[scarmuega]

Summary

Boros does not build from a clean checkout. Cargo.lock is gitignored, so every build resolves dependencies fresh, pallas floats to 1.4.0, and src/ledger/u5c/mod.rs fails with 10 errors (boros decision 0002). That covers the image job in build.yml, so no boros image can be built today, including one with patched TLS trust.

This PR:

• removes Cargo.lock from .gitignore and commits a lockfile that pins pallas to 1.0.0-alpha.2, the last resolution that compiles. Every other dependency is at its latest compatible release;

• keeps the rustls trust components at the eMudhra distrust floor: rustls 0.23.46, rustls-webpki 0.103.16, webpki-roots 1.0.10 and 0.26.11 (which re-exports 1.x). The lockfile has no webpki 0.21/0.22 and no rustls older than 0.23;

• builds the Dockerfile with cargo build --release --locked, so the image uses the committed resolution;

• moves the builder image from rust:1.85.0-slim-bullseye to rust:1.98.0-slim-bookworm. The Dockerfile was already unbuildable for two reasons:

  • bullseye's LTS ended, and deb.debian.org still lists bullseye-security packages it no longer serves, so apt install returns 404 (the same rot oura#958 fixed);
  • the current resolution needs rustc ≥ 1.88 (psm, serde_with, time, icu_*). A resolution capped at 1.85 still does not compile, because ar_archive_writer 0.5.x uses let-chains.

  The runtime base, debian:stable-slim, is unchanged.

It does not migrate to pallas 1.4. That follow-up belongs to decision 0002.

Verification (head 5fc95d6)

• Trust-floor check on Cargo.lock: at floor.
• cargo build --locked (rust 1.98.0): passes.
• cargo test --locked: 32 passed, 1 failed. The failure is network::...::it_should_demonstrate_processing_speed_differences, which binds fixed ports 3001/3002. An unrelated local process already holds 127.0.0.1:3001, so the handshake fails. CI runs on a clean host.
• docker buildx build --platform linux/amd64 from a git archive of the head passes (--locked release build in 29m under emulation). The binary starts in the image.

Pre-existing, unrelated to this PR

• cargo clippy -- -D warnings (current stable) reports 6 errors, all in source this PR does not touch: an unused import, the unused FanoutError enum, and four result_large_err errors on tonic::Status.
• cargo fmt --check reports diffs in unchanged source files.
• The runtime image (debian:stable-slim, Debian 13.7) does not install ca-certificates. TLS trust comes from the bundled webpki-roots. The tonic tls-roots feature has no system store to read.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Cargo lockfiles are now included in version control rather than ignored.
  • Release builds now use Rust 1.98 on Debian Bookworm.
  • Builds require the committed lockfile to ensure consistent dependency versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 358d306e-cd75-405e-8e30-0cedc66e30f3

📥 Commits

Reviewing files that changed from the base of the PR and between fdec4da and 5fc95d6.

⛔ Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing: 2

• .gitignore
• Dockerfile

💤 Files with no reviewable changes: 1

• .gitignore

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The pull request removes the Cargo.lock ignore rule and updates the Docker build image to Rust 1.98.0 on slim Bookworm. Release builds now use Cargo’s --locked option.

Changes: Container build and lockfile

Layer / File(s)	Summary
Lockfile-enforced Docker build .gitignore, Dockerfile	The .gitignore no longer excludes Cargo.lock. The Docker build image changes from Rust 1.85.0 on slim Bullseye to Rust 1.98.0 on slim Bookworm. Release builds use Cargo’s --locked option.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: paulobressan

Merge Risk: ⚪ Minimal · up to 5fc95

No merge-blocking defect was established in the reproducible container build changes.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes: committing Cargo.lock and enforcing locked Docker builds.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[scarmuega]

QA review record

Pass: first pass, head 5fc95d69f634bb0353095b78189118787300dc59.

Diff in scope: fdec4da..5fc95d6.

