rust: Upgrade to 1.88.0

[KavyaSree2610]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?

Change Log

Does this affect the toolchain?

NO

Associated issues

• https://microsoft.visualstudio.com/OS/_workitems/edit/58943486

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-YYYY-XXXX

Test Methodology

• Buddy Build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=947483&view=results

[CBL-Mariner-Bot]

⚠️ PR Check Passed with Warnings

Found 7 warning(s) that should be reviewed.

🤖 AI Analysis Summary:

Brief Analysis:
This PR updates the Rust package version from 1.86.0 to 1.88.0 and bumps the stage0 compiler to 1.87.0 while revising the patch order. However, a discrepancy between spec patch references and the changelog has been detected.

Critical Issues Found:
• ERROR: The changelog still mentions a patch for CVE-2025-4574 although the current spec no longer references it.

Recommended Actions:
• Either reintroduce the CVE-2025-4574.patch into the spec (if still needed) or update the changelog to remove the obsolete reference.
• Clean up the patch files in the directory to avoid maintaining unused patches.
• Verify that all version bumps are security-audited and documented.

---

📋 For detailed analysis and recommendations, check the Azure DevOps pipeline logs.

[CBL-Mariner-Bot]

⚠️ PR Check Passed with Warnings

Found 7 warning(s) that should be reviewed.

🤖 AI Analysis Summary:

Brief Analysis:
This update bumps the Rust package from 1.86.0 to 1.88.0 (and stage0 from 1.85.0 to 1.87.0) and refreshes source signatures accordingly. The security patches for CVE-2025-53605 and CVE-2024-11738 remain listed, while the previously referenced CVE-2025-4574 patch has been removed from the Patch directives even though its fix is still noted in the changelog.

Critical Issues Found:
• Removed CVE-2025-4574 patch reference in the spec versus its appearance in the changelog (potential inconsistency).

Recommended Actions:
• Confirm that the upstream 1.88.0 release includes the fix for CVE-2025-4574 and update the changelog or remove legacy entries accordingly.
• Clean up any now-unused patch files, if appropriate.
• Double-check patch numbering and application (via %autosetup) for consistency.

---

📋 For detailed analysis and recommendations, check the Azure DevOps pipeline logs.

[CBL-Mariner-Bot]

⚠️ PR Check Passed with Warnings

Found 7 warning(s) that should be reviewed.

🤖 AI Analysis Summary:

Brief Analysis:
This update bumps the Rust package from 1.86.0 to 1.88.0 and updates several source signatures and stage0 versions. However, there is an inconsistency between the patch list and the changelog regarding CVE-2025-4574.

Critical Issues Found:
• ERROR: The changelog still references “Patch CVE-2025-4574” (from Jun 13 2025) even though the spec patch list now omits it.

Recommended Actions:
• Reconcile the patch references by either reintroducing CVE-2025-4574 in the spec (e.g. as Patch2) or updating the changelog to remove its mention.
• Verify that all patches are applied (via %autosetup/%patch macros) and their numbering remains sequential.
• Confirm that upstream CVE details and patch attributions are clearly documented in the changelog.

---

📋 For detailed analysis and recommendations, check the Azure DevOps pipeline logs.

[CBL-Mariner-Bot]

⚠️ PR Check Passed with Warnings

Found 6 warning(s) that should be reviewed.

🤖 AI Analysis Summary:

Brief Analysis:
This PR updates the Rust package from version 1.86.0 to 1.88.0, updates the stage0_version from 1.85.0 to 1.87.0, and removes the now-unreferenced CVE‑2025‑4574 patch. The changes appear to streamline the CVE patch application with sequential, valid patch listings.

Critical Issues Found:
• No critical security issues detected.

Recommended Actions:
• Remove any leftover CVE‑2025‑4574_1.75.patch from the directory to avoid confusion.
• Confirm that upstream fixes for CVE‑2025‑4574 justify its removal and that changelog documentation clearly reflects this decision.
• Verify patch application via %autosetup is functioning as expected with the remaining CVE‑2025‑53605.patch and CVE‑2024‑11738.patch.

---

📋 For detailed analysis and recommendations, check the Azure DevOps pipeline logs.