[0.2] Backports

.github/workflows/ci.yaml

@@ -1,4 +1,5 @@
 name: CI
+permissions: {}
 
 on:
   merge_group:
@@ -23,10 +24,12 @@ defaults:
 jobs:
   style_check:
     name: Style check
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup Rust toolchain
         run: ./ci/install-rust.sh && rustup component add rustfmt
       - name: Check style
@@ -36,13 +39,15 @@ jobs:
     name: Clippy on ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-24.04, macos-26, windows-2025]
+        os: [ubuntu-26.04, macos-26, windows-2025]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - run: rustup update stable --no-self-update
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       # Here we use the latest stable Rust toolchain already installed by GitHub
       # Ideally we should run it for every target, but we cannot rely on unstable toolchains
       # due to Clippy not being consistent between them.
@@ -64,18 +69,22 @@ jobs:
             only: '(aarch64|x86_64)' # just a spot check for beta
           - toolchain: stable
           - toolchain: 1.65.0 # msrv
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 25
     env:
       TOOLCHAIN: ${{ matrix.toolchain }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup Rust toolchain
         run: ./ci/install-rust.sh
 
       - name: Install semver-checks
-        uses: taiki-e/install-action@cargo-semver-checks
+        uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2.82.2
         if: matrix.toolchain == 'stable'
+        with:
+          tool: cargo-semver-checks
 
       - name: Retrieve semver baseline
         if: matrix.toolchain == 'stable'
@@ -84,7 +93,7 @@ jobs:
       # FIXME(ci): These `du` statements are temporary for debugging cache
       - name: Target size before restoring cache
         run: du -sh target | sort -k 2 || true
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           key: ${{ matrix.os }}-${{ matrix.toolchain }}
       - name: Target size after restoring cache
@@ -106,14 +115,15 @@ jobs:
   test_tier1:
     name: Test tier1
     strategy:
+      fail-fast: false # Speed up 0.2 backport CI
       matrix:
         include:
           - target: aarch64-apple-darwin
             os: macos-26
           - target: aarch64-pc-windows-msvc
             os: windows-11-arm
           - target: aarch64-unknown-linux-gnu
-            os: ubuntu-24.04-arm
+            os: ubuntu-26.04-arm
           - target: i686-pc-windows-gnu
             os: windows-2025
           - target: i686-pc-windows-msvc
@@ -124,15 +134,17 @@ jobs:
           - target: x86_64-pc-windows-msvc
             os: windows-2025
           - target: x86_64-unknown-linux-gnu
-    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-24.04' }}
+    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-26.04' }}
     timeout-minutes: 25
     env:
       TARGET: ${{ matrix.target }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup Rust toolchain
         run: ./ci/install-rust.sh
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           key: ${{ matrix.target }}
 
@@ -154,7 +166,7 @@ jobs:
         id: create_artifacts
         if: always()
         run: python3 ci/create-artifacts.py
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() && steps.create_artifacts.outcome == 'success'
         with:
           name: ${{ env.ARCHIVE_NAME }}-${{ matrix.target }}${{ matrix.artifact-tag && format('-{0}', matrix.artifact-tag) }}
@@ -164,9 +176,8 @@ jobs:
   # Unlike `main` this job doesn't have `needs`, in order to speed up backports a bit
   test_tier2:
     name: Test tier2
-    needs: [test_tier1, style_check]
     strategy:
-      fail-fast: true
+      fail-fast: false # Speed up 0.2 backport CI
       max-parallel: 16
       matrix:
         include:
@@ -221,15 +232,17 @@ jobs:
           # FIXME(ppc): SIGILL running tests, see
           # https://github.com/rust-lang/libc/pull/4254#issuecomment-2636288713
           # - target: powerpc-unknown-linux-gnu
-    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-24.04' }}
+    runs-on: ${{ matrix.os && matrix.os || 'ubuntu-26.04' }}
     timeout-minutes: 25
     env:
       TARGET: ${{ matrix.target }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Setup Rust toolchain
         run: ./ci/install-rust.sh
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           key: ${{ matrix.target }}
 
