collin/anvil
e7d9ab240d095207a11c11f7a774cb189822a325 / Cargo.toml
| 1 | [workspace] |
| 2 | resolver = "2" |
| 3 | members = [ |
| 4 | "crates/*", |
| 5 | "vendor/gitserver-core", |
| 6 | ] |
| 7 | |
| 8 | [workspace.package] |
| 9 | version = "0.0.0" |
| 10 | edition = "2024" |
| 11 | license = "MIT OR Apache-2.0" |
| 12 | repository = "https://github.com/richardscollin/anvil" |
| 13 | rust-version = "1.98.0" |
| 14 | |
| 15 | [workspace.lints.clippy] |
| 16 | # One version of a crate per tree, or say why not. Duplicates are usually a |
| 17 | # dependency mid-upgrade (two `digest` generations, two `base64`s) — each one |
| 18 | # is dead weight in the static musl binary and a type that does not unify |
| 19 | # across the seam. Unavoidable ones go in `allowed-duplicate-crates` in |
| 20 | # clippy.toml, with a reason, so the list is the record of what we are waiting |
| 21 | # on rather than an ambient warning everyone learns to scroll past. |
| 22 | multiple_crate_versions = "warn" |
| 23 | |
| 24 | [workspace.dependencies] |
| 25 | # Internal crates |
| 26 | anvil-core = { path = "crates/anvil-core" } |
| 27 | anvil-ci = { path = "crates/anvil-ci" } |
| 28 | anvil-docker = { path = "crates/anvil-docker" } |
| 29 | anvil-job = { path = "crates/anvil-job" } |
| 30 | anvil-agent = { path = "crates/anvil-agent" } |
| 31 | anvil-git = { path = "crates/anvil-git" } |
| 32 | anvil-web = { path = "crates/anvil-web" } |
| 33 | anvil-ssh = { path = "crates/anvil-ssh" } |
| 34 | |
| 35 | # Repo secrets (docs/secrets.md): sealed to users' ssh-ed25519 keys with |
| 36 | # X25519 + HKDF-SHA256 + AES-256-GCM. AES-GCM rather than ChaCha20-Poly1305 |
| 37 | # because the *browser* is the encryptor and WebCrypto has no ChaCha. |
| 38 | # Both track whatever russh is on, because cargo unifies each onto a single |
| 39 | # version tree-wide: these used to be `=`-pinned to pre-releases for that |
| 40 | # reason, and russh 0.63 moving to the final releases is what let the pins go. |
| 41 | # Bumping either ahead of russh puts them back. X25519 comes from |
| 42 | # `MontgomeryPoint::mul_clamped` rather than the x25519-dalek wrapper, which |
| 43 | # would want its own curve25519-dalek. |
| 44 | |
| 45 | # HTTP client for the CD deploy webhook. No TLS feature on purpose: the deploy |
| 46 | # receiver is host-local plaintext HTTP, and enabling rustls would drag in |
| 47 | # aws-lc-rs and break the musl cross-compile (see the russh note below). |
| 48 | # TLS via rustls with the *ring* provider only (`-no-provider` + an explicit |
| 49 | # rustls/ring dep): aws-lc-rs needs cmake and breaks the zig musl |
| 50 | # cross-compile, ring does not. anvil-git installs the provider at use time. |
| 51 | # Used for the CD deploy webhook (anvil-ci) and HTTPS push mirroring |
| 52 | # (anvil-git). |
| 53 | # Native (system) roots rather than the bundled webpki set: `anvild secret` |
| 54 | # talks to whatever anvil you self-host, including one behind a private or |
| 55 | # local CA — portless's `.localhost` certificates being the everyday case. The |
| 56 | # deploy image installs ca-certificates, so the server side is unaffected. |
| 57 | # reqwest 0.13 folded the old `rustls-tls-native-roots-no-provider` into |
| 58 | # `rustls-no-provider`, which verifies against the platform trust store — |
| 59 | # same intent, one feature. |
| 60 | |
| 61 | # Used directly only for idempotent schema shims on existing databases; the |
| 62 | # version tracks what toasty-driver-sqlite already pulls in. |
| 63 | |