• .gitignore: 4 lines removed.
• Dockerfile: 2 lines changed.
• Cargo.lock: added, 4610 generated lines.

Size class: small. Apart from the generated lockfile, only 6 lines change, and no Rust source changes.

Lenses

• Run: correctness, state and resources, conformance, test adequacy, fresh eyes and dependencies. Dependencies is triggered by the lockfile.
• Skipped:
  • Security: the PR changes no input parsing, auth, secrets or network-exposure code. The dependencies lens covered the TLS trust crates.
  • Errors and observability, compatibility, persistence: the PR changes no service code, public API, config key or stored format. The state lens covered the stored-format effects of the new resolution (sqlx migrations and .sqlx offline data across 0.8.x).
  • Bounded-context lenses: boros declares none.
• Independence: each reviewer and each refuter ran in its own fresh context. Nothing was degraded.

Checks at the exact head

• Trust floor: the umbrella's check on 5fc95d6:Cargo.lock prints at floor. Locked versions are rustls 0.23.46, rustls-webpki 0.103.16, and webpki-roots 1.0.10 and 0.26.11. There is no webpki crate. Every pallas-* crate is at 1.0.0-alpha.2.
• Local build: cargo build --locked passes in a clean workspace.
• Dependencies: cargo deny --locked check advisories (advisory DB of 2026-10-21) reports no vulnerable, unsound or yanked crates. All 445 registry versions exist on crates.io and none is yanked.
• Runtime image: the lock has no openssl-sys, native-tls or sasl crates. A binary built on bookworm (glibc 2.36) runs on the debian:stable-slim runtime (trixie).
• CI Test (run 39633300330): success, 33/33.
  • The runner used the committed lock unchanged: no Locking line in the log, and it compiled pallas 1.0.0-alpha.2.
• CI Clippy (run 39633300187): failure. This is pre-existing.
  • It reports 6 errors, all in source this PR does not touch: an unused error import, the unused FanoutError enum, and 4× result_large_err.
  • Before this PR, Clippy and Test failed on pallas 1.4.0 compile errors instead.
  • main has no branch protection, so no check is formally required.
• Docker: the producer's amd64 docker buildx build from git archive 5fc95d6 exited 0, and the binary started in the image.

Findings

• Confirmed against this PR: none.
• Plausible: none.
• Confirmed, but pre-existing and outside the plan's scope (not open against this PR): the docs install line docs/app/installation/from_source/page.mdx:20 runs cargo install --path=. without --locked.
  • cargo install ignores Cargo.lock without --locked. On the PR head it printed Locking 460 packages to latest compatible versions.
  • pallas = "1.0.0-alpha.2" admits 1.4.0, so a from-source install still resolves fresh and hits the pallas 1.4 compile errors.
  • That doc line was last changed in e5ed414 and the PR doesn't make it worse.
  • Suggested follow-up: add --locked to that line.
• Refuted (4): each is about CI policy that predates this PR or about future PRs, and this PR leaves .github/ untouched.
  • test.yml and clippy.yml run without --locked. Before this PR there was no lock at all, and a later mismatch would stop at the --locked Docker build.
  • build.yml never builds the Dockerfile on PRs. That is pre-existing, and the plan's local docker build test is met.
  • CI uses the runner's Rust while the Dockerfile pins one. That gap existed with 1.85 too, and this head passes under both.
  • No CI gate checks the trust floor. The plan's done-when asks only for a one-off check on this head, which passes. A gate is a possible follow-up for the umbrella owner.

PR conversation

• One CodeRabbit notice that it skipped the draft. No action needed.
• No review threads and no reviews.

Normalization

• No comment changes were warranted. The diff adds no code comments.

Outcome

passed. The PR stays draft.

[scarmuega]

Merge observed.

Plan: plans/emudhra-distrust-rust-boros.md
QA-approved head: 5fc95d69f634bb0353095b78189118787300dc59

Trellis will verify the human merge evidence, adopt the domain pin, and retire the plan. No further merge action is needed.