@@ -251,7 +264,7 @@ jobs:
         id: create_artifacts
         if: always()
         run: ./ci/create-artifacts.py
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always() && steps.create_artifacts.outcome == 'success'
         with:
           name: ${{ env.ARCHIVE_NAME }}-${{ matrix.target }}${{ matrix.artifact-tag && format('-{0}', matrix.artifact-tag) }}
@@ -262,12 +275,9 @@ jobs:
     name: Test tier2 VM
     runs-on: ubuntu-latest
     strategy:
-      fail-fast: true
+      fail-fast: false # Speed up 0.2 backport CI
       matrix:
         include:
-          # FIXME(#4740): FreeBSD 13 tests are extremely flaky and fail most of the time
-          # - release: "13.4"
-          #   target: x86_64-unknown-freebsd
           - release: "15.0"
             target: i686-unknown-freebsd
           - release: "14.4"
@@ -278,9 +288,11 @@ jobs:
           - target: x86_64-unknown-netbsd
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Test on FreeBSD
-        uses: vmactions/freebsd-vm@v1.4.5
+        uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8
         if: contains(matrix.target, 'freebsd')
         with:
           release: ${{ matrix.release }}
@@ -300,7 +312,7 @@ jobs:
             ./ci/run.sh ${{ matrix.target }}
 
       - name: test on Solaris
-        uses: vmactions/solaris-vm@v1.3.2
+        uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1.3.7
         if: contains(matrix.target, 'solaris')
         with:
           release: "11.4-gcc"
@@ -309,15 +321,18 @@ jobs:
           copyback: false
           prepare: |
             set -ex
-            source <(curl -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install)
-            rustc --version
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- \
+              --profile minimal --default-toolchain nightly -y
             uname -a
           run: |
-            export PATH=$HOME/.rust_solaris/bin:$PATH
+            set -ex
+            . "$HOME/.cargo/env"
+            which rustc
+            rustc -Vv
             ./ci/run.sh ${{ matrix.target }}
 
       - name: Test on NetBSD
-        uses: vmactions/netbsd-vm@v1
+        uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1.4.0
         if: contains(matrix.target, 'netbsd')
         with:
           release: "10.1"
@@ -338,20 +353,37 @@ jobs:
 
   docs:
     name: Ensure docs build
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - name: Install Rust
       run: rustup update nightly --no-self-update && rustup default nightly
-    - uses: Swatinem/rust-cache@v2
+    - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
     - run: cargo doc --workspace --no-deps
 
+  zizmor:
+    name: Zizmor (Static analysis for GitHub Actions)
+    runs-on: ubuntu-24.04
+    permissions:
+      security-events: write
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+
   # One job that "summarizes" the success state of this pipeline. This can then be added to branch
   # protection, rather than having to add each job separately.
   success:
     name: success
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     needs:
       - style_check
       - test_tier1
@@ -360,11 +392,14 @@ jobs:
       - verify_build
       - docs
       - clippy
-    # Github branch protection is exceedingly silly and treats "jobs skipped because a dependency
+      - zizmor
+    # GitHub branch protection is exceedingly silly and treats "jobs skipped because a dependency
     # failed" as success. So we have to do some contortions to ensure the job fails if any of its
     # dependencies fails.
     if: always() # make sure this is never "skipped"
+    env:
+      NEEDS: ${{ toJson(needs) }}
     steps:
       # Manually check the status of all dependencies. `if: failure()` does not work.
       - name: check if any dependency failed
-        run: jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+        run: jq --exit-status 'all(.result == "success")' <<< "$NEEDS"

.github/workflows/publish_0.2.yml

@@ -17,13 +17,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Install Rust (rustup)
         run: rustup update stable --no-self-update && rustup default stable
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@v0.5
+        uses: release-plz/action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5.130
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

Cargo.toml

@@ -5,7 +5,6 @@ keywords = ["libc", "ffi", "bindings", "operating", "system"]
 categories = ["external-ffi-bindings", "no-std", "os"]
 exclude = ["/ci/*", "/.github/*", "/triagebot.toml", "cherry-pick-stable.sh"]
 description = "Raw FFI bindings to platform libraries like libc."
-authors = ["The Rust Project Developers"]
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/rust-lang/libc"
@@ -184,14 +183,11 @@ members = [
     "libc-test",
 ]
 
-# FIXME(msrv): These should be renamed as `[workspace.lints.*]` once MSRV is above 1.64
-#       This way all crates can use it with `[lints] workspace=true` section
-
-[lints.rust]
+[workspace.lints.rust]
 # FIXME(cleanup): make ident usage consistent in each file
 unused_qualifications = "allow"
 
