Identified a standalone AWS access key ID, with no AWS secret access key beside it. Graded low because a key ID is the public half of the credential and authenticates nothing on its own: the secret access key is what signs a request. It is still worth acting on. It names the AWS account and the IAM identity it was issued under, it shows this code reaches AWS with a long-lived key rather than a role, and it completes an attack if the matching secret leaked anywhere else. Check whether the key is still active and rotate it if it is.
1# This file contains definitions of CI job parameters that are loaded2# dynamically in CI from ci.yml.3runners:4 - &base-job5 env:6 # This force enables the new Cargo build-dir layout for all CI jobs.7 # The new layout will become the default soon so we enable it on everything8 # to catch issues as soon as possible.9 # See: https://github.com/rust-lang/cargo/issues/1501010 CARGO_UNSTABLE_BUILD_DIR_NEW_LAYOUT: true1112 - &job-linux-4c13 os: ubuntu-24.0414 # Free some disk space to avoid running out of space during the build.15 free_disk: true16 <<: *base-job1718 - &job-macos-1519 os: macos-15 # macOS 15 Arm6420 <<: *base-job2122 - &job-macos-2623 os: macos-26 # macOS 26 Arm6424 <<: *base-job2526 - &job-windows27 os: windows-202528 <<: *base-job2930 - &job-windows-8c31 os: windows-2025-8core-32gb32 <<: *base-job3334 - &job-windows-aarch6435 os: windows-11-arm36 <<: *base-job3738 - &job-aarch64-linux39 # Free some disk space to avoid running out of space during the build.40 free_disk: true41 os: ubuntu-24.04-arm42 <<: *base-job4344 - &job-linux-x86-8c-ec245 os: ec2-x86_64ami-m8a.2xlarge-x64-linux-$github.run_id-$github.run_attempt46 <<: *base-job4748 - &job-linux-x86-16c-ec249 os: ec2-x86_64ami-c8a.4xlarge-x64-linux-$github.run_id-$github.run_attempt50 <<: *base-job5152 - &job-linux-x86-32c-ec253 os: ec2-x86_64ami-c8a.8xlarge-x64-linux-$github.run_id-$github.run_attempt54 <<: *base-job5556 - &job-linux-aarch64-8c-ec257 os: ec2-arm64ami-m9g.2xlarge-aarch64-linux-$github.run_id-$github.run_attempt58 <<: *base-job5960 - &job-linux-aarch64-16c-ec261 os: ec2-arm64ami-c9g.4xlarge-aarch64-linux-$github.run_id-$github.run_attempt62 <<: *base-job6364envs:65 production:66 &production67 DEPLOY_BUCKET: rust-lang-ci268 # AWS_SECRET_ACCESS_KEYs are stored in GitHub's secrets storage, named69 # AWS_SECRET_ACCESS_KEY_<keyid>. Including the key id in the name allows to70 # rotate them in a single branch while keeping the old key in another71 # branch, which wouldn't be possible if the key was named with the kind72 # (caches, artifacts...).73 CACHES_AWS_ACCESS_KEY_ID: AKIA46X5W6CZI5DHEBFL74 ARTIFACTS_AWS_ACCESS_KEY_ID: AKIA46X5W6CZN24CBO5575 AWS_REGION: us-west-176 TOOLSTATE_PUBLISH: 17778 # Try builds started through `@bors try` (without specifying custom jobs79 # in the PR description) will be passed the `DIST_TRY_BUILD` environment80 # variable by citool.81 # This tells the `opt-dist` tool to skip building certain components82 # and skip running tests, so that the try build finishes faster.83 try:84 <<: *production8586 auto:87 <<: *production8889 pr:90 PR_CI_JOB: 19192jobs:93 dist-x86_64-linux: &job-dist-x86_64-linux94 name: dist-x86_64-linux95 env:96 IMAGE: dist-x86_64-linux97 CODEGEN_BACKENDS: llvm,cranelift98 DOCKER_SCRIPT: dist.sh99 dist-aarch64-linux: &job-dist-aarch64-linux100 name: dist-aarch64-linux101 env:102 IMAGE: dist-aarch64-linux103 CODEGEN_BACKENDS: llvm,cranelift104105106# Jobs that run on