crates/gunnar-policy/Cargo.toml
[package]
name = "gunnar-policy"
description = "gunnar's pre-receive policy gate: branch protection, ref-name policy, ssh-sig verification, size limits"
readme = "README.md"
version = "2.0.0"
edition.workspace = true
rust-version.workspace = true
license.workspace = true
# On the `cargo install gunnar` chain (owner order 2026-10-22).
publish = true
authors.workspace = true
repository.workspace = true
[dependencies]
gunnar-store = { workspace = true }
# The plaintext check for ENCRYPTED repositories: format rules only — no
# cipher, no key, no dependencies of its own (`default-features = false`).
gunnar-crypt = { workspace = true }
gix-hash = { workspace = true }
ssh-key = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
thiserror = { workspace = true }
tracing = { workspace = true }
[dev-dependencies]
anyhow = { workspace = true }
# The ring check's tests wrap real key rings (classic and quantum-safe) with
# the client's own code; the gate itself still links only the format rules.
gunnar-crypt = { workspace = true, features = ["wrap"] }
# **Test-only since 2026-08-10, and an outside oracle rather than a tool.**
# `src/ancestry.rs` used `gix_object::CommitRefIter::parent_ids()` to walk
# parents; it now uses `gunnar_store::object::commit_links`, and the seven
# crates behind `gix-object` (`gix-actor`, `gix-date`, `gix-error`,
# `gix-hashtable`, `gix-utils`, `gix-validate`) left the appliance graph with
# it. What is left here is the fixture side: `tests/common/mod.rs` *builds* the
# commits the gate walks, and building an object is exactly what this crate is
# still the right answer for. If the fixture writer and the walker were the
# same code, the suite would only prove that gunnar agrees with itself (one
# implementation).
gix-object = { workspace = true }
# `MemGitServe`, the in-memory control every fixture here is built on, lives
# behind `gunnar-store`'s `conformance` feature (`mem.rs:67`) — the same
# arrangement `gunnar-wire`'s dev-dependencies already declare. Without it
# `gunnar_store::mem` carries only `MemSecretStore` and nothing in
# `tests/common/mod.rs` resolves.
gunnar-store = { workspace = true, features = ["conformance"] }
# Test-only. `GitOps` takes packs and nothing else — `MemObjectStore::write`
# died with `ObjectStore` — so `tests/common/mod.rs` has to build a one-object
# packfile to put a fixture commit in the store. This is git's pack writer,
# already first-party and already in every graph that links `gunnar-wire`, and
# using it is what keeps a second spelling of the entry format out of a test
# module (one implementation). Nothing under `src/` names it.
# PATH ONLY, no `version` — see `xtask/tests/publish_order.rs`: a versioned
# dev-only sibling is an ordering constraint written where the thing that
# computes the order cannot read it.
gunnar-pack = { version = "3.0.0" }
tempfile = { workspace = true }
rand = { workspace = true }
gix = { workspace = true }