makiri 0.9.0 → 0.10.0.rc2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ece0ed1298dbb761fbaeecc7e497b20ee69766c988ef5e0c671e282a3a455de9
-  data.tar.gz: a909b7cbd715ad23e58f5c4f649298c6ca4472c9004423eb73930baadea205ec
+  metadata.gz: c7dc5843dd369edd0bcae884c8b4f23dbdb854de335b51c99e1474858c9c49f6
+  data.tar.gz: ba1aeb6c3363450fc0212f5ce814c971b0e2eaf8dfd3f927703cfa2a667fdc35
 SHA512:
-  metadata.gz: 265f7671dd689039fb98a41513b45fa2b3dae542f9a99942832fe25e36c1b4e7430caf8c14f39c3832947819258a850cacca556ef278785356d616d5b132cd16
-  data.tar.gz: 7bed0126338689b1e5c2bbf47b60d9550352b471162f80b030cad11141158efbd7a293f48551be73bbdfe1ac9d24cab6c0074ff46ef5d01e2aa404888e147c0e
+  metadata.gz: f1699b0cdd955116e52a2b575abfa5dbfbbdaecd43d3217844020828d18af341505e2df25539a8c5086ad619c85fe099f679054a1cf562067d6ec159977aee73
+  data.tar.gz: 666692b6b9597640c6092a8407594a380fa6dfd6682844c1fecc4ce85ea5381e5dc49877210e3684ac3a10ab09f9b30a49cef4939b7f113fdc8d6e359b608156

data/.github/workflows/ci.yml

@@ -30,12 +30,111 @@ jobs:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - name: Compile the extension (builds vendored Lexbor, then the ext)
+      # The extension is a Rust crate, so a toolchain is part of the build the
+      # way a C compiler used to be. (`rake ports` stood here and checked that
+      # the port table, Cargo.toml, this file and lib.rs agreed about which C
+      # each flag replaced. There is no table, no flags and no C left for it to
+      # check.)
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          # RubyInstaller's Ruby is a MinGW build, but a default rustup on
+          # Windows installs the MSVC host - and rb-sys will not generate
+          # bindings from Ruby's headers across that ABI boundary. extconf.rb
+          # names the GNU triple; this installs the std that goes with it.
+          # Empty elsewhere, so the other runners are unaffected.
+          targets: ${{ runner.os == 'Windows' && 'x86_64-pc-windows-gnu' || '' }}
+
+      # rb-sys runs bindgen at build time to generate bindings against the local
+      # Ruby, and bindgen needs libclang. The runner image ships one; installing
+      # it explicitly is what keeps a base-image change from turning into
+      # "Unable to find libclang" in the cargo step.
+      # clang/lld/llvm are for the vendored Lexbor's LTO, not for bindgen: on
+      # Linux the whole chain has to be LLVM or extconf turns LTO off (gcc emits
+      # GIMPLE, which rust-lld cannot read - see the note in extconf.rb). It
+      # DETECTS them, so a runner without them still builds, just without LTO;
+      # installing them here is what makes CI exercise the fast path.
+      - name: Install libclang (bindgen) and the LLVM chain (Lexbor LTO)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev clang lld llvm
+
+      - name: Compile the extension (builds vendored Lexbor, then the crate)
         run: bundle exec rake compile
 