each push to a pull request (PR).107#108# These jobs automatically inherit envs.pr, to avoid repeating it in each job109# definition.110#111# PR CI jobs will be automatically registered as Auto CI jobs or overridden. When112# automatically registered, the PR CI job configuration will be copied as an113# Auto CI job but with `continue_on_error` overridden to `false` (to fail-fast).114# When overridden, `citool` will check for equivalence between the PR and CI job115# of the same name modulo `continue_on_error` and `env`.116pr:117 - name: test-pr-check-1118 <<: *job-linux-4c119 - name: test-pr-check-2120 <<: *job-linux-4c121 - name: test-tidy122 continue_on_error: true123 free_disk: false124 env:125 # This submodule is expensive to checkout, and it should not be needed for126 # tidy. This speeds up the PR CI job by ~1 minute.127 SKIP_SUBMODULES: src/gcc128 <<: *job-linux-4c129 - name: test-x86_64-gnu-llvm-22130 env:131 ENABLE_GCC_CODEGEN: "1"132 DOCKER_SCRIPT: x86_64-gnu-llvm.sh133 <<: *job-linux-4c134 - name: test-aarch64-gnu-llvm-22-1135 env:136 IMAGE: test-aarch64-gnu-llvm-22137 LLVM_VERSION: "22"138 DOCKER_SCRIPT: stage_2_test_set1.sh139 <<: *job-aarch64-linux140 - name: test-aarch64-gnu-llvm-22-2141 env:142 IMAGE: test-aarch64-gnu-llvm-22143 LLVM_VERSION: "22"144 DOCKER_SCRIPT: stage_2_test_set2.sh145 <<: *job-aarch64-linux146 - name: test-x86_64-gnu-tools147 <<: *job-linux-4c148 - name: test-x86_64-gnu-miri149 <<: *job-linux-4c150 - name: test-x86_64-gnu-gcc151 doc_url: https://rustc-dev-guide.rust-lang.org/tests/codegen-backend-tests/cg_gcc.html152 env:153 CODEGEN_BACKENDS: llvm,gcc154 <<: *job-linux-4c155 - name: test-x86_64-gnu-gcc-core-tests156 doc_url: https://rustc-dev-guide.rust-lang.org/tests/codegen-backend-tests/cg_gcc.html157 env:158 CODEGEN_BACKENDS: gcc159 <<: *job-linux-4c160161 # This job tests features we want to stabilize soon, to ensure they don't162 # regress.163 - name: test-x86_64-gnu-next-trait-solver-polonius164 doc_url: https://rustc-dev-guide.rust-lang.org/tests/x86_64-gnu-next-trait-solver-polonius-ci-job.html165 env:166 CODEGEN_BACKENDS: llvm167 <<: *job-linux-4c168169# Jobs that run when you perform a try build (@bors try)170# These jobs automatically inherit envs.try, to avoid repeating171# it in each job definition.172try:173 - <<: [*job-dist-x86_64-linux, *job-linux-x86-32c-ec2]174 name: dist-x86_64-linux-quick175 env:176 IMAGE: dist-x86_64-linux177 CODEGEN_BACKENDS: llvm,cranelift178 DOCKER_SCRIPT: dist.sh179 DIST_TRY_BUILD: 1180 - <<: [*job-dist-aarch64-linux, *job-linux-aarch64-16c-ec2]181 name: dist-aarch64-linux-quick182 env:183 IMAGE: dist-aarch64-linux184 CODEGEN_BACKENDS: llvm,cranelift185 DIST_TRY_BUILD: 1186187# Jobs that only run when explicitly invoked in one of the following ways:188# - comment `@bors try jobs=<job-name>`189# - `try-job: <job-name>` in the PR description and comment `@bors try`.190optional:191 # This job is used just to test optional jobs.192 # It will be replaced by tier 2 and tier 3 jobs in the future.193 - name: optional-test-pr-check-1194 env:195 IMAGE: test-pr-check-1196 <<: *job-linux-4c197 # Duplicate the try jobs here so that we can run them via jobs=...198 - <<: [*job-dist-x86_64-linux, *job-linux-x86-32c-ec2]199 name: dist-x86_64-linux-quick200 env:201 IMAGE: dist-x86_64-linux202 CODEGEN_BACKENDS: llvm,cranelift203 DOCKER_SCRIPT: dist.sh204 DIST_TRY_BUILD: 1205 - <<: [*job-dist-aarch64-linux, *job-linux-aarch64-16c-ec2]206 name: