Merge branch 'pin-rust-version-and-allow-automatic-install-of-right-des-554'

22 files changed, 29 insertions, 142 deletions

diff --git a/.github/workflows/android-audit.yml b/.github/workflows/android-audit.yml
index e949d62de9..68884ae526 100644
--- a/.github/workflows/android-audit.yml
+++ b/.github/workflows/android-audit.yml
@@ -37,8 +37,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
diff --git a/.github/workflows/android-kotlin-format-check.yml b/.github/workflows/android-kotlin-format-check.yml
index 31bfc9af3c..9960339098 100644
--- a/.github/workflows/android-kotlin-format-check.yml
+++ b/.github/workflows/android-kotlin-format-check.yml
@@ -27,8 +27,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
diff --git a/.github/workflows/cargo-vendor.yml b/.github/workflows/cargo-vendor.yml
index 14d2da7790..31177c725d 100644
--- a/.github/workflows/cargo-vendor.yml
+++ b/.github/workflows/cargo-vendor.yml
@@ -23,11 +23,5 @@ jobs:
         with:
           submodules: true
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Vendor Rust dependencies
         run: cargo vendor
diff --git a/.github/workflows/clippy.yml b/.github/workflows/clippy.yml
index ec1ccb030e..218eeeef23 100644
--- a/.github/workflows/clippy.yml
+++ b/.github/workflows/clippy.yml
@@ -25,8 +25,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image_android=$(cat ./building/android-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image_android: ${{ env.inner_container_image_android }}
@@ -51,12 +50,6 @@ jobs:
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |
diff --git a/.github/workflows/daemon.yml b/.github/workflows/daemon.yml
index f37b6c6d54..8e22397b9c 100644
--- a/.github/workflows/daemon.yml
+++ b/.github/workflows/daemon.yml
@@ -49,8 +49,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -79,9 +78,15 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --depth=1 dist-assets/binaries
           git submodule update --init --recursive --depth=1 wireguard-go-rs
-      # The container image already has rustup and Rust, but only the stable toolchain
+
+      # The container image already has rustup and the pinned version of Rust
       - name: Install Rust toolchain
-        run: rustup default ${{ matrix.rust }}
+        # When running this job for "stable" test against our pinned rust version
+        # instead of the stable channel.
+        # TODO: Improve this so both "stable" and the pinned version are tested if
+        # they differ.
+        if: ${{ matrix.rust != 'stable' }}
+        run: rustup override set ${{ matrix.rust }}
 
       - name: Build and test crates
         run: ./ci/check-rust.sh
@@ -102,12 +107,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Install Go
         uses: actions/setup-go@v3
         with:
@@ -168,17 +167,10 @@ jobs:
       # TODO: Remove once fixed
       - name: Install Rust x64 target
         if: ${{ matrix.config.arch == 'arm64' }}
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: x86_64-pc-windows-msvc
+        run: rustup target add x86_64-pc-windows-msvc
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
 
       - name: Install msbuild
         uses: microsoft/setup-msbuild@v1.0.2
diff --git a/.github/workflows/desktop-e2e.yml b/.github/workflows/desktop-e2e.yml
index a23cdbd602..2a334ab52d 100644
--- a/.github/workflows/desktop-e2e.yml
+++ b/.github/workflows/desktop-e2e.yml
@@ -195,11 +195,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: i686-pc-windows-msvc
-          default: true
+        run: rustup target add i686-pc-windows-msvc
       - name: Install latest zig
         uses: mlugg/setup-zig@v1
       - name: Install msbuild
@@ -287,11 +283,6 @@ jobs:
           node-version-file: desktop/package.json
           cache: 'npm'
           cache-dependency-path: desktop/package-lock.json
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
       - name: Build app
         run: ./build.sh
       - name: Build test executable
diff --git a/.github/workflows/frontend.yml b/.github/workflows/frontend.yml
index 8b80e3b5e0..a65f3523f9 100644
--- a/.github/workflows/frontend.yml
+++ b/.github/workflows/frontend.yml
@@ -24,13 +24,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-          profile: minimal
-
       - name: Setup node
         uses: actions/setup-node@v4
         with:
diff --git a/.github/workflows/ios-build-xcode-16.yml b/.github/workflows/ios-build-xcode-16.yml
index e871046310..cc8f6ac205 100644
--- a/.github/workflows/ios-build-xcode-16.yml
+++ b/.github/workflows/ios-build-xcode-16.yml
@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-end-to-end-tests.yml b/.github/workflows/ios-end-to-end-tests.yml
index f177c28bf0..bbc70d8588 100644
--- a/.github/workflows/ios-end-to-end-tests.yml
+++ b/.github/workflows/ios-end-to-end-tests.yml
@@ -99,11 +99,7 @@ jobs:
           ref: ${{ env.COMMIT_HASH }}
 