+      # Warnings are errors: the lints that matter here are the project's own -
+      # `clippy.toml`'s disallowed-methods is what enforces that every heap
+      # allocation goes through `falloc`, which is the invariant `rake oom`
+      # exists to exercise. An unsafe block without a stated contract and a
+      # raw-pointer compare that should be `ptr::eq` are the others.
+      #
+      # After `rake compile`, because build.rs generates the Lexbor layout from
+      # the vendored headers and those only exist once cmake has installed them.
+      # One cell, not twelve: `--all-features` is every configuration the crate
+      # has, so the other matrix cells would re-run it. This step was
+      # lost when the per-flag port matrix was deleted - it used to run once per
+      # leg with that leg's features - and nothing noticed, because the comment
+      # claiming it ran was in a different file.
+      - name: Clippy
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        working-directory: ext/makiri/rust
+        run: cargo clippy --all-features -- -D warnings
+
+      - name: Rust formatting
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        working-directory: ext/makiri/rust
+        run: cargo fmt --all -- --check
+
+      # The cargo-fuzz crate is a separate crate that nothing else here builds,
+      # so an engine API change used to break it silently until the nightly
+      # run. Formatting and clippy on stable prove it still compiles and stays
+      # tidy against this commit; libFuzzer and the sanitizer stay nightly-only
+      # (libfuzzer.yml).
+      - name: Fuzz crate checks
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        working-directory: ext/makiri/rust/fuzz
+        run: |
+          cargo fmt -- --check
+          cargo clippy --all-targets -- -D warnings
+
+      # Fast, Ruby- and Lexbor-free checks for the Rust core. Kani proves the
+      # bounded symbolic contracts in verify.yml; this executes exhaustive
+      # small-domain and regression properties on every ordinary CI run.
+      - name: Rust core tests
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        run: bundle exec rake rust:test
+
+      # The Rust port has a small, explicitly audited unsafe perimeter.  This
+      # catches a raw operation added to a parsing primitive, or a new mutable
+      # global added without a GVL/ownership proof.
+      - name: Unsafe-boundary gate
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        run: bundle exec rake unsafe:boundaries
+
+      # Only Init_makiri may be exported (or another Lexbor-based gem in the
+      # same process binds to our Lexbor and segfaults - CLAUDE.md), and no
+      # Lexbor/Makiri symbol may be left undefined (it would be a NULL call).
+      # The export half is enforced at the SOURCE - only Init_makiri is
+      # #[no_mangle] - because on ELF nothing else works: objcopy cannot remove
+      # an entry from a linked .so's .dynsym, and a second --version-script is
+      # merged rather than applied. This gate is what proves it held.
+      # One cell, like the Rust-only checks above: the symbol table does not
+      # vary by OS or Ruby.
+      - name: Symbol gate
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        run: bundle exec rake symbols
+
       # The :threading suite is heavy (GC.stress across threads) and checks a
       # structural property that does not vary by OS/Ruby, so run it on a single
       # representative job; the rest of the matrix skips it for a fast run.
+      #
+      # The recorded C-build differential. It was a tautology while the C was
+      # still what built here, and recording it then was the whole point: it is
+      # now the only surviving check that this build answers what the C
+      # answered, and it cannot be re-recorded. Again one cell: the answers do
+      # not vary by OS or Ruby.
+      - name: Differential
+        if: matrix.os == 'ubuntu-latest' && matrix.ruby == '3.4'
+        run: bundle exec rake diff
+
       - name: Run the test suite
         run: bundle exec rake spec
         env:
@@ -46,7 +145,11 @@ jobs:
         run: bundle exec ruby -Ilib -r makiri -e 'p Makiri::VERSION'
 
   sanitize:
-    name: AddressSanitizer + UBSan (Ruby ${{ matrix.ruby }})
+    # AddressSanitizer only. UBSan used to run beside it over the C sources;
+    # rustc's -Zsanitizer has no `undefined`, so with the C retired there is
+    # nothing for it to instrument. Naming the job for what it runs keeps a
+    # green tick from claiming coverage that no longer exists.
+    name: AddressSanitizer (Ruby ${{ matrix.ruby }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -61,14 +164,34 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # Nightly, not stable: -Zsanitizer is unstable, and extconf refuses to
+      # build the crate uninstrumented when ASan is asked for rather than
+      # quietly producing a run that checks nothing.
+      - uses: dtolnay/rust-toolchain@nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      # Builds the ext with -fsanitize=address,undefined and runs the whole
-      # spec suite with the ASan runtime preloaded. Any heap/UB error aborts
-      # the run with a non-zero exit, failing the job.
-      - name: Build + test under sanitizers
+      # Builds the crate with -Zsanitizer=address and runs the whole spec suite
+      # with the ASan runtime preloaded. Any heap error aborts the run with a
+      # non-zero exit, failing the job.
+      - name: Build + test under AddressSanitizer
         run: bundle exec rake sanitize
+
+      # The Ruby-free engine tests under ASan too - the XPath and CSS evaluation
+      # cases, and the arena, tree and mutation self-checks, which reach states
+      # no public API can build and
+      # ran under `rake sanitize` while they were a Ruby hook. `--target` keeps
+      # the build scripts uninstrumented. Linux only: on macOS an ASan test
+      # binary deadlocks in dyld before main (see the Rakefile's cargo-fuzz note).
+      - name: Rust core tests under AddressSanitizer
+        working-directory: ext/makiri/rust
+        env:
+          RUSTFLAGS: -Zsanitizer=address
+        run: cargo test --no-default-features --features lexbor --target x86_64-unknown-linux-gnu

data/.github/workflows/conformance.yml

@@ -31,6 +31,12 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now.
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -82,6 +88,12 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now.
+      - uses: dtolnay/rust-toolchain@stable
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:

data/.github/workflows/libfuzzer.yml

@@ -11,17 +11,21 @@ on:
   workflow_dispatch:
 
