Skip to content

fix(uv): resolve missing Rust crate dependencies for uv 0.10.12 build - #18336

Draft
Autumn Nash (WithEnoughCoffee) wants to merge 3 commits into
4.0from
fix/uv-rust-crate-buildrequires
Draft

fix(uv): resolve missing Rust crate dependencies for uv 0.10.12 build#18336
Autumn Nash (WithEnoughCoffee) wants to merge 3 commits into
4.0from
fix/uv-rust-crate-buildrequires

Conversation

@WithEnoughCoffee

@WithEnoughCoffee Autumn Nash (WithEnoughCoffee) commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Status: draft

Not ready for merge. Local mock builds and smoke tests all pass

Before ready-for-review:

  • All touched crypto packages (bumped defaults + compat packages) must be built and tagged in the Koji build tag before any dependent package rebuilds — this ordering can't be validated locally and is the main pre-merge risk.
  • Maintainer sign-off on the 8 crypto compat packages now pointing at real Fedora repos (see below).
  • Follow-up (non-blocking): unpin the 9 bumped defaults back to bare/snapshot-following once AZL's snapshot naturally advances past their pinned commits.

Root cause

uv 0.10.12 uses %cargo_generate_buildrequires -a -t, which resolves BuildRequires dynamically against every feature/dev-dependency in its Cargo.lock. Several of AZL's packaged Rust crate versions fall outside the semver ranges uv needs (some too old, some too new), producing 21 unresolved dependency errors at %generate_buildrequires.

Options considered

  • A — align the crate set to uv 0.10.12 (chosen): isolated blast radius, no toolchain dependency.
  • B — move to uv 0.11.32: blocked on requiring Rust 1.95, while AZL is pinned to 1.94.1 — a much larger toolchain-wide change, tracked separately.

What changed

30 Rust crate components touched:

  • 7 crates bumped in place (confirmed zero real reverse-dependents via repoquery --whatrequires): rust-astral-tokio-tar, rust-nix (default only), rust-libc, rust-lzma-rust2, rust-zip, rust-insta, rust-proptest.
  • 9 shared crypto crates with existing consumers (rust-sha2, rust-digest, rust-aes, rust-hmac, rust-sha1, rust-md-5, rust-streebog, rust-pbkdf2, rust-const-oid): defaults bumped forward to Fedora f43 HEAD (what uv needs), each pinned to an explicit commit. 8 of the 9 get a new version-suffixed compat package (rust-sha2_0.10, rust-digest0.10, rust-aes0.8, rust-hmac0.12, rust-sha1_0.10, rust-md-5_0.10, rust-pbkdf2_0.12, rust-const-oid0.9) to keep serving ~60 combined existing dynamically-generated consumers (rust-rsa, rust-blake2, rust-sha3, rust-uucore, etc.) on the older range. rust-streebog gets no compat package — no in-tree consumer needs the older range.
    • All 8 compat packages point directly at their own real Fedora dist-git repos (they already exist upstream, created after AZL's pinned snapshot) — same convention as the pre-existing rust-nix0.23/28/29/30. No upstream-name override or rename overlay.
    • The 9 bumped defaults are now hard-pinned to an explicit commit (required to avoid a Provides/file collision with the compat packages) and will stop following Fedora's rolling snapshot, including security fixes, until a follow-up PR unpins them.
    • Re-rendering rust-hmac0.12/rust-pbkdf2_0.12 from their real Fedora specs pulled in two patches inherited unchanged from Fedora (hmac-0.12.1-no-streebog.patch, pbkdf2-0.12.2-no-streebog.patch) — not authored downstream here.
  • 3 brand-new crates, never packaged in AZL before: rust-ctutils, rust-cpubits, rust-cmov.

uv's own .comp.toml needed no change.

