32-bit
exestatic.rust-lang.org · publisher domain- SHA-256
- f574ea2bd6d798b6072b3a45e3053f3cabcc2cb48d6b4bd59b661b41d675b31a
- Silent install
- -y -q
Rustup: the Rust toolchain installer
by The Rust Programming Language · Apache-2.0 or MIT
100/100how this is calculated
The Rust toolchain installer
Record
- Latest version
- 1.29.0
- Release date
- 05 Mar 2026
- Official page
- https://rust-lang.github.io/rustup/
- Package identifier
- Rustlang.Rustup
- Command
- cargo, cargo-clippy, cargo-fmt, cargo-miri, clippy-driver, rls, rust-analyzer, rust-gdb, rust-gdbgui, rust-lldb, rustc, rustdoc, rustfmt, rustup
Official downloads
These URLs are the ones The Rust Programming Language declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
64-bit
exestatic.rust-lang.org · publisher domain- SHA-256
- 86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7
- Silent install
- -y -q
ARM64
exestatic.rust-lang.org · publisher domain- SHA-256
- 3af309e6c3062aa11df0e932954f69d13b734d8a431e593812f3ecd9ff9e6ef6
- Silent install
- -y -q
Verify the file you downloaded
Run this against the file on disk. If the output does not match the hash below, the file is not what The Rust Programming Language published. Delete it.
Windows · PowerShell
Get-FileHash "rustup-init.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "rustup-init.exe"Expected output
86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7
How we scored this 100 out of 100
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 5 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | Apache-2.0 or MITA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Version history9 on record
Every version with a published manifest, newest first. Useful when you need an older build for compatibility.
- 1.29.0
- 1.28.2
- 1.28.1
- 1.28.0
- 1.27.1
- 1.27.0
- 1.26.0
- 1.25.2
- 1.25.1