guests/static-scan/Cargo.toml
[package]
name = "heimdall-guest-static-scan"
version = "0.1.0"
edition = "2021"
license = "AGPL-3.0-only"
publish = false
description = "Heimdall is a defensive sandbox: the static-scanner wasm guest (behavior, typosquat, dependency confusion, registry, malicious feed), judging with modgunn's code"
[workspace]
[lib]
crate-type = ["rlib", "cdylib"]
[dependencies]
# The contract shared with the caller (envelope, purl, findings document).
heimdall-scan = { package = "nordisk-heimdall-scan", path = "../../crates/heimdall-scan" }
# The judging code: modgunn's Engine A (`scan`: behavior, registry, feeds) and
# the typosquat / dependency-confusion function (`scip`). Both features are
# pure Rust with no I/O; modgunn builds for wasm32 unchanged.
modgunn = { version = "=0.0.8", default-features = false, features = ["scan", "scip"] }
# npm .tgz, PyPI sdists and .crate files are gzip'd tar; the zip reader
# (wheels, zip sdists) is src/zip.rs over the same inflater.
flate2 = { version = "1.1.10", default-features = false, features = ["rust_backend"] }
tar = { version = "0.4.46", default-features = false }
# Zip members' CRC-32 (the same crate flate2 checks gzip with).
crc32fast = "1"
sha2 = "0.10"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
[target.'cfg(target_arch = "wasm32")'.dependencies]
# The same generator and version heimdall-wasm's own test guest uses.
wit-bindgen = "0.57.1"
[profile.release]
# A panic in the guest traps; the host reports it as a refusal (heimdall-wasm-2).
panic = "abort"
opt-level = "s"
lto = true
codegen-units = 1
[target.'cfg(not(target_arch = "wasm32"))'.dev-dependencies]
# The REAL wasm host on main: the guest is built for wasm32, componentized,
# signed, loaded and run exactly as a Heimdall job runs it.
heimdall-wasm = { package = "nordisk-heimdall-wasm", path = "../../crates/heimdall-wasm" }
heimdall-core = { package = "nordisk-heimdall-core", path = "../../crates/heimdall-core" }
guest-host = { version = "0.2.1", default-features = false, features = ["verify-modules"] }
wit-component = "0.258.3"
wasmparser = "0.258.3"
blake3 = "1"
tempfile = "3"
proptest = "1"
# The test fixtures: real gzip'd tar archives (tar's Builder; the hostile
# names are written into raw headers).
flate2 = { version = "1.1.10" }
tar = { version = "0.4.46" }