Strip symbols from release binaries - #522
Merged
Merged
Conversation
Add strip = "symbols" to [profile.release]. The release build ships no DWARF debug info; this removes the remaining symbol table (172k mangled Rust symbols, measured 21.6 MiB) that is never used at runtime. Panic file:line messages are unaffected (Location lives in rodata, not the symtab); unwinding is untouched; profiling uses [profile.release-perf], which already overrides with strip = false. Verified on a local release build: binary stripped (369 dynamic symbols remain, LINKEDIT 23.1 -> 2.0 MiB), q2 --version and q2 mcp --launcher-info gates pass, and the release packaging path (tar.gz + sha256 + minisign sign/verify with filename trusted comment) round-trips on the stripped bytes using a throwaway key.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
strip = "symbols" to[profile.release]. The release build already ships no DWARF debug info (debug = false`); this removes the remaining symbol table — 172k mangled Rust symbol names + addresses, measured 21.6 MiB of the binary — that is never used at runtime.What we lose (and why it's fine)
RUST_BACKTRACE=1frames and user OS crash reports become address-only. Nothing in the tree captures backtraces programmatically (noBacktrace::capture, no native panic hook), so no feature regresses; if crash symbolication is ever needed, the release job can archive an unstripped binary as a CI artifact (follow-up, not here).file:line:colmessages are unaffected (core::panic::Locationlives in rodata, not the symtab). Unwinding is untouched (__unwind_info/__eh_framestay). Dynamic symbols survive (linking unaffected).[profile.release-perf]already carriesstrip = falsefor samply/perf.Verification (local, macOS arm64)
cargo build --release --locked --bin q2: binary stripped —nmshows 369 residual dynamic symbols (was 166,964),__LINKEDIT23.1 → 2.0 MiB.q2 --version,q2 mcp --launcher-info(real bundle, no placeholder). The--print-asset-manifest-hashesgate doesn't exist on main yet (lands with Live share for q2 preview #464).release.yml:tar -czfsingle-member tarball →shasum -a 256 -croundtrip →minisign -S/-Vwith a throwaway key and filename trusted comment: signature and comment verified. Signing happens in the release job over the tarball bytes, so stripping (a link-time change) cannot break it by construction; this proves the mechanics end-to-end on the new bytes.Strand: bd-p0p4r9b2