Repository navigation
Expand file tree
/
Copy pathCargo.toml
More file actions
322 lines (307 loc) · 13.5 KB
/
Copy pathCargo.toml
File metadata and controls
322 lines (307 loc) · 13.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
[workspace]
members = [
"crates/args",
"crates/bep",
"crates/async-dialog",
"crates/lcache",
"crates/rcache",
"crates/check",
"crates/client-config",
"crates/checkouts",
"crates/common",
"crates/decode",
"crates/diagnostics",
"crates/graph",
"crates/mctx",
"crates/mfile",
"crates/op",
"crates/ot",
"crates/orchestrator",
"crates/paths",
"crates/mip",
"crates/minimal",
"crates/minimal-client",
"crates/minimald",
"crates/minimald-rpc",
"crates/minvmd",
"crates/minzoned",
"crates/mlog",
"crates/remote-client",
"crates/remote-proto",
"crates/sandbox",
"crates/boxes",
"crates/stdlib",
"crates/switch",
"crates/version",
]
# Local checkout of our ChrisTitusTech/vt100-rust fork (vt100-ctt); built and
# published standalone.
exclude = ["vt100-rust"]
resolver = "3"
package.edition = "2024"
package.publish = false
package.license = "Apache-2.0"
# Minimum supported Rust version, verified by the nightly `msrv` job
# (`cargo hack check --rust-version`). Every crate inherits this via
# `rust-version.workspace = true`; bump here, in one place, when the floor moves.
# 1.95 is the dependency-driven floor (sysinfo 0.39 requires rustc 1.95); no
# resolved dependency requires newer. The build toolchain pin is 1.97.0.
package.rust-version = "1.95"
# The DECLARED next release. The `version` crate builds every dev version on
# it (`0.6.0-dev.<N>.g<sha>`, N commits past the last v* tag), a release build
# is handed it as MINIMAL_RELEASE_VERSION (asserted equal by build.rs and
# scripts/assert-release-version.sh), and a no-.git build (source tarball)
# reports it verbatim. See crates/version/src/scheme.rs.
# Bump it when the commits since the last tag require it: `feat:` -> minor, a
# breaking change under any type -> minor, anything else -> patch; while the
# project is 0.x a breaking change is a minor, never a major
# (scripts/next-version.sh). `scripts/next-version.sh --check` (the
# workspace `package_version` test, `just check-version`) fails the PR that
# leaves it stale or not strictly greater than the newest v* tag.
package.version = "0.8.0"
# Workspace lint policy. A crate opts in with `[lints] workspace = true`.
#
# Only lints already clean across the workspace live here: CI's clippy job runs
# `-D warnings`, which promotes a `warn` lint into a hard error, so a single
# remaining hit would fail every PR. These 15 have zero hits today and act as
# tripwires against new ones. The stricter lints that still have legacy sites
# (unwrap_used, indexing_slicing, let_underscore_must_use, ...) are enforced on
# changed lines by `just clippy-strict` instead — see scripts/clippy-strict.sh —
# and should be promoted here as their counts reach zero. Test code is exempt
# from the panic family in clippy.toml.
[workspace.lints.rust]
# The kani proof harnesses (boxes, rcache) are gated on `cfg(kani)`, a
# custom cfg. Declaring it once here keeps rustc's unexpected_cfgs lint quiet
# on the normal (non-kani) builds without every crate repeating the check-cfg.
unexpected_cfgs = { level = "warn", check-cfg = ["cfg(kani)"] }
[workspace.lints.clippy]
# Panic / silent-failure tripwires.
unchecked_time_subtraction = "warn"
let_underscore_future = "warn"
# Holding a lock across .await.
await_holding_lock = "warn"
await_holding_refcell_ref = "warn"
# Safety documentation hygiene.
unnecessary_safety_doc = "warn"
# Numeric correctness.
float_cmp = "warn"
float_cmp_const = "warn"
lossy_float_literal = "warn"
invalid_upcast_comparisons = "warn"
# Easily-avoided footguns.
rc_mutex = "warn"
debug_assert_with_mut_call = "warn"
iter_not_returning_iterator = "warn"
expl_impl_clone_on_copy = "warn"
infallible_try_from = "warn"
dbg_macro = "warn"
[profile.release]
strip = true
lto = true
codegen-units = 1
# Fast-compiling profile for the Stage-2 guest initramfs minimald. The release
# profile's full LTO + codegen-units=1 dominate the cross-compile time, and the
# initramfs binary doesn't need them (it just reaches READY + serves a session).
# Drops the cross-compile from ~13 min toward a few minutes.
[profile.initramfs]
inherits = "release"