Build order

Leaves first: rust-cmov, rust-cpubits, rust-libc, rust-const-oid/0.9, rust-proptest → rust-ctutils (needs proptest ≥1.11.0 for its own %check) → rust-digest/0.10 → rust-sha2/0.10, rust-aes/0.8, rust-sha1/0.10, rust-md-5/0.10, rust-streebog → rust-lzma-rust2 (needs crate(sha2) >= 0.11.0) → rust-hmac/0.12 → rust-pbkdf2/0.12 → rust-zip, rust-nix, rust-insta, rust-astral-tokio-tar, rust-astral-reqwest-middleware0.4, rust-astral-reqwest-retry0.8, rust-astral_async_http_range_reader0.9 → uv.

tagging risk: all touched crypto packages should be built/tagged before any dependent rebuild, so %generate_buildrequires resolves against AZL's own builds rather than falling through to Fedora. Not exercisable locally — flagged for reviewers.

Testing performed

  • All 30 components + uv built cleanly end-to-end via azldev comp build in the corrected order (%generate_buildrequires → %build → %check → %install), no missing-crate errors.
  • clamav (a second, independent consumer embedding its own Rust sub-crate) rebuilt cleanly against the final crate set — confirms it correctly picks up the old-version compat packages rather than the bumped defaults.
  • Functional smoke test of the built uv binary in mock: install, uv --version/python list, uv venv, and uv pip install requests (network) all worked, exercising the full touched crate chain (reqwest-middleware/retry, zip, sha2/digest).

@WithEnoughCoffee
fix(uv): resolve missing Rust crate dependencies for uv 0.10.12 build
b31c07b 
uv's Dynamic BuildRequires (driven by %cargo_generate_buildrequires
against its Cargo.lock) could not be satisfied on AZL4: the distro's
pinned Rust crate snapshot lacked required versions of
astral-reqwest-middleware, astral-reqwest-retry, insta, nix, libc,
lzma-rust2, proptest, and zip, plus several of their transitive
dependencies (ctutils, cpubits, cmov, astral-tokio-tar,
astral_async_http_range_reader).

An initial attempt bumped the shared default packages for sha2,
digest, aes, hmac, sha1, md-5, streebog, pbkdf2, const-oid,
cargo-util, and tracing directly. Because rust2rpm's dynamic
BuildRequires generation reads each consumer's own Cargo.lock rather
than any statically greppable spec text, this silently broke roughly
60 other packages already building against the older shared versions
(discovered via repoquery --whatrequires against AZL's live repos,
not local spec grep, which misses dynamic requires entirely).

To avoid destabilizing existing consumers, those 11 shared bumps have
been reverted back to the distro default versions. Instead, uv's
newer requirements are satisfied via version-suffixed "compat"
packages (e.g. rust-sha2_0.11, rust-digest0.11, rust-aes0.9,
rust-hmac0.13, rust-sha1_0.11, rust-md-5_0.11, rust-streebog0.11,
rust-pbkdf2_0.13, rust-const-oid0.10) that install alongside the
unmodified shared defaults and are consumed only by uv's dependency
chain. Crates confirmed (via repoquery) to have no other reverse
dependents were bumped directly instead of compat-packaged: nix,
astral-tokio-tar, insta, libc, lzma-rust2, proptest, and zip.

Verification performed:
- uv builds successfully end-to-end via mock, including smoke tests
  (uv --version, venv creation, `uv pip compile` against a real Flask
  dependency tree, `uv build` producing a valid sdist+wheel).
- clamav (a consumer of the reverted shared crates) builds
  successfully, confirming the revert restored original behavior.
- rust-blake2 (the original trigger for reverting sha2/digest) and
  rust-camino (a real proptest 1.11.0 consumer) rebuild successfully
  against the final crate set.
- rpm -qlvp/--requires/--scripts sanity checks on uv, python3-uv, and
  clamav-lib show no permission, ownership, or packaging issues.
- All touched components' specs/ output was regenerated via
  `azldev comp render` and is idempotent (re-running render produces
  no further changes), satisfying CI's rendered-specs-match check.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: e869f93f-ea1b-443f-b4c0-a3d89d01e6fb
@WithEnoughCoffee
refactor(rust-crypto-compat): point 8 compat packages at real Fedora …
bf9a623 
…dist-git repos

