rust: Upgrade to 1.96.1

[Kavya Sree Kaitepalli (KavyaSree2610)]

Summary:

• Upgrades the  rust  toolchain from 1.90.0 to 1.96.1 and rebuilds/updates all dependencies. Splitted the stage0 bootstrap tarballs (cargo/rustc/rust-std) into a separate  rust-bootstrap  SRPM to keep the  rust  SRPM's size down, and so the large prebuilt binaries only need to be re-fetched/rebuilt when the stage0 version actually changes, not on every  rust  spec/patch update

Changes:

Rust toolchain upgrade:

• Bumped  rust  from 1.90.0-9 to 1.96.1-1 in  SPECS/rust/rust.spec , with updated  rust.signatures.json .
• Refreshed/dropped CVE patches that are now fixed upstream in 1.96.1 (removed  CVE-2024-11738 ,  CVE-2025-4574 ,  CVE-2025-55159 ,  CVE-2026-25541 ,  CVE-2026-25727 ,  CVE-2026-33055 ,  CVE-2026-33056 ,  CVE-2026-5222 ,  CVE-2026-5223 ) and rebased the remaining still-applicable patches ( CVE-2025-58160 ,  CVE-2025-67873 ,  CVE-2025-68114 ,  CVE-2026-2006 ,  CVE-2026-24116 ,  CVE-2026-34743 ,  CVE-2026-40034 ) onto the new source, adding  CVE-2026-47143 .
• Added a new  rust-bootstrap  SPEC providing the prebuilt stage0 cargo/rustc/rust-std tarballs (x86_64/aarch64) required to bootstrap-compile the new Rust version from source.

Downstream dependents rebuilt:

• rust-fix-unstable-name-collisions.patch added to kata specs (kata-containers-cc, kata-containers-preview). Backport of the upstream commit that resolves the new unstable_name_collisions errors that Rust 1.96 raises on the kata code base (mostly around Iterator/Stream trait method shadowing in the agent). Removable at kata v3.30.0, where the fix lands natively.
• rust-1.96-protection-cpuid.patch added to kata-containers-preview only. Backport of the two upstream commits that remove now-unnecessary unsafe blocks around __cpuid / __cpuid_count, which Rust 1.96 promoted to safe intrinsics. Without this patch the build fails with unused_unsafe warnings-as-errors. Removable at kata v3.32.0

License file changes:

• Rust ships a number of new license/copyright text files that the toolkit's license scanner flags as "files that look like licenses but aren't classified," failing the build. Two scoped exceptions added:
  rust : ignore ^/usr/lib/rustlib/.?/license-files/.. These are per-target license files that the new src tool extracts alongside the stdlib sources; they're already covered by the top-level Rust COPYRIGHT / LICENSE-APACHE / LICENSE-MIT we ship via %license.
  rust-doc : ignore the embedded font and web-asset license/copyright files inside the generated HTML doc tree (/usr/share/doc/docs/html/.../fonts/.txt, static.files/LICENSE.txt, static.files/COPYRIGHT.txt, static.files/LICENSE.md, plus a couple of false-positive HTML pages whose paths contain bsd/absd, and search.index/.js). These are licenses for the bundled web fonts (DejaVu, Source Code Pro, Source Serif, FiraSans, NanumBarunGothic) and JS assets the rustdoc generator embeds; they're not the package's own license and are correctly carried inside the rust-doc HTML payload.

Linked workitems:
https://microsoft.visualstudio.com/OS/_workitems/edit/57001289/ for license warnings
https://microsoft.visualstudio.com/OS/_workitems/edit/59197184/ for rust-src package
Validation:

• Local build is successful

[Kavya Sree Kaitepalli (KavyaSree2610)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.

[Kavya Sree Kaitepalli (KavyaSree2610)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.

[Muhammad Falak R Wani (mfrw)]

Since this is a decent Jump :)
I would encourage to do a full build as well :)