opt-level = 1
lto = false
codegen-units = 16
# Keep debug info lean for third-party dependencies. Full DWARF on every
# transitive rlib bloats `target/debug` into the tens of GB (this workspace
# alone accumulated ~160GB of deps). Line tables are enough for backtraces and
# gdb line numbers; workspace crates keep full debug info for local debugging.
[profile.dev.package."*"]
debug = "line-tables-only"
[workspace.dependencies]
aes-gcm = "0.11"
anyhow = "1.0"
arbitrary = "1"
async-compression = { version = "0.4", features = ["tokio", "zstd", "zstdmt"] }
async-tar = { version = "0.6", default-features = false, features = ["runtime-tokio"] }
base64 = "0.23"
blake3 = { version = "1", features = ["serde"] }
# WireGuard mesh peer (Unit 4, behind the `networking-wg` feature). Pure-Rust
# WireGuard avoids a Go/cgo toolchain dependency (spec Design Considerations).
boringtun = { version = "0.7", default-features = false }
bytes = "1.12" # keep in sync with reqwest
bzip2 = "0.6"
camino = { version = "1", features = ["serde1"] }
clap = { version = "4.6", features = ["derive", "env", "string"] }
clap_complete = { version = "4.6" }
codespan-reporting = { version = "0.13", features = ["serialization"] } # Keep in sync with nickel-lang-core
constcat = "0.6"
copy_dir = "0.1.3"
chrono = {version = "0.4", features = ["serde", "std"]}
crc32c = "0.6"
crossterm = { version = "0.29", features = ["event-stream"] }
dirs = "7"
fd-lock = "4"
either = { version = "1.17", default-features = false }
flate2 = "1.1"
futures = "0.3"
generational-arena = {version = "0.2", features = ["serde"] }
getrandom = "0.3"
google-cloud-gax = "1.13"
google-cloud-auth = "1.15"
google-cloud-storage = "1.17"
# Tracked as a git rev, not the crates.io release, update when they publish next.
# Current rev is master @ 2026-08-03.
hakoniwa = { features = ["cgroups", "rustslirp"], git = "https://github.com/souk4711/hakoniwa.git", rev = "0810ffa37620ef5c57de263c8eaa1f4d7633c14a" }
# DNS message parsing/encoding only (the box-zone answerer in `minimald`): no
# resolver, no server, no async runtime features — the message types are all
# `net::answerer` needs, and `default-features = false` keeps them that way.
hickory-proto = { version = "0.26", default-features = false, features = ["std"] }
http-body = "1"
hex = "0.4"
indicatif = "0.18"
indoc = "^2.0"
inquire = { version = "0.9", default-features = false, features = ["crossterm", "fuzzy"] }
insta = "1.48"
jaq-all = "0.3.0"
json-subscriber = "0.3"
libc = "0.2"
lzma-rs = "0.3"
# From crates.io, not a git rev: the published nickel-lang-parser ships its
# LALRPOP grammar pre-generated, while a git checkout regenerates it in the
# build script on every cold build (minutes, far longer under emulated cross
# builds). Prefer waiting for a release over pinning a git rev again.
nickel-lang-core = { version = "0.19", default-features = false, features = ["format"] }
opentelemetry-semantic-conventions = "0.33"
# OTLP export (spec 25, telemetry); all opt-in at runtime.
opentelemetry = "0.33"
opentelemetry_sdk = "0.33"
opentelemetry-otlp = { version = "0.33", default-features = false, features = ["trace", "logs", "http-proto", "reqwest-blocking-client"] }
opentelemetry-http = { version = "0.33", default-features = false }
opentelemetry-appender-tracing = "0.33"
tracing-opentelemetry = "0.34"
# `socket` + `time`: the guest's vsock timekeep listener binds an AF_VSOCK
# datagram socket and steps CLOCK_REALTIME from the host's updates.
nix = { version = "0.31", features = ["fs", "sched", "socket", "time", "user"] }
nutype = { version = "0.8", features = ["serde"] }
object = { version = "0.40", default-features = false, features = ["archive", "elf", "read_core", "std"] }
oci-spec = "0.10"
p256 = { version = "0.14", features = ["ecdh"] }
path-absolutize = "4.0"
rand = "0.10"
# rand_core 0.6 (not 0.10) to match boringtun/x25519-dalek's RNG traits for
# WireGuard keypair generation (`networking-wg`).
rand_core = { version = "0.6", features = ["getrandom"] }
rayon = "1.12"
ratatui = "0.30"
regex = "1" # keep in sync with nickel-lang-core
reqwest = { version = "0.13.4", features = ["stream"], default-features = false } # keep in sync with google-cloud-gax
rustc-hash = "2.1.3"
serde = { version = "1.0", features = ["derive", "rc"] } # Keep within the same minor version as nickel-lang-core
prost = "0.14"
prost-build = "0.14"
prost-types = "0.14"
# Property testing (dev-dependency only; NET-071 proxy parity is the first consumer).
proptest = "1"
resolv-conf = "0.7"
russh = { version = "0.65", default-features = false, features = ["aws-lc-rs", "flate2"] }
russh-sftp = "2.4"
serde_json = { version = "1" }
serde_json_lenient = { version = "0.2" }
serial_test = "4"
sha2 = "0.11"
shlex = "2.0"
size = "0.5"
