Update Rust to v1.60 (#1615)

- Updates the debian base from `buster` to `bullseye`;
- Bumps the devcontainer version;
- Removes the `update-rust-version.sh` script, since it's too brittle
  and isn't necessary any longer (since we check rust versions in CI);
- Updates checksec to v2.5.;
- Acknowledges that releases no longer produces binaries with
  `FORTIFY_SOURCE`

Signed-off-by: Oliver Gould <[email protected]>

Author: olix0r

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG RUST_VERSION=1.59.0
+ARG RUST_VERSION=1.60.0
 
 FROM docker.io/rust:${RUST_VERSION}-bullseye as kubectl
 ARG KUBECTL_VERSION=v1.23.2
@@ -18,6 +18,10 @@ ARG YQ_VERSION=v4.2.0
 RUN curl --proto '=https' --tlsv1.3 -vsSfLo /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" \
     && chmod +x /usr/local/bin/yq
 
+FROM docker.io/rust:${RUST_VERSION}-bullseye as checksec
+ARG CHECKSEC_VERSION=2.5.0
+RUN cd /usr/local/bin && curl -vsLO "https://raw.githubusercontent.com/slimm609/checksec.sh/${CHECKSEC_VERSION}/checksec" && chmod 755 checksec
+
 FROM docker.io/rust:${RUST_VERSION}-bullseye as nightly
 RUN rustup toolchain add nightly
 
@@ -78,6 +82,7 @@ COPY --from=cargo-deny /usr/local/bin/cargo-deny /usr/local/bin/cargo-deny
 COPY --from=k3d /usr/local/bin/k3d /usr/local/bin/k3d
 COPY --from=kubectl /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY --from=yq /usr/local/bin/yq /usr/local/bin/yq
+COPY --from=checksec /usr/local/bin/checksec /usr/local/bin/checksec
 COPY --from=nightly /usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu /usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu
 COPY --from=fuzz /usr/local/cargo/bin/cargo-fuzz /usr/local/cargo/bin/cargo-fuzz
 

.devcontainer/devcontainer.json

@@ -1,6 +1,6 @@
 {
 	"name": "linkerd2-proxy",
-	"image": "ghcr.io/linkerd/dev-proxy:v9",
+	"image": "ghcr.io/linkerd/dev-proxy:v10",
 	// "dockerFile": "./Dockerfile",
 	"extensions": [
 		"matklad.rust-analyzer",

.github/actions/list-changed-crates/Dockerfile

@@ -1,4 +1,4 @@
-ARG RUST_VERSION=1.59.0
+ARG RUST_VERSION=1.60.0
 FROM docker.io/library/rust:${RUST_VERSION}-bullseye
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt update && \

.github/actions/package/Dockerfile

@@ -1,5 +1,5 @@
-ARG RUST_VERSION=1.59.0
-ARG BASE_IMAGE=rust:${RUST_VERSION}-buster
+ARG RUST_VERSION=1.60.0
+ARG BASE_IMAGE=rust:${RUST_VERSION}-bullseye
 FROM $BASE_IMAGE
 WORKDIR /linkerd
 RUN apt-get update && \
@@ -11,7 +11,8 @@ RUN apt-get update && \
     apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/
 ENV CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc
 ENV CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER=arm-linux-gnueabihf-gcc
-# v2.1.0
-ARG CHECKSEC_SHA=04582bad41589ad479ca8b1f0170ed317475b5a5
-RUN cd /usr/local/bin && curl -vsLO "https://raw.githubusercontent.com/slimm609/checksec.sh/$CHECKSEC_SHA/checksec" && chmod 755 checksec
+ARG CHECKSEC_VERSION=2.5.0
+RUN cd /usr/local/bin && \
+    curl -vsLO "https://raw.githubusercontent.com/slimm609/checksec.sh/${CHECKSEC_VERSION}/checksec" && \
+    chmod 755 checksec
 COPY expected-checksec.json validate-checksec.sh /linkerd/

.github/actions/package/expected-checksec.json

@@ -1,6 +1,6 @@
 {
   "canary": "yes",
-  "fortify_source": "yes",
+  "fortify_source": "no",
   "nx": "yes",
   "pie": "yes",
   "relro": "full",

.github/workflows/beta.yml

@@ -23,7 +23,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
     timeout-minutes: 20
     continue-on-error: true
     steps:

.github/workflows/check-all.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 20
     runs-on: ubuntu-latest
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
     steps:
       - run: |
           curl --proto =https --tlsv1.3 -vsSfLo /usr/local/bin/cargo-action-fmt "https://github.com/olix0r/cargo-action-fmt/releases/download/release%2F${CARGO_ACTION_FMT_VERSION}/cargo-action-fmt-x86_64-unknown-linux-gnu"

.github/workflows/check-each.yml

@@ -51,7 +51,7 @@ jobs:
     timeout-minutes: 20
     runs-on: ubuntu-latest
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
     strategy:
       matrix:
         crate: ${{ fromJson(needs.list-changed-crates.outputs.crates) }}

.github/workflows/coverage.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
       options: --security-opt seccomp=unconfined # 🤷
     steps:
       - run: apt update && apt install -y cmake clang golang # for boring

.github/workflows/fuzzers.yml

@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ubuntu-latest
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
     steps:
       - run: apt update && apt install -y jo
       - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
@@ -79,7 +79,7 @@ jobs:
     timeout-minutes: 40
     runs-on: ubuntu-latest
     container:
-      image: docker://rust:1.59.0-buster
+      image: docker://rust:1.60.0-bullseye
     strategy:
       matrix:
         dir: ${{ fromJson(needs.list-changed.outputs.dirs) }}