       - name: Configure Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          override: true
-          target: aarch64-apple-ios
+        run: rustup target add aarch64-apple-ios
 
       - name: Build iOS end to end tests action
         uses: ./.github/actions/build-ios-e2e-tests
diff --git a/.github/workflows/ios-rust-ffi.yml b/.github/workflows/ios-rust-ffi.yml
index 07c52412a6..6d1457d4f1 100644
--- a/.github/workflows/ios-rust-ffi.yml
+++ b/.github/workflows/ios-rust-ffi.yml
@@ -26,11 +26,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Build and test crates
         shell: bash
@@ -58,11 +54,7 @@ jobs:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          target: ${{ matrix.target }}
-          default: true
+        run: rustup target add ${{ matrix.target }}
 
       - name: Clippy check
         shell: bash
diff --git a/.github/workflows/ios-screenshots-creation.yml b/.github/workflows/ios-screenshots-creation.yml
index 64c64ac270..e842b08c1f 100644
--- a/.github/workflows/ios-screenshots-creation.yml
+++ b/.github/workflows/ios-screenshots-creation.yml
@@ -33,10 +33,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-screenshots-tests.yml b/.github/workflows/ios-screenshots-tests.yml
index bef9a9ab02..93084a8b14 100644
--- a/.github/workflows/ios-screenshots-tests.yml
+++ b/.github/workflows/ios-screenshots-tests.yml
@@ -45,10 +45,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim
+        run: rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios-validate-build-schemas.yml b/.github/workflows/ios-validate-build-schemas.yml
index 8b40e71b4e..fc0f6a7b86 100644
--- a/.github/workflows/ios-validate-build-schemas.yml
+++ b/.github/workflows/ios-validate-build-schemas.yml
@@ -46,10 +46,7 @@ jobs:
         with:
           xcode-version: '16.1'
       - name: Configure Rust
-        run: |
-          rustup default stable
-          rustup update stable
-          rustup target add aarch64-apple-ios-sim x86_64-apple-ios
+        run: rustup target add aarch64-apple-ios-sim x86_64-apple-ios
 
       - name: Configure Xcode project
         run: |
diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index 70b094cebb..2565e91f01 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -91,8 +91,6 @@ jobs:
         run: |
           brew bundle dump
           brew bundle
-          rustup default stable
-          rustup update stable
           rustup target add aarch64-apple-ios-sim
 
       - name: Configure Xcode project
diff --git a/.github/workflows/rust-unused-dependencies.yml b/.github/workflows/rust-unused-dependencies.yml
index eba2735f9c..aed6d4ea22 100644
--- a/.github/workflows/rust-unused-dependencies.yml
+++ b/.github/workflows/rust-unused-dependencies.yml
@@ -51,7 +51,7 @@ jobs:
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
       - name: Install nightly Rust toolchain
-        run: rustup default $RUST_NIGHTLY_TOOLCHAIN
+        run: rustup override set $RUST_NIGHTLY_TOOLCHAIN
 