smallvec = {version = "1.15", features = ["serde"]}
# The userspace TCP/IP stack the Box Egress Proxy's host leg runs over
# (`net::bep_host` in `minvmd`): Ethernet medium, IPv4, and the TCP/UDP/ICMP
# sockets the proxy terminates, with the interface's address capacity pinned
# to the leg's own address. Default features stay off: no IPv6 (the VM host
# path is IPv4-only, NET-082), no DHCP/DNS/mDNS, no 6LoWPAN, and no phy
# adapters — the frames arrive over the shuttle's channels, not a host
# interface.
smoltcp = { version = "0.14", default-features = false, features = ["std", "medium-ethernet", "proto-ipv4", "socket-tcp", "socket-udp", "socket-icmp", "iface-max-addr-count-4"] }
sysinfo = { version = "0.39", default-features = false, features = ["system"] }
tar = "0.4"
tempfile = "3.27"
tokio = { version = "1.53", features = ["full"] }
tokio-stream = "0.1"
tokio-vsock = "0.7"
# The blocking AF_VSOCK stream the guest daemon's telemetry sender writes
# the host over (`minimald::telemetry_forward`), tokio-vsock's own base.
vsock = "0.5"
tokio-util = "0.7"
toml = "1.1"
toml_edit = "0.25"
tonic = "0.14.6"
tonic-prost = "0.14.6"
tonic-prost-build = "0.14.6"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
tracing-appender = "0.2"
thiserror = "2"
unicode-width = "0.2"
url = "2" # keep in sync with reqwest
uuid = { version = "1.24", features = ["v4", "v7", "serde"] }
vt100 = { version = "0.16.2" }
zeroize = "1"
zstd = "0.14"
moka = { version = "0.12", default-features = false, features = ["sync"] }
globset = "0.4"
walkdir = "2.5"
petgraph = "0.8"
# Our crates. These are path deps in a `publish = false` workspace, so no
# `version` requirement is needed (or used) — cargo resolves them by path. Adding
# one would just be a pin to keep in sync with each crate's own version.
args = { path = "crates/args" }
async-dialog = { path = "crates/async-dialog" }
graph = { path = "crates/graph" }
lcache = { path = "crates/lcache" }
rcache = { path = "crates/rcache" }
check = { path = "crates/check" }
checkouts = { path = "crates/checkouts" }
client-config = { path = "crates/client-config" }
common = { path = "crates/common" }
decode = { path = "crates/decode" }
diagnostics = { path = "crates/diagnostics" }
mctx = { path = "crates/mctx" }
minimal-client = { path = "crates/minimal-client" }
minimald-rpc = { path = "crates/minimald-rpc" }
mlog = { path = "crates/mlog" }
mfile = { path = "crates/mfile" }
op = { path = "crates/op" }
ot = { path = "crates/ot" }
orchestrator = { path = "crates/orchestrator" }
paths = { path = "crates/paths" }
remote-proto = { path = "crates/remote-proto" }
remote-client = { path = "crates/remote-client" }
sandbox = { path = "crates/sandbox" }
boxes = { path = "crates/boxes" }
switch = { path = "crates/switch" }
version = { path = "crates/version" }
stdlib = { path = "crates/stdlib" }
# Lifts the wasm-bindgen ceiling.
#
# nickel-lang-core's `format` feature (what `mip check --fix` formats .ncl
# files with, crates/check/src/lib.rs) reaches topiary-core ->
# topiary-tree-sitter-facade -> topiary-web-tree-sitter-sys. Released 0.7.3
# pins an exact `wasm-bindgen = "=0.2.100"` *untargeted*, so it constrains
# resolution even though we never build wasm32 — capping wasm-bindgen at
# 0.2.100 and js-sys/web-sys at 0.3.77 for the entire graph. That in turn
# pinned google-cloud-auth/storage, reqwest and russh-sftp well below their
# current releases, and forced duplicate copies of the RustCrypto 0.10 stack
# (sha2/digest/block-buffer/crypto-common) alongside our 0.11.
#
# Upstream already fixed it — master moved to a caret `wasm-bindgen = "0.2"`
# and target-gates topiary-web-tree-sitter-sys behind
# `cfg(target_arch = "wasm32")` — but has not cut a release carrying it.
# Master's workspace version is still 0.7.3, so this patch satisfies
# nickel's `topiary-core = "^0.7"` unchanged.
#
# Only the two wasm crates are patched: topiary-core has no wasm-bindgen
# dependency of its own and stays on crates.io 0.7.3, so .ncl formatting
# output is untouched. Drop this section once topiary publishes >0.7.3.
[patch.crates-io]
# upstream doy/vt100 doesn't dispatch CSI 'f' (HVP, ECMA-48's CUP alias that
# btop uses for all cursor positioning) and merges once a year; our fork's
# minimal-patches branch carries the fix from doy/vt100-rust#34. Drop this
# once an upstream release includes it (gominimal/minimal#1197).
vt100 = { git = "https://github.com/gominimal/vt100-rust.git", rev = "9b8cce5a6798daf061948259ebcb073bb1ea54a6" }
topiary-tree-sitter-facade = { git = "https://github.com/tweag/topiary.git", rev = "838c74ab4058f82bc3c6a12380f22c10f22ac814" }
topiary-web-tree-sitter-sys = { git = "https://github.com/tweag/topiary.git", rev = "838c74ab4058f82bc3c6a12380f22c10f22ac814" }