cargo: drop shared musl rustflags; each repo owns its rustflags

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code

[HarryR]

What

Remove the musl [target.*] rustflags from the workspace-shared /src/.cargo/config.toml, leaving only the workspace-wide [env] SOURCE_DATE_EPOCH. Rustflags now live in each repo's own .cargo/config.toml.

Why

The sibling repos (stage0 #8, stage1 #17) are dropping the global ENV RUSTFLAGS from their Dockerfile.build in favor of per-target .cargo/config.toml. That global env var was load-bearing: it overrode all config rustflags uniformly, masking two problems that surface once it's gone:

• CI reproducibility: CI checks out each repo alone, with no workspace parent and CARGO_HOME redirected to an empty dir, so this shared file is never present in CI. A repo relying on it would build differently in CI than locally.
• Cargo concatenates rustflags across config files (a sub-repo's does not override the workspace's, contrary to the old comment here). A musl repo that also declares its own rustflags (stage1, os402) got them doubled, changing every binary's -Cmetadata and thus its bytes.

Keeping only [env] here, with each repo self-sufficient, makes dev and CI load an identical single flag set.

Impact

• stage0, stage1, os402 — self-sufficient (own configs). stage0 gains one in its PR.
• vaportpm, vaportpm-zk — gnu-host by default; unaffected unless they manually --target musl, in which case they now add their own rustflags.

Verification

With the repo Dockerfiles dropping their RUSTFLAGS and this change in place, the measured binaries hash identically to before: stage0.efi, ena.efi, payload.efi, stage1, stage2, and the linux.efi UKI. stage0 smoke-boot 5/5 and the stage1 chain (SIGN=1 / MANIFEST=1 / SIGN_ARGS=1) pass.

Merge alongside lockboot/stage0#8 and lockboot/stage1#17.

🤖 Generated with Claude Code