| 64 | # `anvild secret` prompts for an ssh key passphrase / an account password. |
| 65 | |
| 66 | # RS256 verification of OIDC id tokens (docs/oidc.md). ring rather than a JWT |
| 67 | # crate: it is already in the tree under rustls, cross-compiles to static musl |
| 68 | # (aws-lc-rs, which the maintained JWT crates default to, needs cmake and does |
| 69 | # not), and one signature check over `header.payload` is all we need. |
| 70 | |
| 71 | # `default-onig` (C Oniguruma regex engine) over the pure-Rust `default-fancy`: |
| 72 | # several times faster on large files, and zig's cc cross-compiles the C just |
| 73 | # fine for the static musl build (verified via deploy/build.sh's toolchain). |
| 74 | |
| 75 | # ssh — use the `ring` crypto backend instead of the default `aws-lc-rs`: |
| 76 | # ring is far cheaper to compile (no cmake/perl) and cross-compiles cleanly |
| 77 | # (zigbuild/musl), which matters for building images for the low-RAM VPS. |
| 78 | |
| 79 | # ssh-key parsing/fingerprinting, shared by anvil-core (storage) and anvil-ssh |
| 80 | # (auth). Pinned to match russh's transitive ssh-key so fingerprints agree. |
| 81 | |
| 82 | aes-gcm = { version = "0.11.1" } |
| 83 | anyhow = { version = "1" } |
| 84 | argon2 = { version = "0.6.0-rc.8", features = ["rand_core"] } |
| 85 | async-trait = { version = "0.1" } |
| 86 | axum = { version = "0.8", features = ["ws"] } |
| 87 | axum-extra = { version = "0.12.6", features = ["cookie"] } |
| 88 | base64 = { version = "0.22.1" } |
| 89 | bollard = { version = "0.21.1" } |
| 90 | clap = { version = "4", features = ["derive"] } |
| 91 | curve25519-dalek = { version = "5.0.0" } |
| 92 | flate2 = { version = "1" } |
| 93 | futures-util = { version = "0.3" } |
| 94 | gitserver-core = { path = "vendor/gitserver-core" } |
| 95 | gix = { version = "0.87.1", default-features = false, features = ["sha1", "max-performance-safe", "blob-diff", "revision"] } |
| 96 | gix-pack = { version = "0.74.2", features = ["sha1"] } |
| 97 | hmac = { version = "0.13.0" } |
| 98 | lru = { version = "0.18.2" } |
| 99 | maud = { version = "0.27", features = ["axum"] } |
| 100 | pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] } |
| 101 | rand = { version = "0.10" } |
| 102 | reqwest = { version = "0.13.4", default-features = false, features = ["form", "json", "rustls-no-provider"] } |
| 103 | ring = { version = "0.17" } |
| 104 | rpassword = { version = "7" } |
| 105 | rusqlite = { version = "0.40.2" } |
| 106 | russh = { version = "0.63.1", default-features = false, features = ["flate2", "ring", "rsa"] } |
| 107 | rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] } |
| 108 | serde = { version = "1", features = ["derive"] } |
| 109 | serde_json = { version = "1" } |
| 110 | serde_yaml = { version = "0.9" } |
| 111 | sha2 = { version = "0.11.0" } |
| 112 | similar = { version = "3.2.0" } |
| 113 | ssh-key = { version = "0.7.0-rc.11" } |
| 114 | syntect = { version = "5", default-features = false, features = ["default-onig"] } |
| 115 | tar = { version = "0.4" } |
| 116 | thiserror = { version = "2" } |
| 117 | time = { version = "0.3", features = ["serde", "formatting"] } |
| 118 | toasty = { version = "0.10.0", features = ["sqlite"] } |
| 119 | tokio = { version = "1", features = ["full"] } |
| 120 | tokio-util = { version = "0.7", features = ["io"] } |
| 121 | toml = { version = "1.1.4" } |
| 122 | tower = { version = "0.5" } |
| 123 | tower-http = { version = "0.7.0", features = ["trace", "fs"] } |
| 124 | tracing = { version = "0.1" } |
| 125 | tracing-subscriber = { version = "0.3", features = ["env-filter"] } |