 jobs:
-  # Build the libFuzzer harnesses under clang with -fsanitize=fuzzer,address
-  # and run each target for 300s.  The corpus is stored as a build artifact so
-  # it can be seeded in subsequent runs (regression asset per the roadmap).
-  libfuzzer-nightly:
-    name: libFuzzer ${{ matrix.target }} (clang)
+  # The surfaces, coverage-guided, under cargo-fuzz.
+  #
+  # A second job stood beside this one and fuzzed the same three XML/XPath
+  # surfaces as C binaries built by ext/makiri/fuzz/Makefile under clang.
+  # Both were shipped code while the port was in progress; only one is now,
+  # and the C harnesses went with the sources they drove. The corpus cache
+  # key is unchanged, so the accumulated seeds carry over.
+  cargo-fuzz-nightly:
+    name: cargo-fuzz ${{ matrix.target }} (rust)
     runs-on: ubuntu-latest
     timeout-minutes: 360
     strategy:
       fail-fast: false
       matrix:
-        target: [xml, xpath, xml_xpath]
+        target: [xml, xpath, xml_xpath, css, html, html_xpath]
 
     steps:
       - name: Checkout (with vendored Lexbor submodule)
@@ -32,52 +36,79 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # -Zsanitizer is unstable, and cargo-fuzz needs it.
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: clippy
+
+      - name: Install libclang (bindgen, via rb-sys)
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
           ruby-version: "3.4"
           bundler-cache: true
 
-      # Build the vendored Lexbor first (plain mode is fine; the harness links
-      # the static archive).  The fuzzer binary itself is built with ASan.
+      # The targets need the vendored Lexbor library and headers - the crate's
+      # build.rs links the archive and generates bindings from the headers.
       - name: Compile the extension (builds Lexbor)
         run: bundle exec rake compile
 
-      - name: Install clang
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y clang
+      - name: Install cargo-fuzz
+        run: cargo install cargo-fuzz --locked
+
+      # The fuzz crate inherits the allocation lint from ../clippy.toml, and it
+      # was firing there unseen: nothing built this crate with -D warnings.
+      - name: Clippy the fuzz crate
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo clippy --all-targets -- -D warnings
 
-      - name: Build libFuzzer harnesses
+      - name: Build the fuzz targets
+        working-directory: ext/makiri/rust/fuzz
+        run: cargo fuzz build ${{ matrix.target }}
+
+      # A green fuzz run proves nothing if the sanitizer is inert, and the
+      # obvious check for that (nm -u | grep __asan_report) reads 0 on Linux
+      # whether or not the binary is instrumented, because the runtime is
+      # linked statically. Assert on the full symbol table instead.
+      - name: Assert the target is instrumented
+        working-directory: ext/makiri/rust/fuzz
         run: |
-          cd ext/makiri/fuzz
-          make clean
-          make all
+          bin=$(ls target/*/release/${{ matrix.target }})
+          reports=$(nm "$bin" | grep -c '__asan_report')
+          echo "$bin: __asan_report symbols = $reports"
+          test "$reports" -gt 0 || { echo "not ASan-instrumented"; exit 1; }
 
-      # Restore the previous corpus so the fuzzer starts from the accumulated
-      # regression seeds rather than from scratch.
       - name: Restore corpus cache
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
-          path: ext/makiri/fuzz/corpus/${{ matrix.target }}
-          key: libfuzzer-corpus-${{ matrix.target }}-${{ github.run_id }}
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
+          key: cargo-fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
           restore-keys: |
-            libfuzzer-corpus-${{ matrix.target }}-
+            cargo-fuzz-corpus-${{ matrix.target }}-
 
-      - name: Run libFuzzer ${{ matrix.target }} (300s)
+      - name: Run cargo-fuzz ${{ matrix.target }} (300s)
+        working-directory: ext/makiri/rust/fuzz
         run: |
-          mkdir -p ext/makiri/fuzz/corpus/${{ matrix.target }}
-          cd ext/makiri/fuzz
-          ./${{ matrix.target }}_fuzz \
+          mkdir -p corpus/${{ matrix.target }}
+          cargo fuzz run ${{ matrix.target }} -- \
             -max_total_time=300 \
             -max_len=4096 \
-            -print_final_stats=1 \
-            corpus/${{ matrix.target }}
+            -print_final_stats=1
 
-      # Save the mutated corpus as an artifact for download / seeding.
       - name: Upload corpus artifact
         uses: actions/upload-artifact@v4
         with:
-          name: libfuzzer-corpus-${{ matrix.target }}
-          path: ext/makiri/fuzz/corpus/${{ matrix.target }}
+          name: cargo-fuzz-corpus-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/corpus/${{ matrix.target }}
           retention-days: 7
+
+      # Anything cargo-fuzz saved under artifacts/ is a reproducer.
+      - name: Upload reproducers
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: cargo-fuzz-artifacts-${{ matrix.target }}
+          path: ext/makiri/rust/fuzz/artifacts/${{ matrix.target }}
+          retention-days: 30