dist-aarch64-linux-quick207 env:208 IMAGE: dist-aarch64-linux209 CODEGEN_BACKENDS: llvm,cranelift210 DIST_TRY_BUILD: 1211212# Main CI jobs that have to be green to merge a commit into the default branch.213#214# These jobs automatically inherit envs.auto, to avoid repeating it in each job215# definition.216#217# Auto jobs may not specify `continue_on_error: true`, and thus will fail-fast.218#219# Unless explicitly overridden, PR CI jobs will be automatically registered as220# Auto CI jobs.221auto:222 #############################223 # Linux/Docker builders #224 #############################225226 - name: test-aarch64-gnu227 <<: *job-aarch64-linux228229 - name: test-aarch64-gnu-debug230 <<: *job-aarch64-linux231232 - name: test-arm-android233 <<: *job-linux-4c234235 - name: test-armhf-gnu236 <<: *job-linux-4c237238 - <<: [*job-dist-aarch64-linux, *job-linux-aarch64-16c-ec2]239240 - name: dist-android241 <<: *job-linux-4c242243 - name: dist-arm-linux-gnueabi244 <<: *job-linux-4c245246 - name: dist-arm-linux-musl247 <<: *job-linux-4c248249 - name: dist-armhf-linux250 <<: *job-linux-4c251252 - name: dist-armv7-linux253 <<: *job-linux-4c254255 - name: dist-i586-gnu-i586-i686-musl256 <<: *job-linux-4c257258 - name: dist-i686-linux259 <<: *job-linux-4c260261 - name: dist-loongarch64-linux262 <<: *job-linux-4c263264 - name: dist-loongarch64-musl265 <<: *job-linux-4c266267 - name: dist-ohos-aarch64268 <<: *job-linux-4c269270 - name: dist-ohos-armv7271 <<: *job-linux-4c272273 - name: dist-ohos-x86_64274 <<: *job-linux-4c275276 - name: dist-powerpc-linux277 <<: *job-linux-4c278279 - name: dist-powerpc64-linux-gnu280 <<: *job-linux-4c281282 - name: dist-powerpc64-linux-musl283 <<: *job-linux-4c284285 - name: dist-powerpc64le-linux-gnu286 <<: *job-linux-4c287288 - name: dist-powerpc64le-linux-musl289 <<: *job-linux-4c290291 - name: dist-riscv64-linux-gnu292 <<: *job-linux-4c293294 - name: dist-riscv64-linux-musl295 <<: *job-linux-4c296297 - name: dist-s390x-linux298 <<: *job-linux-4c299300 - name: dist-various-1301 <<: *job-linux-4c302303 - name: dist-various-2304 <<: *job-linux-4c305306 - name: dist-x86_64-freebsd307 <<: *job-linux-4c308309 - name: dist-aarch64-freebsd310 <<: *job-aarch64-linux311312 - name: dist-x86_64-illumos313 <<: *job-linux-4c314315 - <<: [*job-dist-x86_64-linux, *job-linux-x86-16c-ec2]316317 - name: dist-x86_64-linux-alt318 env:319 IMAGE: dist-x86_64-linux320 CODEGEN_BACKENDS: llvm,cranelift321 DOCKER_SCRIPT: dist-alt.sh322 <<: *job-linux-x86-8c-ec2323324 - name: dist-x86_64-musl325 env:326 CODEGEN_BACKENDS: llvm,cranelift327 <<: *job-linux-4c328329 - name: dist-x86_64-netbsd330 <<: *job-linux-4c331332 - name: dist-x86_64-solaris333 <<: *job-linux-4c334335 - name: dist-sparcv9-solaris336 <<: *job-linux-4c337338 # The i686-gnu job is split into multiple jobs to run tests in parallel.339 # i686-gnu-1 skips tests that run in i686-gnu-2.340 - name: test-i686-gnu-1341 env:342 IMAGE: test-i686-gnu343 DOCKER_SCRIPT: stage_2_test_set1.sh344 <<: *job-linux-4c345346 # Skip tests that run in i686-gnu-1347 - name: test-i686-gnu-2348 env:349 IMAGE: test-i686-gnu350 DOCKER_SCRIPT: stage_2_test_set2.sh351 <<: *job-linux-4c352353 # The i686-gnu-nopt job is split into multiple jobs to run tests in parallel.354 # i686-gnu-nopt-1 skips tests that run in i686-gnu-nopt-2355 - name: test-i686-gnu-nopt-1356 env:357 IMAGE: test-i686-gnu-nopt358 DOCKER_SCRIPT: stage_2_test_set1.sh359 <<: *job-linux-4c360361 # Skip tests that run in