server/inspect/Cargo.toml
[package]
name = "holger-inspect"
version = "4.0.0"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Holger's file and archive inspector: unpacks every ingested artifact under configurable expansion limits and checks for zip bombs, deep nesting, path traversal, escaping symlinks, magic-byte/format mismatches and executables or scripts the format's policy forbids. Carries the optional ClamAV and YARA malware adapters."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["development-tools"]
keywords = ["airgap", "inspection", "zip-bomb", "clamav", "yara"]
# NETWORK-FREE apart from the local clamd socket: no HTTP client, no registry
# client. Every dependency is already in holger's Cargo.lock.
[dependencies]
serde = { version = "1", features = ["derive"] }
# The same zip line the rest of the workspace pins (D1 settled on 9).
zip = { version = "9", default-features = false, features = ["deflate"] }
flate2 = "1"
tar = "0.4"
# The image cataloger: OCI JSON (index, manifests, SPDX files, package.json)
# and zstd layers. Both are already in the lock.
serde_json = "1"
zstd = "0.14"
# HOL-NCSC (NCSC P2): every container in the INGEST walk is opened or blocked. xz in
# pure Rust (lzma-rs, decoded under the walk's caps) and bzip2 on its pure-Rust
# backend (libbz2-rs-sys); both are already in the lock.
lzma-rs = "0.3"
bzip2 = "0.6"
# The YARA adapter hands the `yara` binary a file, when that binary is installed.
tempfile = "3"
# The built-in YARA matcher's literal-atom prefilter (T10). Already in the lock
# through regex.
aho-corasick = "1.1"
[dev-dependencies]
ron = "0.12"
# Real xz streams for the tests (the decoder under test is lzma-rs). Already in the lock.
liblzma = "0.4"