Opus v3 Hanselman review found that rust-sha2_0.10, rust-digest0.10,
rust-hmac0.12, rust-aes0.8, rust-const-oid0.9, rust-pbkdf2_0.12,
rust-sha1_0.10, and rust-md-5_0.10 were hand-rolled by pinning the main
crate's git history at an old commit and renaming via a spec-set-tag
overlay. All 8 of these package names already exist as real, distinct
Fedora dist-git repositories (verified live against src.fedoraproject.org),
created after AZL's pinned fedora-43-updates buildroot snapshot
(20260528), which is why azldev's snapshot-aware tooling could not see
them locally. If AZL's buildroot snapshot advances past mid-2026,
Fedora's real same-named RPMs would generally out-rank our hand-rolled
ones, silently shadowing them -- reintroducing the very class of bug this
PR set out to fix, just on a longer fuse.

Repoint all 8 at their real upstream Fedora repos (pinned to current f43
HEAD, since the repos postdate AZL's snapshot cutoff and can't resolve via
the bare distro-default snapshot), dropping the upstream-name override and
Name rename overlay -- matching the established convention used by
rust-nix0.23/0.28/0.29/0.30 and other pre-existing compat packages.

Only rust-streebog0.10 has no real Fedora equivalent (confirmed via HTTP
404) and remains a genuine AZL-only hand-rolled compat package.
@WithEnoughCoffee
refactor(rust-crypto-compat): drop speculative rust-streebog0.10 comp…
af97a91 
…at package

Removed the rust-streebog0.10 compat package added earlier in this branch's
history. It was a speculative addition (for symmetry with the other 8
crypto compat packages) with no real consumer requiring it, and it has no
matching upstream Fedora repo. Also fixes a stale comment in the default
rust-streebog component referencing the now-removed compat package.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: a960731a-6754-444c-9b63-489729bf3128
Copilot AI balanced review requested due to automatic review settings August 6, 2026 02:52
Copilot AI reviewed Aug 6, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Human review recommended

The draft’s 30-package dependency transition still requires Koji tagging-order and CI validation.

Pull request overview

Aligns Azure Linux’s Rust crate graph so uv 0.10.12 can resolve dynamically generated build requirements.

Changes:

  • Bumps required Rust crates and adds three transitive crates.
  • Adds compatibility packages for existing consumers of older crypto crates.
  • Refreshes locks and rendered specs, including test/dependency patches.
File summaries
File Description
base/comps/components.toml Moves customized components to dedicated definitions.
base/comps/rust-aes/rust-aes.comp.toml Pins AES 0.9.1.
base/comps/rust-aes0.8/rust-aes0.8.comp.toml Adds AES 0.8 compatibility component.
base/comps/rust-astral-reqwest-middleware0.4/rust-astral-reqwest-middleware0.4.comp.toml Adds middleware compatibility component.
base/comps/rust-astral-reqwest-retry0.8/rust-astral-reqwest-retry0.8.comp.toml Adds retry compatibility component.
base/comps/rust-astral-tokio-tar/rust-astral-tokio-tar.comp.toml Pins tokio-tar 0.6.4.
base/comps/rust-astral_async_http_range_reader0.9/rust-astral_async_http_range_reader0.9.comp.toml Adds range-reader compatibility component.
base/comps/rust-cmov/rust-cmov.comp.toml Adds the cmov crate.
base/comps/rust-const-oid/rust-const-oid.comp.toml Pins const-oid 0.10.2.
base/comps/rust-const-oid0.9/rust-const-oid0.9.comp.toml Adds const-oid 0.9 compatibility component.
base/comps/rust-cpubits/rust-cpubits.comp.toml Adds the cpubits crate.
base/comps/rust-ctutils/rust-ctutils.comp.toml Adds the ctutils crate.
base/comps/rust-digest/rust-digest.comp.toml Pins digest 0.11.3.
base/comps/rust-digest0.10/rust-digest0.10.comp.toml Adds digest 0.10 compatibility component.
base/comps/rust-hmac/rust-hmac.comp.toml Pins HMAC 0.13.0.
base/comps/rust-hmac0.12/rust-hmac0.12.comp.toml Adds HMAC 0.12 compatibility component.
base/comps/rust-insta/rust-insta.comp.toml Pins insta 1.46.3.
base/comps/rust-libc/rust-libc.comp.toml Pins libc 0.2.189.
base/comps/rust-lzma-rust2/rust-lzma-rust2.comp.toml Pins lzma-rust2 0.18.0.
base/comps/rust-md-5/rust-md-5.comp.toml Pins md-5 0.11.0.
base/comps/rust-md-5_0.10/rust-md-5_0.10.comp.toml Adds md-5 0.10 compatibility component.
base/comps/rust-nix/rust-nix.comp.toml Pins nix and skips a host-dependent test.
base/comps/rust-pbkdf2/rust-pbkdf2.comp.toml Pins PBKDF2 0.13.0.
base/comps/rust-pbkdf2_0.12/rust-pbkdf2_0.12.comp.toml Adds PBKDF2 0.12 compatibility component.
base/comps/rust-proptest/rust-proptest.comp.toml Pins proptest 1.11.0.
base/comps/rust-sha1/rust-sha1.comp.toml Pins SHA-1 0.11.0.
base/comps/rust-sha1_0.10/rust-sha1_0.10.comp.toml Adds SHA-1 0.10 compatibility component.
base/comps/rust-sha2/rust-sha2.comp.toml Pins SHA-2 0.11.0.
base/comps/rust-sha2_0.10/rust-sha2_0.10.comp.toml Adds SHA-2 0.10 compatibility component.
base/comps/rust-streebog/rust-streebog.comp.toml Pins Streebog 0.11.0.
base/comps/rust-zip/rust-zip.comp.toml Pins zip 8.6.0.
locks/rust-aes.lock Refreshes the AES lock.
locks/rust-aes0.8.lock Adds the AES compatibility lock.
locks/rust-astral-reqwest-middleware0.4.lock Adds the middleware compatibility lock.
locks/rust-astral-reqwest-retry0.8.lock Adds the retry compatibility lock.
locks/rust-astral-tokio-tar.lock Refreshes the tokio-tar lock.
locks/rust-astral_async_http_range_reader0.9.lock Adds the range-reader compatibility lock.
locks/rust-cmov.lock Adds the cmov lock.
locks/rust-const-oid.lock Refreshes the const-oid lock.
locks/rust-const-oid0.9.lock Adds the const-oid compatibility lock.
locks/rust-cpubits.lock Adds the cpubits lock.
locks/rust-ctutils.lock Adds the ctutils lock.
locks/rust-digest.lock Refreshes the digest lock.
locks/rust-digest0.10.lock Adds the digest compatibility lock.
locks/rust-hmac.lock Refreshes the HMAC lock.
locks/rust-hmac0.12.lock Adds the HMAC compatibility lock.
locks/rust-insta.lock Refreshes the insta lock.
locks/rust-libc.lock Refreshes the libc lock.