data/.github/workflows/release.yml

@@ -6,7 +6,7 @@ name: Release
 #
 # Native gems are built on each target platform's own runner — NOT
 # cross-compiled — because the extension builds vendored Lexbor with CMake using
-# the host toolchain (see ext/makiri/extconf.rb). Each runner compiles for
+# the host toolchain (see ext/makiri/rust/extconf.rb). Each runner compiles for
 # Ruby 3.2/3.3/3.4; script/build_native_gem.rb then assembles one gem per
 # platform containing all three ABIs (lib/makiri.rb selects the right one at
 # require time). `gem install` of a native gem does not recompile or need
@@ -74,11 +74,26 @@ jobs:
           submodules: recursive
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
+      # The extension is a Rust crate, so every release runner needs cargo. This
+      # is the job that produces the precompiled gems, which is what most users
+      # install - if it cannot build, the gem falls back to a source install and
+      # every one of those users needs a toolchain of their own.
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          # RubyInstaller's Ruby is a MinGW build, but a default rustup on
+          # Windows installs the MSVC host - and rb-sys will not generate
+          # bindings from Ruby's headers across that ABI boundary. extconf.rb
+          # names the GNU triple; this installs the std that goes with it.
+          # Empty elsewhere, so the other runners are unaffected.
+          targets: ${{ runner.os == 'Windows' && 'x86_64-pc-windows-gnu' || '' }}
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
       - uses: ruby/setup-ruby@v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
-      - name: Compile (builds vendored Lexbor, then the ext)
+      - name: Compile (builds vendored Lexbor, then the crate)
         run: bundle exec rake compile
       - name: Smoke-load
         shell: bash

data/.github/workflows/security.yml

@@ -9,46 +9,17 @@ on:
   workflow_dispatch:
 
 jobs:
-  security-lint:
-    name: C safety lint
-    runs-on: ubuntu-latest
-    if: github.event_name != 'schedule'
-    steps:
-      - name: Checkout (with vendored Lexbor submodule)
-        uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.4"
-          bundler-cache: true
-
-      - name: Run C safety lint
-        run: bundle exec rake security:clint
-
-  security-sanitize:
-    name: ASan + UBSan security suite
-    runs-on: ubuntu-latest
-    if: github.event_name != 'schedule'
-    steps:
-      - name: Checkout (with vendored Lexbor submodule)
-        uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Ensure cmake is available
-        uses: lukka/get-cmake@latest
-
-      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.4"
-          bundler-cache: true
-
-      - name: Build + test under sanitizers
-        run: bundle exec rake sanitize
+  # A "C safety lint" job stood here (`rake security:clint`, over
+  # script/check_c_safety.rb). It enforced rules about C that no longer exists -
+  # bounded reads through mkr_span, no raw cursor members, no unchecked size
+  # arithmetic. The equivalents are now type-level rather than lint-level:
+  # slices carry their length, and the allocation chokepoint is enforced by
+  # `clippy.toml`'s disallowed-methods - run with `-D warnings` by ci.yml's
+  # Clippy step (the crate) and libfuzzer.yml's (the fuzz crate, nightly).
+
+  # A security-sanitize job stood here and ran `rake sanitize`. ci.yml's
+  # `sanitize` job already does (Ruby 3.4 and 4.0) and adds the Ruby-free engine
+  # tests under ASan, so this was a second copy of the same run.
 
   security-fuzz-short:
     name: Short sanitized fuzz
@@ -63,6 +34,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -89,6 +74,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -115,6 +114,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -144,6 +157,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -173,6 +200,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -183,7 +224,7 @@ jobs:
         run: bundle exec rake invariants
 
   invariants-sanitize:
-    name: Nightly invariant checks under ASan + UBSan
+    name: Nightly invariant checks under AddressSanitizer
     runs-on: ubuntu-latest
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
@@ -195,6 +236,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -219,6 +274,20 @@ jobs:
       - name: Ensure cmake is available
         uses: lukka/get-cmake@latest
 
+      # The extension is a Rust crate; cargo is part of the build now. stable is
+      # the default because that is what ships - but nightly has to be PRESENT
+      # too: -Zsanitizer is unstable, so extconf sets RUSTUP_TOOLCHAIN=nightly
+      # for an ASan build (and aborts rather than quietly building it plain).
+      # Installed uniformly across this file's jobs; the few that never sanitize
+      # pay one toolchain download for one block instead of nine variants.
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install the nightly toolchain (for -Zsanitizer)
+        run: rustup toolchain install nightly
+
+      - name: Install libclang (bindgen, via rb-sys)
+        if: runner.os == 'Linux'
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Set up Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -227,3 +296,4 @@ jobs:
 
       - name: Build Lexbor under ASan and run the suite
         run: bundle exec rake "sanitize:lexbor"
+