i686-gnu-nopt-1362 - name: test-i686-gnu-nopt-2363 env:364 IMAGE: test-i686-gnu-nopt365 DOCKER_SCRIPT: i686-gnu-nopt-2.sh366 <<: *job-linux-4c367368 - name: test-pr-check-1369 <<: *job-linux-4c370371 - name: test-pr-check-2372 <<: *job-linux-4c373374 - name: test-tidy375 free_disk: false376 <<: *job-linux-4c377378 - name: test-various379 <<: *job-linux-4c380381 # FIXME(#162999): temporarily disabled due to unauthenticated382 # servers getting overwhelmed383 #384 #- name: test-x86_64-fuchsia385 # # Only run this job on the nightly channel. Fuchsia requires386 # # nightly features to compile, and this job would fail if387 # # executed on beta and stable.388 # only_on_channel: nightly389 # doc_url: https://rustc-dev-guide.rust-lang.org/tests/fuchsia.html390 # <<: *job-linux-x86-8c-ec2391392 # Tests integration with Rust for Linux.393 # Builds stage 1 compiler and tries to compile a few RfL examples with it.394 - name: test-x86_64-rust-for-linux395 doc_url: https://rustc-dev-guide.rust-lang.org/tests/rust-for-linux.html396 <<: *job-linux-4c397398 - name: test-x86_64-gnu399 <<: *job-linux-4c400401 - name: test-x86_64-gnu-parallel-frontend402 doc_url: https://rustc-dev-guide.rust-lang.org/tests/x86_64-gnu-parallel-frontend.html403 env:404 DOCKER_SCRIPT: x86_64-gnu-parallel-frontend.sh405 <<: *job-linux-4c406407 # This job ensures commits landing on nightly still pass the full408 # test suite on the stable channel. There are some UI tests that409 # depend on the channel being built (for example if they include the410 # channel name on the output), and this builder prevents landing411 # changes that would result in broken builds after a promotion.412 - name: test-x86_64-gnu-stable413 # Only run this job on the nightly channel. Running this on beta414 # could cause failures when `dev: 1` in `stage0.txt`, and running415 # this on stable is useless.416 only_on_channel: nightly417 env:418 IMAGE: test-x86_64-gnu419 RUST_CI_OVERRIDE_RELEASE_CHANNEL: stable420 <<: *job-linux-4c421422 - name: test-x86_64-gnu-aux423 <<: *job-linux-4c424425 - name: test-x86_64-gnu-debug426 <<: *job-linux-4c427428 - name: test-x86_64-gnu-distcheck429 <<: *job-linux-4c430431 # The x86_64-gnu-llvm-22 job is split into multiple jobs to run tests in parallel.432 # x86_64-gnu-llvm-22-1 skips tests that run in x86_64-gnu-llvm-22-{2,3}.433 - name: test-x86_64-gnu-llvm-22-1434 env:435 RUST_BACKTRACE: 1436 IMAGE: test-x86_64-gnu-llvm-22437 LLVM_VERSION: "22"438 DOCKER_SCRIPT: stage_2_test_set2.sh439 <<: *job-linux-4c440441 # Skip tests that run in x86_64-gnu-llvm-22-{1,3}442 - name: test-x86_64-gnu-llvm-22-2443 env:444 RUST_BACKTRACE: 1445 IMAGE: test-x86_64-gnu-llvm-22446 LLVM_VERSION: "22"447 DOCKER_SCRIPT: x86_64-gnu-llvm2.sh448 <<: *job-linux-4c449450 # Skip tests that run in x86_64-gnu-llvm-22-{1,2}451 - name: test-x86_64-gnu-llvm-22-3452 env:453 RUST_BACKTRACE: 1454 IMAGE: test-x86_64-gnu-llvm-22455 LLVM_VERSION: "22"456 DOCKER_SCRIPT: x86_64-gnu-llvm3.sh457 <<: *job-linux-4c458459 - name: test-x86_64-gnu-nopt460 <<: *job-linux-4c461462 - name: test-x86_64-gnu-tools463 env:464 DEPLOY_TOOLSTATES_JSON: toolstates-linux.json465 <<: *job-linux-4c466467 - name: test-x86_64-gnu-miri468 <<: *job-linux-4c469470 - name: test-x86_64-gnu-stdlib-semver-check471 doc_url: https://rustc-dev-guide.rust-lang.org/tests/stdlib-semver-check.html472 <<: *job-linux-4c473474 - name: optional-test-x86_64-gnu-autodiff475 continue_on_error: true476 doc_url: