ci: Pin cbindgen to current latest (v0.29.2)

.cbindgen-version

@@ -0,0 +1 @@
+0.29.2

.github/workflows/build_and_test.yml

@@ -373,6 +373,8 @@ jobs:
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+    - run: cargo +stable install --version "$(cat .cbindgen-version)" --locked cbindgen
+
     - run: rustup toolchain install "$(cat rust-toolchain)" --profile minimal --target aarch64-linux-android,armv7-linux-androideabi
 
     - name: Restore cargo cache
@@ -569,7 +571,7 @@ jobs:
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - run: cargo +stable install cbindgen
+    - run: cargo +stable install --version "$(cat .cbindgen-version)" --locked cbindgen
 
     - run: swift/verify_error_codes.sh
 

.github/workflows/jni_artifacts.yml

@@ -117,7 +117,7 @@ jobs:
 
     - run: sudo apt-get update && sudo apt-get install protobuf-compiler
 
-    - run: cargo +stable install cbindgen
+    - run: cargo +stable install --version "$(cat .cbindgen-version)" --locked cbindgen
 
     - name: Verify that the JNI bindings are up to date
       run: rust/bridge/jni/bin/gen_java_decl.py --verify

README.md

@@ -88,12 +88,13 @@ You should always install any Rust tools you need that may affect the build from
 package manager (e.g. `apt` or `brew`). Package managers sometimes contain outdated versions of these tools that can break
 the build with incompatibility issues (especially cbindgen).
 
-To install the main Rust extra dependencies matching the versions we use, you can run the following commands: 
+To install the main Rust extra dependencies matching the versions we use, you can run the following commands:
 
 ```shell
-$ cargo +stable install cbindgen cargo-fuzz
-$ cargo +stable install --version "$(cat ../acknowledgments/cargo-about-version)" --locked cargo-about
-$ cargo +stable install --version "$(cat ../.taplo-cli-version)" --locked taplo-cli
+$ cargo +stable install --version "$(cat .cbindgen-version)" --locked cbindgen
+$ cargo +stable install --version "$(cat acknowledgments/cargo-about-version)" --locked cargo-about
+$ cargo +stable install --version "$(cat .taplo-cli-version)" --locked taplo-cli
+$ cargo +stable install cargo-fuzz
 ```
 
 ## Java/Android

rust/bridge/jni/bin/gen_java_decl.py

@@ -191,6 +191,17 @@ def verify_contents(expected_output_file: str, expected_contents: str) -> None:
         sys.exit('error: %s not up to date; re-run %s!' % (os.path.basename(expected_output_file), sys.argv[0]))
 
 
+def check_cbindgen_version(repo_root: str) -> None:
+    version = subprocess.check_output(['cbindgen', '--version'], text=True).strip()
+
+    cbindgen_version_file = os.path.join(repo_root, '.cbindgen-version')
+    with open(cbindgen_version_file) as f:
+        expected_version = f.read().strip()
+
+    if version != f'cbindgen {expected_version}':
+        print(f'warning: this script expects cbindgen version {expected_version}, but {version} is installed', file=sys.stderr)
+
+
 def convert_to_java(rust_crate_dir: str, in_path: str, out_path: str, verify: bool) -> None:
     stdout = run_cbindgen(rust_crate_dir)
 
@@ -212,17 +223,20 @@ def main() -> None:
     args = parse_args()
 
     our_abs_dir = os.path.dirname(os.path.realpath(__file__))
+    repo_root = os.path.join(our_abs_dir, '..', '..', '..', '..')
+
+    check_cbindgen_version(repo_root)
     convert_to_java(
         rust_crate_dir=os.path.join(our_abs_dir, '..', 'impl'),
         in_path=os.path.join(our_abs_dir, 'Native.kt.in'),
-        out_path=os.path.join(our_abs_dir, '..', '..', '..', '..', 'java', 'shared', 'java', 'org', 'signal', 'libsignal', 'internal', 'Native.kt'),
+        out_path=os.path.join(repo_root, 'java', 'shared', 'java', 'org', 'signal', 'libsignal', 'internal', 'Native.kt'),
         verify=args.verify,
     )
 
     convert_to_java(
         rust_crate_dir=os.path.join(our_abs_dir, '..', 'testing'),
         in_path=os.path.join(our_abs_dir, 'NativeTesting.kt.in'),
-        out_path=os.path.join(our_abs_dir, '..', '..', '..', '..', 'java', 'shared', 'java', 'org', 'signal', 'libsignal', 'internal', 'NativeTesting.kt'),
+        out_path=os.path.join(repo_root, 'java', 'shared', 'java', 'org', 'signal', 'libsignal', 'internal', 'NativeTesting.kt'),
         verify=args.verify,
     )
 

swift/build_ffi.sh

@@ -156,7 +156,16 @@ FFI_TESTING_HEADER_PATH=swift/Sources/SignalFfi/signal_ffi_testing.h
 
 if [[ -n "${SHOULD_CBINDGEN}" ]]; then
   check_cbindgen
-  cbindgen --version
+
+  echo "Checking cbindgen version"
+  VERSION=$(cbindgen --version)
+  echo "Found $VERSION"
+
+  EXPECTED_VERSION=$(cat .cbindgen-version)
+  if [ "$VERSION" != "cbindgen $EXPECTED_VERSION" ]; then
+    echo "warning: this script expects cbindgen version $EXPECTED_VERSION, but $VERSION is installed" >&2
+  fi
+
   if [[ -n "${CBINDGEN_VERIFY}" ]]; then
     echo diff -u "${FFI_HEADER_PATH}" "<(cbindgen -q ${RELEASE_BUILD:+--profile release} rust/bridge/ffi)"
     if ! diff -u "${FFI_HEADER_PATH}"  <(cbindgen -q ${RELEASE_BUILD:+--profile release} rust/bridge/ffi); then