locks/rust-lzma-rust2.lock Refreshes the lzma-rust2 lock.
locks/rust-md-5.lock Refreshes the md-5 lock.
locks/rust-md-5_0.10.lock Adds the md-5 compatibility lock.
locks/rust-nix.lock Refreshes the nix lock.
locks/rust-pbkdf2.lock Refreshes the PBKDF2 lock.
locks/rust-pbkdf2_0.12.lock Adds the PBKDF2 compatibility lock.
locks/rust-proptest.lock Refreshes the proptest lock.
locks/rust-sha1.lock Refreshes the SHA-1 lock.
locks/rust-sha1_0.10.lock Adds the SHA-1 compatibility lock.
locks/rust-sha2.lock Refreshes the SHA-2 lock.
locks/rust-sha2_0.10.lock Adds the SHA-2 compatibility lock.
locks/rust-streebog.lock Refreshes the Streebog lock.
locks/rust-zip.lock Refreshes the zip lock.
specs/r/rust-aes/rust-aes.spec Renders AES 0.9.1.
specs/r/rust-aes/sources Updates the AES source hash.
specs/r/rust-aes0.8/aes-fix-metadata-auto.diff Carries compatibility metadata adjustments.
specs/r/rust-aes0.8/rust-aes0.8.spec Renders the AES compatibility package.
specs/r/rust-aes0.8/sources Adds the AES 0.8 source hash.
specs/r/rust-astral-reqwest-middleware0.4/0001-Downstream-only-do-not-attempt-to-run-doctests-from-.patch Breaks a doctest dependency cycle.
specs/r/rust-astral-reqwest-middleware0.4/astral-reqwest-middleware-fix-metadata.diff Removes unused test dependencies.
specs/r/rust-astral-reqwest-middleware0.4/rust-astral-reqwest-middleware0.4.spec Renders the middleware compatibility package.
specs/r/rust-astral-reqwest-middleware0.4/sources Adds the middleware source hash.
specs/r/rust-astral-reqwest-retry0.8/astral-reqwest-retry-fix-metadata-auto.diff Removes WASM-only dependencies.
specs/r/rust-astral-reqwest-retry0.8/rust-astral-reqwest-retry0.8.spec Renders the retry compatibility package.
specs/r/rust-astral-reqwest-retry0.8/sources Adds the retry source hash.
specs/r/rust-astral-tokio-tar/astral-tokio-tar-fix-metadata.diff Excludes the upstream release script.
specs/r/rust-astral-tokio-tar/rust-astral-tokio-tar.spec Renders tokio-tar 0.6.4.
specs/r/rust-astral-tokio-tar/sources Updates the tokio-tar source hash.
specs/r/rust-astral_async_http_range_reader0.9/astral_async_http_range_reader-fix-metadata.diff Adjusts test dependencies.
specs/r/rust-astral_async_http_range_reader0.9/rust-astral_async_http_range_reader0.9.spec Renders the range-reader compatibility package.
specs/r/rust-astral_async_http_range_reader0.9/sources Adds crate and test fixture hashes.
specs/r/rust-cmov/rust-cmov.spec Renders the cmov package.
specs/r/rust-cmov/sources Adds the cmov source hash.
specs/r/rust-const-oid/rust-const-oid.spec Renders const-oid 0.10.2.
specs/r/rust-const-oid/sources Updates the const-oid source hash.
specs/r/rust-const-oid0.9/rust-const-oid0.9.spec Renders the const-oid compatibility package.
specs/r/rust-const-oid0.9/sources Adds the const-oid 0.9 source hash.
specs/r/rust-cpubits/rust-cpubits.spec Renders the cpubits package.
specs/r/rust-cpubits/sources Adds the cpubits source hash.
specs/r/rust-ctutils/rust-ctutils.spec Renders the ctutils package.
specs/r/rust-ctutils/sources Adds the ctutils source hash.
specs/r/rust-digest/digest-0.11.3-ignore-sha2-doctests.patch Avoids the SHA-2 bootstrap cycle.
specs/r/rust-digest/digest-fix-metadata.diff Removes the circular dev dependency.
specs/r/rust-digest/rust-digest.spec Renders digest 0.11.3.
specs/r/rust-digest/sources Updates the digest source hash.
specs/r/rust-digest0.10/sources Adds the digest 0.10 source hash.
specs/r/rust-hmac/rust-hmac.spec Renders HMAC 0.13.0.
specs/r/rust-hmac/sources Updates the HMAC source hash.
specs/r/rust-hmac0.12/hmac-0.12.1-no-streebog.patch Removes Streebog-dependent tests.
specs/r/rust-hmac0.12/hmac-fix-metadata.diff Removes the Streebog dev dependency.
