817ba02625
Some checks failed
nigig-build (CAD) / supply-chain (push) Has been cancelled
nigig-build (CAD) / cad-module (push) Has been cancelled
nigig-build (CAD) / full-crate-check (push) Has been cancelled
repo hygiene / hygiene (push) Has been cancelled
sms / gates (push) Has been cancelled
sms / robius-sms (push) Has been cancelled
sms / android (push) Has been cancelled
sms / nigig-sms (push) Has been cancelled
sms / supply-chain (push) Has been cancelled
doc-engine / engine (push) Has been cancelled
doc-engine / consumer (push) Has been cancelled
nigig-map / test (push) Has been cancelled
nigig-build declared robius-sms and robius-location and called neither:
zero references to robius_sms or robius_location anywhere under
nigig-build/src. That dead dependency pulled in
robius-sms -> polkit -> gio -> glib -> glib-macros -> proc-macro-error
which is the ONLY reason deny-nigig-build.toml carried
RUSTSEC-2024-0370 (proc-macro-error, unmaintained)
RUSTSEC-2024-0429 (glib VariantStrIter unsoundness)
plus an unanswered LGPL-2.1 distribution question about linking polkit
into a shipped mobile binary -- all of it for code that never ran.
Removing the direct dependency alone was NOT enough, which is the part
worth recording. `cargo tree -p nigig-build -i polkit` showed three
paths, not one: the direct declaration, and two more through nigig-core
and nigig-uikit. Both of those also declare robius-sms and also never
use it. All three declarations had to go before polkit left the graph.
nigig-core keeps robius-location: unlike the others it genuinely uses it,
in src/location.rs.
Verified, not assumed:
- before: cargo tree -p nigig-build -i polkit resolved, three paths
- after: polkit, gio and proc-macro-error no longer resolve at all
- cargo deny check -> "advisories ok, bans ok, licenses ok, sources ok"
with two fewer ignores (5 -> 3)
- nigig-build, nigig-core, nigig-uikit and nigig-sms all still compile
- Cargo.lock loses 5 lines
Also in this commit:
- A CI gate so the declarations cannot come back. Deliberately scoped
to robius-sms/robius-location on these three manifests rather than a
blanket `cargo machete`: five other unused dependencies exist here
(chrono, futures, postcard, rand, serde_json) and a gate that is red
on its first run gets switched off. Negative-tested by re-adding the
dependency and confirming the gate fails.
- Three pages carried the same placeholder string telling the user
they were looking at a "RobrixStackNavigationView destination ...
just like SMS conversation screens". That is user-visible UI copy,
not a comment. Replaced with text describing the page. The identical
"This follows the SMS/Home pattern" comment in the same three files
now says what the code does instead of naming another module.
Note the scope limit: 26 of the 29 crates in this workspace declare
robius-sms and never use it. This commit fixes the three that put
advisories on nigig-build. The rest are the same latent problem and
should be swept separately.
54 lines
2.1 KiB
TOML
54 lines
2.1 KiB
TOML
|
|
[package]
|
|
name = "nigig-core"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
|
|
[features]
|
|
default = ["native"]
|
|
native = ["dep:tokio", "dep:reqwest", "dep:lettre", "matrix_client/native", "async-rt"]
|
|
async-rt = []
|
|
|
|
[dependencies]
|
|
matrix_client = { path = "../matrix_client", default-features = false }
|
|
nigig-system-prefs = { path = "../nigig-system-prefs" }
|
|
makepad-widgets = { git = "https://gitdab.com/andodeki/makepad", rev = "a79f0dce4d477e2232344facca0798d3f25043ec"}
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
robius-directories = { git = "https://github.com/project-robius/robius", rev = "b766e62b0600f5d2ee21cc6995648346fc277bd8" }
|
|
robius-ussd = { path = "../robius-ussd", features = ["serde"] }
|
|
cfg-if = "1.0"
|
|
futures = { version = "0.3", default-features = false, features = ["alloc"] }
|
|
error_set = "0.9.1"
|
|
url = "2.5.0"
|
|
clap = { version = "4.0.16", features = ["derive"] }
|
|
robius-open = { git = "https://github.com/project-robius/robius", rev = "b766e62b0600f5d2ee21cc6995648346fc277bd8" }
|
|
postcard = { version = "1.1.3", features = ["use-std"] }
|
|
rand = "0.8.5"
|
|
csv = "1.3"
|
|
image = { version = "0.25", default-features = false, features = ["png"] }
|
|
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
tokio = { version = "1", features = ["rt", "macros", "sync", "fs", "io-util"], optional = true }
|
|
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"], optional = true }
|
|
robius-location = { git = "https://github.com/project-robius/robius", rev = "b766e62b0600f5d2ee21cc6995648346fc277bd8" }
|
|
lettre = { version = "0.11", default-features = false, features = [
|
|
"tokio1",
|
|
"tokio1-rustls",
|
|
"smtp-transport",
|
|
"pool",
|
|
"hostname",
|
|
"builder",
|
|
"ring",
|
|
"webpki-roots",
|
|
], optional = true }
|
|
|
|
[target.'cfg(target_arch = "wasm32")'.dependencies]
|
|
wasm-bindgen = "0.2"
|
|
wasm-bindgen-futures = "0.4"
|
|
js-sys = "0.3"
|
|
getrandom = { version = "0.2", features = ["js"] }
|
|
web-sys = { version = "0.3", features = [
|
|
"Window", "console", "Request", "RequestInit", "Response", "Headers",
|
|
] }
|