xtask: Enable strict provenance checks in Miri

Author: nicholasbishop

xtask/src/cargo.rs

@@ -212,6 +212,19 @@ pub fn fix_nested_cargo_env(cmd: &mut Command) {
     cmd.env("PATH", sanitized_path(orig_path));
 }
 
+/// Check if the three UEFI targets are installed via rustup (only
+/// supported since nightly-2022-11-10).
+fn is_target_installed(target: &str) -> Result<bool> {
+    let output = Command::new("rustup")
+        .args(["target", "list", "--installed"])
+        .output()?;
+    if !output.status.success() {
+        bail!("failed to get installed targets");
+    }
+    let stdout = String::from_utf8(output.stdout)?;
+    Ok(stdout.lines().any(|x| x == target))
+}
+
 #[derive(Debug)]
 pub struct Cargo {
     pub action: CargoAction,
@@ -261,6 +274,7 @@ impl Cargo {
             CargoAction::Miri => {
                 action = "miri";
                 sub_action = Some("test");
+                cmd.env("MIRIFLAGS", "-Zmiri-strict-provenance");
             }
             CargoAction::Test => {
                 action = "test";
@@ -277,6 +291,13 @@ impl Cargo {
 
         if let Some(target) = self.target {
             cmd.args(["--target", target.as_triple()]);
+
+            // If the target is not installed, use build-std. Keep this
+            // around until our minimum-supported nightly version is at
+            // least 2022-11-10.
+            if !is_target_installed(target.as_triple())? {
+                cmd.args(["-Zbuild-std=core,alloc"]);
+            }
         }
 
         if self.packages.is_empty() {