https://rustc-dev-guide.rust-lang.org/tests/autodiff-ci-job.html477 <<: *job-linux-4c478479 ####################480 # macOS Builders #481 ####################482483 - name: dist-x86_64-apple484 env:485 SCRIPT: >-486 ./x.py dist bootstrap enzyme487 --include-default-paths488 --host=x86_64-apple-darwin489 --target=x86_64-apple-darwin490 RUST_CONFIGURE_ARGS: >-491 --enable-full-tools492 --enable-sanitizers493 --enable-profiler494 --disable-docs495 --set build.allocator=jemalloc496 --set llvm.link-shared=true497 --set rust.lto=thin498 --set rust.codegen-units=1499 # Ensure that host tooling is built to support our minimum support macOS version.500 MACOSX_DEPLOYMENT_TARGET: 10.12501 MACOSX_STD_DEPLOYMENT_TARGET: 10.12502 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer503 DIST_REQUIRE_ALL_TOOLS: 1504 CODEGEN_BACKENDS: llvm,cranelift505 <<: *job-macos-15506507 - name: dist-apple-various508 env:509 # Build and distribute the standard library for these targets.510 TARGETS: "aarch64-apple-ios,\511 aarch64-apple-ios-sim,\512 x86_64-apple-ios,\513 aarch64-apple-ios-macabi,\514 x86_64-apple-ios-macabi,\515 aarch64-apple-tvos,\516 aarch64-apple-tvos-sim,\517 aarch64-apple-visionos,\518 aarch64-apple-visionos-sim,\519 aarch64-apple-watchos,\520 aarch64-apple-watchos-sim"521 SCRIPT: ./x.py dist bootstrap --include-default-paths --host='' --target=$TARGETS522 # Mac Catalyst cannot currently compile the sanitizer:523 # https://github.com/rust-lang/rust/issues/129069524 #525 # And tvOS and watchOS don't currently support the profiler runtime:526 # https://github.com/rust-lang/rust/issues/152426527 RUST_CONFIGURE_ARGS: >-528 --enable-sanitizers529 --enable-profiler530 --set build.allocator=jemalloc531 --set target.aarch64-apple-ios-macabi.sanitizers=false532 --set target.x86_64-apple-ios-macabi.sanitizers=false533 --set target.aarch64-apple-tvos.profiler=false534 --set target.aarch64-apple-tvos-sim.profiler=false535 --set target.aarch64-apple-watchos.profiler=false536 --set target.aarch64-apple-watchos-sim.profiler=false537 # Ensure that host tooling is built to support our minimum support macOS version.538 # FIXME(madsmtm): This might be redundant, as we're not building host tooling here (?)539 MACOSX_DEPLOYMENT_TARGET: 10.12540 MACOSX_STD_DEPLOYMENT_TARGET: 10.12541 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer542 <<: *job-macos-15543544 - name: dist-aarch64-apple545 env:546 SCRIPT: >-547 ./x.py dist bootstrap enzyme548 --include-default-paths549 --host=aarch64-apple-darwin550 --target=aarch64-apple-darwin551 RUST_CONFIGURE_ARGS: >-552 --enable-full-tools553 --enable-sanitizers554 --enable-profiler555 --set build.allocator=jemalloc556 --set llvm.link-shared=true557 --set rust.lto=thin558 --set rust.codegen-units=1559 # Aarch64 tooling only needs to support macOS 11.0 and up as nothing else560 # supports the hardware.561 MACOSX_DEPLOYMENT_TARGET: 11.0562 MACOSX_STD_DEPLOYMENT_TARGET: 11.0563 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer564 DIST_REQUIRE_ALL_TOOLS: 1565 CODEGEN_BACKENDS: llvm,cranelift566 <<: *job-macos-15567568 - name: test-aarch64-apple-1569 env:570 # NOTE: keep in sync with `src/ci/docker/scripts/stage_2_test_set1.sh`571 SCRIPT: >-572 ./x.py --stage 2 test573 --host=aarch64-apple-darwin574 --target=aarch64-apple-darwin575 --skip compiler576 --skip src577 RUST_CONFIGURE_ARGS: >-578 --enable-sanitizers579 --enable-profiler580 --set build.allocator=jemalloc581 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer582 # Aarch64 tooling only needs to support macOS 11.0 and up as nothing else583 # supports the hardware, so only need to test it there.584 MACOSX_DEPLOYMENT_TARGET: 11.0585 MACOSX_STD_DEPLOYMENT_TARGET: 11.0586 <<: *job-macos-15587588 - name: test-aarch64-apple-2589 env:590 # NOTE: keep in sync with `src/ci/docker/scripts/stage_2_test_set2.sh`,591 # union `src/tools/cargo` specifically.592 SCRIPT: >-593 ./x.py --stage 2 test594 --host=aarch64-apple-darwin595 --target=aarch64-apple-darwin596 --skip tests597 --skip library598 --skip tidyselftest599 && ./x.py --stage 2 test600 --host=aarch64-apple-darwin601 --target=aarch64-apple-darwin602 src/tools/cargo603 RUST_CONFIGURE_ARGS: >-604 --enable-sanitizers605 --enable-profiler606 --set build.allocator=jemalloc607 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer608 # Aarch64 tooling only needs to support macOS 11.0 and up as nothing else609 # supports the hardware, so only need to test it there.610 MACOSX_DEPLOYMENT_TARGET: 11.0611 MACOSX_STD_DEPLOYMENT_TARGET: 11.0612 <<: *job-macos-15613614 # EXPERIMENT(#157687): we will try to run `aarch64-apple`-equivalent workload615 # on `macos-26` runner images in parallel to evaluate the running times, since616 # previous attempts have timed out multiple times. Remove/revert this job if617 # this hangs or times out, or if it becomes the slowest Merge CI job, and let618 # T-infra know.619 - name: test-aarch64-apple-macos-26-1620 doc_url: https://github.com/rust-lang/rust/issues/157687621 env:622 # NOTE: keep in sync with `src/ci/docker/scripts/stage_2_test_set1.sh`623 SCRIPT: >-624 ./x.py --stage 2 test625 --host=aarch64-apple-darwin626 --target=aarch64-apple-darwin627 --skip compiler628 --skip src629 RUST_CONFIGURE_ARGS: >-630 --enable-sanitizers631 --enable-profiler632 --set rust.jemalloc633 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer634 # Aarch64 tooling only needs to support macOS 11.0 and up as nothing else635 # supports the hardware, so only need to test it there.636 MACOSX_DEPLOYMENT_TARGET: 11.0637 MACOSX_STD_DEPLOYMENT_TARGET: 11.0638 <<: *job-macos-26639640 - name: test-aarch64-apple-macos-26-2641 doc_url: https://github.com/rust-lang/rust/issues/157687642 env:643 # NOTE: keep in sync with `src/ci/docker/scripts/stage_2_test_set2.sh`,644 # union `src/tools/cargo` specifically.645 SCRIPT: >-646 ./x.py --stage 2 test647 --host=aarch64-apple-darwin648 --target=aarch64-apple-darwin649 --skip tests650 --skip library651 --skip tidyselftest652 && ./x.py --stage 2 test653 --host=aarch64-apple-darwin654 --target=aarch64-apple-darwin655 src/tools/cargo656 RUST_CONFIGURE_ARGS: >-657 --enable-sanitizers658 --enable-profiler659 --set rust.jemalloc660 DEVELOPER_DIR: /Applications/Xcode_26.2.app/Contents/Developer661 # Aarch64 tooling only needs to support macOS 11.0 and up as nothing else662 # supports the hardware, so only need to test it there.663 MACOSX_DEPLOYMENT_TARGET: 11.0664 MACOSX_STD_DEPLOYMENT_TARGET: 11.0665 <<: *job-macos-26666667 ######################668 # Windows Builders #669 ######################670671 # x86_64-msvc is split into two jobs to run tests in parallel.672 - name: test-x86_64-msvc-1673 # required to run LLDB 22674 required_python_version: '3.11'675 env:676 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-sanitizers --enable-profiler677 SCRIPT: make ci-msvc-py678 LLDB_PATH: ./citools/clang-rust/bin/lldb.exe679 <<: *job-windows680681 - name: test-x86_64-msvc-2682 env:683 