5e714577fb
Some checks failed
Payment domain, storage, platform and UI / isolated-payment-tests (push) Has been cancelled
Payment domain, storage, platform and UI / payment-ui-tests (push) Has been cancelled
PDF engine / engine (push) Has been cancelled
PDF engine / makepad-integration (push) Has been cancelled
PDF engine / fuzz (push) Has been cancelled
repo hygiene / hygiene (push) Has been cancelled
nigig-build (CAD) / supply-chain (push) Has been cancelled
nigig-build (CAD) / cad-module (push) Has been cancelled
nigig-build (CAD) / full-crate-check (push) Has been cancelled
nigig-map / test (push) Has been cancelled
Upstream adopted the makepad fork fix (8fdff3f) but pinned it as
`rev = "a79f0dc"` -- a 7-character abbreviation. The pinning gate passed,
because it only checked that `rev = ` was present at all. Its own error
message has said "Add rev = \"<full-40-char-sha>\"" since it was written,
without ever enforcing it.
An abbreviated rev resolves only while no other object in the repository
shares its prefix. That is a property of the current object count, not a
guarantee -- it is why git's own auto-abbreviation length grows with a
repo. A short pin therefore degrades on its own over time, and someone
who can push to the fork can attempt to manufacture a colliding prefix.
For a dependency that executes at build time, that is a supply-chain
weakness rather than a style preference.
Checked before assuming: a79f0dc currently resolves uniquely in the fork
(exactly one matching object), so nothing is broken today. This closes it
while it is still cheap.
- All 34 manifests expanded to the full SHA
a79f0dce4d477e2232344facca0798d3f25043ec. Cargo.lock is unchanged by
the expansion, confirming it is the same commit and purely notational.
- The gate now also rejects any rev that is not exactly 40 hex chars.
Negative-tested: restoring the 7-char form makes it fire.
685 lib tests pass; all nine gates pass.
37 lines
1.9 KiB
TOML
37 lines
1.9 KiB
TOML
|
|
[package]
|
|
name = "theming"
|
|
version = "0.3.0"
|
|
edition = "2024"
|
|
license = "MIT"
|
|
description = "Runtime theme swapping demo for Makepad 2.0 — consumes nigig-core for persistence."
|
|
|
|
[dependencies]
|
|
# ── Internal shared library ──────────────────────────────────────────────
|
|
# Provides:
|
|
# - persistence::json::{save_json_to, load_json_from, load_json_from_or_default}
|
|
# - state::{ThemeState, LanguageState} (data + load/save, no Makepad dep)
|
|
# - error::PersistenceError
|
|
#
|
|
# Adjust the path if nigig-core lives elsewhere in your workspace.
|
|
nigig-core = { path = "../../nigig-core" }
|
|
|
|
# ── Makepad 2.0 ──────────────────────────────────────────────────────────
|
|
# Use the same makepad-widgets source as nigig-core so the ScriptVm ABI
|
|
# matches. If nigig-core uses a path dep, match it here. If it uses git,
|
|
# match that.
|
|
# makepad-widgets = { git = "https://github.com/makepad/makepad.git", branch = "dev" }
|
|
makepad-widgets = { git = "https://gitdab.com/andodeki/makepad", rev = "a79f0dce4d477e2232344facca0798d3f25043ec"}
|
|
|
|
# ── Robius integration ───────────────────────────────────────────────────
|
|
# robius-use-makepad sets up the right Makepad feature flags for
|
|
# mobile/desktop. robius-directories resolves the app data dir on
|
|
# platforms where std `directories` doesn't work (Android).
|
|
robius-use-makepad = "0.1.1"
|
|
robius-directories = { git = "https://github.com/project-robius/robius", rev = "b766e62b0600f5d2ee21cc6995648346fc277bd8" }
|
|
# serde is re-exported transitively via nigig-core, but we list it
|
|
# explicitly so the theming app can derive Serialize/Deserialize on its
|
|
# own types if needed.
|
|
serde = { version = "1", features = ["derive"] }
|
|
|
|
|