-[lints.clippy]
+[workspace.lints.clippy]
 # Enable pedantic lints - use this manually once in a while, but don't enable by default
 # pedantic = { level = "warn", priority = -1 }
 
@@ -211,6 +207,9 @@ uninlined_format_args = "allow"
 unnecessary_cast = "allow"  # some casts like `as usize` are only needed for some targets
 used_underscore_binding = "allow"
 
+[lints]
+workspace = true
+
 [package.metadata.cargo-semver-checks.lints]
 # Alignment is an internal detail that users must not rely upon
 repr_align_removed = "warn"

build.rs

@@ -131,6 +131,11 @@ fn main() {
         }
     }
 
+    let uclibc_use_time64 = env_flag("CARGO_CFG_LIBC_UNSTABLE_UCLIBC_TIME64");
+    if target_env == "uclibc" && uclibc_use_time64 {
+        set_cfg("linux_time_bits64");
+    }
+
     let linux_time_bits64 = env::var("RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64").is_ok();
     println!("cargo:rerun-if-env-changed=RUST_LIBC_UNSTABLE_LINUX_TIME_BITS64");
     if linux_time_bits64 {
@@ -151,10 +156,10 @@ fn main() {
         ) {
             (Ok(_), Ok(_)) => panic!("Do not set both RUST_LIBC_UNSTABLE_GNU_TIME_BITS and RUST_LIBC_UNSTABLE_GNU_FILE_OFFSET_BITS"),
             (Err(_), Err(_)) => (defaultbits.clone(), defaultbits.clone()),
-            (Ok(tb), Err(_)) if tb == "64" => (tb.clone(), tb.clone()),
+            (Ok(tb), Err(_)) if tb == "64" => (tb.clone(), tb),
             (Ok(tb), Err(_)) if tb == "32" => (tb, defaultbits.clone()),
             (Ok(_), Err(_)) => panic!("Invalid value for RUST_LIBC_UNSTABLE_GNU_TIME_BITS, must be 32 or 64"),
-            (Err(_), Ok(fb)) if fb == "32" || fb == "64" => (defaultbits.clone(), fb),
+            (Err(_), Ok(fb)) if fb == "32" || fb == "64" => (defaultbits, fb),
             (Err(_), Ok(_)) => panic!("Invalid value for RUST_LIBC_UNSTABLE_GNU_FILE_OFFSET_BITS, must be 32 or 64"),
         };
         let valid_bits = ["32", "64"];

ci/docker/armv7-unknown-linux-uclibceabihf/Dockerfile

@@ -14,11 +14,9 @@ RUN sed -i -E 's/(archive|security)\.ubuntu\.com/old-releases.ubuntu.com/g' \
         qemu-user \
         xz-utils
 
-RUN mkdir /toolchain
-
-RUN curl --retry 5 -L https://toolchains.bootlin.com/downloads/releases/toolchains/armv7-eabihf/tarballs/armv7-eabihf--uclibc--bleeding-edge-2021.11-1.tar.bz2 | \
-    tar xjf - -C /toolchain --strip-components=1
-RUN /toolchain/relocate-sdk.sh
+ARG TEST_UCLIBC_TIME64
+COPY install-uclibc.sh /
+RUN /install-uclibc.sh "$TEST_UCLIBC_TIME64"
 
 ENV PATH=$PATH:/rust/bin:/toolchain/bin \
     STAGING_DIR=/toolchain/armv7-buildroot-linux-uclibceabihf/sysroot \

ci/install-uclibc.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+#
+# Installs the appropriate uclibc toolchain into /toolchain
+
+set -eux
+
+time64="$1"
+
+if [ "${time64:-0}" != "0" ]; then
+    version='bleeding-edge-2025.08-1'
+else
+    version='bleeding-edge-2024.02-1'  # last version with 32-bit time_t
+fi
+
+mkdir /toolchain
+
+curl --retry 5 -L "https://toolchains.bootlin.com/downloads/releases/toolchains/armv7-eabihf/tarballs/armv7-eabihf--uclibc--${version}.tar.bz2" |
+tar xjf - -C /toolchain --strip-components=1
+
+/toolchain/relocate-sdk.sh