From 6484a0fd3bd60a9621d63d46dd5833062cab5fd8 Mon Sep 17 00:00:00 2001
From: Julien Cretin <cretin@google.com>
Date: Tue, 2 Jun 2026 09:55:48 +0200
Subject: [PATCH 1/2] Install rustup from submodule again

This reverts #1074.

This is not done for hermetic builds but for source integrity.
---
 .gitmodules                  |  3 +++
 scripts/setup.sh             |  5 +++--
 scripts/sync.sh              | 15 +++++++++++++++
 scripts/upgrade.sh           |  2 ++
 third_party/rust-lang/rustup |  1 +
 5 files changed, 24 insertions(+), 2 deletions(-)
 create mode 160000 third_party/rust-lang/rustup

diff --git a/.gitmodules b/.gitmodules
index 99a15e5bb..6438d4e36 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -7,6 +7,9 @@
 [submodule "third_party/lowRISC/opentitan"]
 	path = third_party/lowRISC/opentitan
 	url = https://github.com/lowRISC/opentitan.git
+[submodule "third_party/rust-lang/rustup"]
+	path = third_party/rust-lang/rustup
+	url = https://github.com/rust-lang/rustup.git
 [submodule "third_party/wasm3/wasm-coremark"]
 	path = third_party/wasm3/wasm-coremark
 	url = https://github.com/wasm3/wasm-coremark.git
diff --git a/scripts/setup.sh b/scripts/setup.sh
index ab0579419..4416615c7 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -44,10 +44,11 @@ ensure bin curl
 ensure bin pkg-config
 
 if ! has bin rustup; then
+  x git submodule update --init third_party/rust-lang/rustup
   if [ -n "$WASEFIRE_YES" ]; then
-    RUSTUP_ARGS='-s -- -y --default-toolchain=none --profile=minimal --no-modify-path'
+    RUSTUP_ARGS='-y --default-toolchain=none --profile=minimal --no-modify-path'
   fi
-  x curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | x sh $RUSTUP_ARGS
+  x ./third_party/rust-lang/rustup/rustup-init.sh $RUSTUP_ARGS
 fi
 
 # Transitive dependencies of xtask.
diff --git a/scripts/sync.sh b/scripts/sync.sh
index 99f8b9826..53069ce39 100755
--- a/scripts/sync.sh
+++ b/scripts/sync.sh
@@ -95,6 +95,7 @@ GIT_MODULES='
 SchemaStore/schemastore
 WebAssembly/spec
 lowRISC/opentitan
+rust-lang/rustup
 wasm3/wasm-coremark
 '
 [ "$(echo "$GIT_MODULES" | sort | tail -n+2)" = "$(echo "$GIT_MODULES")" ] \
@@ -104,3 +105,17 @@ for m in $GIT_MODULES; do
   printf "\tpath = third_party/$m\n"
   printf "\turl = https://github.com/$m.git\n"
 done > .gitmodules
+
+# This is done here instead of upgrade.sh for 2 reasons:
+# 1. This runs more often so users would install with the latest script.
+# 2. The upgrade.sh would need a way to know the latest version.
+RUSTUP_CURL="curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs"
+RUSTUP_SCRIPT="$(curl -s https://rustup.rs \
+  | sed -n '/^<div id="platform-instructions-unix"/,/^<\/div>$/'\
+'{s#^ *<pre class="rustup-command">\(.*\)</pre>$#\1#p;T;q}'
+)"
+[ "$RUSTUP_SCRIPT" = "$RUSTUP_CURL | sh" ] || e "RUSTUP_CURL is out of sync"
+git submodule update --init third_party/rust-lang/rustup
+eval "$RUSTUP_CURL" \
+  | diff - third_party/rust-lang/rustup/rustup-init.sh >/dev/null \
+  || e 'rustup submodule is out of sync'
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index 3481490a8..99484bed3 100755
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -27,6 +27,8 @@ case "$(git branch --show-current)" in
 esac
 
 for submodule in $(git submodule status | cut -d' ' -f3); do
+  # The rustup script is checked in the sync.sh script.
+  [ $submodule = third_party/rust-lang/rustup ] && continue
   i "Upgrade $submodule"
   ( cd $submodule
     git fetch -p origin
diff --git a/third_party/rust-lang/rustup b/third_party/rust-lang/rustup
new file mode 160000
index 000000000..28d1352db
--- /dev/null
+++ b/third_party/rust-lang/rustup
@@ -0,0 +1 @@
+Subproject commit 28d1352dbcb436d3111c3594b9e1588e94950464

From 208908bbfc47e919be68bd7914ee1368b6240467 Mon Sep 17 00:00:00 2001
From: Julien Cretin <cretin@google.com>
Date: Tue, 2 Jun 2026 10:15:23 +0200
Subject: [PATCH 2/2] review

---
 scripts/setup.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/setup.sh b/scripts/setup.sh
index 4416615c7..f8ba0e56d 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -45,6 +45,7 @@ ensure bin pkg-config
 
 if ! has bin rustup; then
   x git submodule update --init third_party/rust-lang/rustup
+  RUSTUP_ARGS=
   if [ -n "$WASEFIRE_YES" ]; then
     RUSTUP_ARGS='-y --default-toolchain=none --profile=minimal --no-modify-path'
   fi