22ceab143d40f511203265e5a70d6cc5ec39163cd54fa281346d19176f64451` | | 4.19.325 | `8753443636e475b506e08abd40059ec9b84904a115d206014f0c856dfe13a25e` | | 4.20.17 | `313b7bebb46084efbfcaf75f4ea6faf2e14c8cbc1711fcba483dc0a036c9acc1` | | 5.19.16 | `bbf0ead65559250e0784c13d4f9716b7f917a1d3a4e00f671f3994cc6990bb02` | --- try-job: armhf-gnu try-job: dist-armhf-linux try-job: dist-arm-linux-gnueabi try-job: dist-powerpc64le-linux-musl try-job: dist-loongarch64-musl try-job: dist-riscv64-linux try-job: dist-powerpc64le-linux-gnu try-job: dist-powerpc64-linux-musl try-job: dist-armv7-linux try-job: dist-powerpc-linux try-job: dist-loongarch64-linux try-job: dist-s390x-linux try-job: dist-i586-gnu-i586-i686-musl try-job: dist-powerpc64-linux-gnu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of rust-lang/rust#158718.
See #t-infra > kernel.org is borked.
Currently rust-lang/rust CI is borked because:
armhf-gnudirectly tries to download kernel v4.x artifacts from kernel.org mirror, anddist-*jobs tries to download kernel v3.x and v4.x artifacts from kernel.org mirror 1.However, kernel.org mirror sync infra has an active incident (ref: https://status.linuxfoundation.org/incidents/3y1k8b4ky71t) where not all files are available. In particular, v3.x and v4.x kernel artifacts are not recovered yet as of time of writing (check https://mirrors.edge.kernel.org/pub/linux/kernel/).
This PR tries to seed v3.x, v4.x kernel artifacts from elsewhere, notably from Way Back Machine and the partial/outdated University of Science and Technology of China (USTC) mirror which seemingly haven't synced with upstream yet.
Which kernel versions are needed?
armhf-gnu, it directly tries to fetch4.14.320(ref). In this PR, we will use the latest4.14.336of4.14.xseries instead.dist-*jobs, they indirectly fetch3.2.x,3.10.x,4.4.x,4.19.x,4.20.x,5.19.xkernel releases from the kernel archives, throughcrosstool-ngusages.Query the defconfigs
What are the exact kernel versions available from alternative sources?
Using https://en.wikipedia.org/wiki/Linux_kernel_version_history and cross-referencing with a slower-updated kernel.org mirror hosted by USTC (https://mirrors.ustc.edu.cn/kernel.org/linux/kernel/v3.x/, https://mirrors.ustc.edu.cn/kernel.org/linux/kernel/v4.x/, https://mirrors.ustc.edu.cn/kernel.org/linux/kernel/v5.x/):
However not the latest {.tar.xz, .tar.sign} pairs are available in either the Wayback Machine archive or USTC mirror, so we have to make do with the latest versions in each release series I could find:
Verify attestation
Fetch kernel PGP signatures
Check archive signatures
Check tar.xz signatures
For the
armhf-gnuone:Calculate SHA of the archives to compare to
ci-mirrorsSHA256 in this PRCommand
ci-mirrorstool invocationsInvocations
Review notes
Important
The reviewer must double-check the attestation of the artifacts because they are directly used in
dist-*jobs, which are CI jobs that we ship dist artifacts from.Footnotes
Add v5.x but those are already recovered. ↩