With `cargo.enabled`, `pnpm install` reads rustup's toolchain file
(`rust-toolchain.toml` or the older `rust-toolchain`, nearest at or above
each Cargo manifest, never above the checkout) and installs the toolchain
it names, the way pnpm already provisions a Python interpreter.
- The channel manifest is read from static.rust-lang.org (or
`tools.rust.mirror`) and verified against the embedded Rust release
signing key. Each component archive is checked against the SHA-256 the
manifest names.
- Components are unpacked together into
`<store>/rust/<release>-<host>-<digest>`, the layout rustup gives a
toolchain, so rustc finds its standard library beside itself. The digest
covers profile, components, and targets. `rust-docs` is left out of the
default profile.
- The toolchain is linked as `.pnpm/rust` beside the toolchain file.
`pnpm run`, `pnpm exec`, the Cargo task cache key, and the `cargo` and
`rustc` invocations pnpm makes during an install use it.
- Pinned channels need no network once installed. Moving channels are
re-read once a day; offline, the newest installed release is used.
- The cargo and rustc calls pnpm makes during an install use only
toolchains this process provisioned, never a `.pnpm/rust` link the
checkout could have committed.
- Any `runtimeOnFail` other than `download` leaves the toolchain to rustup.
The OpenPGP check in pnpm-crypto-shasums-file is generalized (and accepts
ASCII-armored signatures) so the Node.js and Rust verifiers share it. The
bounded reader the Python interpreter install used moves to pnpm-tarball.
Zoltan Kochan
fad744e272