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-sanitizers --enable-profiler684 SCRIPT: make ci-msvc-ps1685 <<: *job-windows686687 - name: test-i686-msvc688 env:689 RUST_CONFIGURE_ARGS:690 --build=x86_64-pc-windows-msvc691 --host=692 --target=i686-pc-windows-msvc693 --enable-sanitizers694 SCRIPT: make ci-msvc695 <<: *job-windows696697 # aarch64-msvc is split into two jobs to run tests in parallel.698 - name: test-aarch64-msvc-1699 env:700 RUST_CONFIGURE_ARGS: --build=aarch64-pc-windows-msvc701 SCRIPT: make ci-msvc-py702 <<: *job-windows-aarch64703704 - name: test-aarch64-msvc-2705 env:706 RUST_CONFIGURE_ARGS: --build=aarch64-pc-windows-msvc707 SCRIPT: make ci-msvc-ps1708 <<: *job-windows-aarch64709710 # x86_64-msvc-ext is split into multiple jobs to run tests in parallel.711 - name: test-x86_64-msvc-ext1712 env:713 SCRIPT: python x.py --stage 2 test src/tools/cargotest src/tools/cargo714 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-lld715 <<: *job-windows716717 # Temporary builder to workaround CI issues718 # See <https://github.com/rust-lang/rust/issues/127883>719 #FIXME: Remove this, and re-enable the same tests in `checktools.sh`, once CI issues are fixed.720 - name: test-x86_64-msvc-ext2721 env:722 SCRIPT: >723 python x.py test --stage 2 miri --target x86_64-apple-darwin --test-args pass &&724 python x.py test --stage 2 miri --target x86_64-pc-windows-gnu --test-args pass &&725 python x.py miri --stage 2 library/core --test-args notest &&726 python x.py miri --stage 2 library/alloc --test-args notest &&727 python x.py miri --stage 2 library/std --test-args notest728 # The last 3 lines smoke-test `x.py miri`. This doesn't run any actual tests (that would take729 # too long), but it ensures that the crates build properly when tested with Miri.730 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-lld731 <<: *job-windows732733 # Run `checktools.sh` and upload the toolstate file.734 - name: test-x86_64-msvc-ext3735 env:736 SCRIPT: src/ci/docker/host-x86_64/test-x86_64-gnu-tools/checktools.sh x.py /tmp/toolstate/toolstates.json windows737 HOST_TARGET: x86_64-pc-windows-msvc738 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-lld --save-toolstates=/tmp/toolstate/toolstates.json739 DEPLOY_TOOLSTATES_JSON: toolstates-windows.json740 <<: *job-windows741742 # 32/64-bit MinGW builds.743 #744 # We are using MinGW with POSIX threads since LLVM requires745 # C++'s std::thread which is disabled in libstdc++ with win32 threads.746 # FIXME: Libc++ doesn't have this limitation so we can avoid747 # winpthreads if we switch to it.748 #749 # Instead of relying on the MinGW version installed on CI we download750 # and install one ourselves so we won't be surprised by changes to CI's751 # build image.752 #753 # Finally, note that the downloads below are all in the `rust-lang-ci` S3754 # bucket, but they clearly didn't originate there! The downloads originally755 # came from the mingw-w64 SourceForge download site. Unfortunately756 # SourceForge is notoriously flaky, so we mirror it on our own infrastructure.757758 # x86_64-mingw is split into two jobs to run tests in parallel.759 - name: test-x86_64-mingw-1760 # required to run LLDB 22761 required_python_version: '3.11'762 env:763 SCRIPT: make ci-mingw-x764 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-gnu765 LLDB_PATH: ./citools/clang-rust/bin/lldb.exe766 <<: *job-windows767768 - name: test-x86_64-mingw-2769 env:770 SCRIPT: make ci-mingw-bootstrap771 