specs/r/rust-hmac0.12/rust-hmac0.12.spec Renders the HMAC compatibility package.
specs/r/rust-hmac0.12/sources Adds the HMAC 0.12 source hash.
specs/r/rust-insta/insta-fix-metadata.diff Refreshes insta metadata changes.
specs/r/rust-insta/rust-insta.spec Renders insta 1.46.3.
specs/r/rust-insta/sources Updates the insta source hash.
specs/r/rust-libc/rust-libc.spec Renders libc 0.2.189.
specs/r/rust-libc/sources Updates the libc source hash.
specs/r/rust-lzma-rust2/lzma-rust2-fix-metadata.diff Refreshes lzma metadata pruning.
specs/r/rust-lzma-rust2/rust-lzma-rust2.spec Renders lzma-rust2 0.18.0.
specs/r/rust-lzma-rust2/sources Updates the lzma-rust2 source hash.
specs/r/rust-md-5/rust-md-5.spec Renders md-5 0.11.0.
specs/r/rust-md-5/sources Updates the md-5 source hash.
specs/r/rust-md-5_0.10/rust-md-5_0.10.spec Renders the md-5 compatibility package.
specs/r/rust-md-5_0.10/sources Adds the md-5 0.10 source hash.
specs/r/rust-nix/nix-fix-metadata-auto.diff Refreshes nix metadata pruning.
specs/r/rust-nix/nix-fix-metadata.diff Removes obsolete libc relaxation.
specs/r/rust-nix/rust-nix.spec Renders nix 0.31.3 and test skip.
specs/r/rust-nix/sources Updates the nix source hash.
specs/r/rust-pbkdf2/pbkdf2-0.13.0-no-belt-hash.patch Removes belt-hash tests.
specs/r/rust-pbkdf2/pbkdf2-fix-metadata.diff Removes the belt-hash dependency.
specs/r/rust-pbkdf2/sources Updates the PBKDF2 source hash.
specs/r/rust-pbkdf2_0.12/pbkdf2-0.12.2-no-streebog.patch Removes Streebog-dependent tests.
specs/r/rust-pbkdf2_0.12/pbkdf2-fix-metadata.diff Removes the Streebog dev dependency.
specs/r/rust-pbkdf2_0.12/sources Adds the PBKDF2 0.12 source hash.
specs/r/rust-proptest/proptest-fix-metadata.diff Refreshes proptest metadata relaxation.
specs/r/rust-proptest/rust-proptest.spec Renders proptest 1.11.0.
specs/r/rust-proptest/sources Updates the proptest source hash.
specs/r/rust-sha1/rust-sha1.spec Renders SHA-1 0.11.0.
specs/r/rust-sha1/sources Updates the SHA-1 source hash.
specs/r/rust-sha1_0.10/rust-sha1_0.10.spec Renders the SHA-1 compatibility package.
specs/r/rust-sha1_0.10/sources Adds the SHA-1 0.10 source hash.
specs/r/rust-sha2/rust-sha2.spec Renders SHA-2 0.11.0.
specs/r/rust-sha2/sources Updates the SHA-2 source hash.
specs/r/rust-sha2_0.10/sources Adds the SHA-2 0.10 source hash.
specs/r/rust-streebog/rust-streebog.spec Renders Streebog 0.11.0.
specs/r/rust-streebog/sources Updates the Streebog source hash.
specs/r/rust-zip/0001-Downstream-patch-out-tests-that-would-need-omitted-t.patch Updates omitted-fixture test exclusions.
specs/r/rust-zip/rust-zip.spec Renders zip 8.6.0.
specs/r/rust-zip/sources Updates zip source hashes.
specs/r/rust-zip/zip-6.0.0-omitted-test-files.patch Removes obsolete test patch.
specs/r/rust-zip/zip-fix-metadata-auto.diff Refreshes automatic metadata pruning.
specs/r/rust-zip/zip-fix-metadata.diff Aligns zip dependency metadata.
Review details
  • Files reviewed: 114/144 changed files
  • Comments generated: 2
  • Review effort level: Balanced

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

Comment thread specs/r/rust-cmov/rust-cmov.spec
Name: rust-cmov
Version: 0.5.4
Release: %autorelease
Summary: Conditional move CPU intrinsics with pure Rust fallback implemenation
Comment thread base/comps/rust-sha1/rust-sha1.comp.toml
Comment on lines +7 to +8
# rust-sha1_0.10 compat package, pinned at the commit this default
# previously resolved to.
@reubeno

reuben olinsky (reubeno) commented Aug 6, 2026

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

azure-pipelines Bot commented Aug 6, 2026

Copy link
Copy Markdown
Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@WithEnoughCoffee @reubeno