       - uses: taiki-e/install-action@v2
         with:
@@ -81,9 +81,9 @@ jobs:
           git config --global --add safe.directory '*'
           git submodule update --init --recursive --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust toolchain
+      - name: Install nightly Rust
         run: |
-          rustup default $RUST_NIGHTLY_TOOLCHAIN
+          rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
           rustup target add aarch64-linux-android
 
       - uses: taiki-e/install-action@v2
@@ -123,12 +123,8 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
-          default: true
-          profile: minimal
+      - name: Install nightly Rust
+        run: rustup override set ${{ env.RUST_NIGHTLY_TOOLCHAIN }}
 
       - uses: taiki-e/install-action@v2
         with:
diff --git a/.github/workflows/rustfmt.yml b/.github/workflows/rustfmt.yml
index 85f88a667a..54c39aaf3e 100644
--- a/.github/workflows/rustfmt.yml
+++ b/.github/workflows/rustfmt.yml
@@ -20,13 +20,6 @@ jobs:
       - name: Checkout wireguard-go submodule
         run: git submodule update --init --depth=1 wireguard-go-rs
 
-      - name: Install nightly Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         run: |-
           rustfmt --version
diff --git a/.github/workflows/testframework-clippy.yml b/.github/workflows/testframework-clippy.yml
index 3ebd0fa274..9a5040d882 100644
--- a/.github/workflows/testframework-clippy.yml
+++ b/.github/workflows/testframework-clippy.yml
@@ -28,12 +28,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Install build dependencies
         if: matrix.os == 'ubuntu-latest'
         run: |
@@ -61,12 +55,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: clippy
-          override: true
-
       - name: Clippy check
         working-directory: test
         shell: bash
diff --git a/.github/workflows/testframework-rustfmt.yml b/.github/workflows/testframework-rustfmt.yml
index 27996c6e2b..a21d86f694 100644
--- a/.github/workflows/testframework-rustfmt.yml
+++ b/.github/workflows/testframework-rustfmt.yml
@@ -18,13 +18,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          components: rustfmt
-          default: true
-
       - name: Check formatting
         working-directory: test
         run: |-
diff --git a/.github/workflows/testframework.yml b/.github/workflows/testframework.yml
index 6f6b874811..630152cb02 100644
--- a/.github/workflows/testframework.yml
+++ b/.github/workflows/testframework.yml
@@ -42,8 +42,7 @@ jobs:
 
       - name: Use default container image and resolve digest
         if: ${{ github.event.inputs.override_container_image == '' }}
-        run: |
-          echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
+        run: echo "inner_container_image=$(cat ./building/linux-container-image.txt)" >> $GITHUB_ENV
 
     outputs:
       container_image: ${{ env.inner_container_image }}
@@ -83,12 +82,6 @@ jobs:
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build test runner
         working-directory: test
         run: cargo build --locked
diff --git a/.github/workflows/translations-converter.yml b/.github/workflows/translations-converter.yml
index fc24845cc7..abc674d31f 100644
--- a/.github/workflows/translations-converter.yml
+++ b/.github/workflows/translations-converter.yml
@@ -16,12 +16,6 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Build and test translations converter tool
         working-directory: android/translations-converter
         run: cargo test
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index 7e0c7e7d46..ee5eafb27a 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -32,12 +32,6 @@ jobs:
         shell: bash
         run: npm ci
 
-      - name: Install Rust
-        uses: actions-rs/toolchain@v1.0.6
-        with:
-          toolchain: stable
-          default: true
-
       - name: Verify translations
         shell: bash
         run: scripts/localization verify
diff --git a/.github/workflows/verify-locked-down-signatures.yml b/.github/workflows/verify-locked-down-signatures.yml
index eee84bf2a7..9453cb789d 100644
--- a/.github/workflows/verify-locked-down-signatures.yml
+++ b/.github/workflows/verify-locked-down-signatures.yml
@@ -11,6 +11,7 @@ on:
       - test/Cargo.lock
       - deny.toml
       - test/deny.toml
+      - rust-toolchain.toml
       - desktop/package-lock.json
       - wireguard-go-rs/libwg/go.sum
       - ci/keys/**