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-gnu772 <<: *job-windows773774 - name: dist-x86_64-msvc775 env:776 RUST_CONFIGURE_ARGS: >-777 --build=x86_64-pc-windows-msvc778 --host=x86_64-pc-windows-msvc779 --target=x86_64-pc-windows-msvc780 --enable-full-tools781 --enable-profiler782 --set rust.codegen-units=1783 SCRIPT: python x.py build --set rust.debug=true opt-dist && PGO_HOST=x86_64-pc-windows-msvc ./build/x86_64-pc-windows-msvc/stage1-tools-bin/opt-dist windows-ci -- python x.py dist bootstrap --include-default-paths784 DIST_REQUIRE_ALL_TOOLS: 1785 CODEGEN_BACKENDS: llvm,cranelift786 <<: *job-windows-8c787788 - name: dist-i686-msvc789 env:790 RUST_CONFIGURE_ARGS: >-791 --build=x86_64-pc-windows-msvc792 --host=793 --target=i686-pc-windows-msvc794 --enable-profiler795 SCRIPT: python x.py dist bootstrap --include-default-paths796 CODEGEN_BACKENDS: llvm797 <<: *job-windows798799 - name: dist-aarch64-msvc800 env:801 RUST_CONFIGURE_ARGS: >-802 --build=aarch64-pc-windows-msvc803 --host=aarch64-pc-windows-msvc804 --target=aarch64-pc-windows-msvc,arm64ec-pc-windows-msvc805 --enable-full-tools806 --enable-profiler807 SCRIPT: python x.py dist bootstrap --include-default-paths808 DIST_REQUIRE_ALL_TOOLS: 1809 <<: *job-windows-aarch64810811 - name: dist-i686-mingw812 env:813 RUST_CONFIGURE_ARGS: >-814 --build=x86_64-pc-windows-gnu815 --host=816 --target=i686-pc-windows-gnu817 --disable-docs818 --set target.i686-pc-windows-gnu.linker=i686-w64-mingw32-gcc819 SCRIPT: python x.py dist bootstrap --include-default-paths820 CODEGEN_BACKENDS: llvm821 <<: *job-windows822823 - name: dist-x86_64-mingw824 env:825 SCRIPT: python x.py dist bootstrap --include-default-paths826 RUST_CONFIGURE_ARGS: >-827 --build=x86_64-pc-windows-gnu828 --enable-full-tools829 DIST_REQUIRE_ALL_TOOLS: 1830 CODEGEN_BACKENDS: llvm,cranelift831 <<: *job-windows832833 # i686 has no dedicated job, build it here because this job is fast834 - name: dist-aarch64-llvm-mingw835 env:836 SCRIPT: python x.py dist bootstrap enzyme --include-default-paths837 RUST_CONFIGURE_ARGS: >-838 --build=aarch64-pc-windows-gnullvm839 --target=aarch64-pc-windows-gnullvm,i686-pc-windows-gnullvm840 --enable-full-tools841 --enable-profiler842 --enable-llvm-link-shared843 DIST_REQUIRE_ALL_TOOLS: 1844 CODEGEN_BACKENDS: llvm,cranelift845 CC_i686_pc_windows_gnullvm: i686-w64-mingw32-clang846 <<: *job-windows-aarch64847848 - name: dist-x86_64-llvm-mingw849 env:850 SCRIPT: python x.py dist bootstrap enzyme --include-default-paths851 RUST_CONFIGURE_ARGS: >-852 --build=x86_64-pc-windows-gnullvm853 --enable-full-tools854 --enable-profiler855 --enable-llvm-link-shared856 DIST_REQUIRE_ALL_TOOLS: 1857 CODEGEN_BACKENDS: llvm,cranelift858 <<: *job-windows859860 - name: dist-x86_64-msvc-alt861 env:862 RUST_CONFIGURE_ARGS: --build=x86_64-pc-windows-msvc --enable-extended --enable-profiler863 SCRIPT: python x.py dist bootstrap --include-default-paths864 <<: *job-windows
Security findings 2
Identified a standalone AWS access key ID, with no AWS secret access key beside it. Graded low because a key ID is the public half of the credential and authenticates nothing on its own: the secret access key is what signs a request. It is still worth acting on. It names the AWS account and the IAM identity it was issued under, it shows this code reaches AWS with a long-lived key rather than a role, and it completes an attack if the matching secret leaked anywhere else. Check whether the key is still active and rotate it if it is.