server/repository/znippy-composer/Cargo.toml
[package]
name = "holger-znippy-composer-repository"
# 0.1.4: local source DRIFTED from the published 0.1.3 under the same version number.
# crates.io bytes are immutable, so the edit can only reach consumers as a new
# version. Bumped 2026-08-23 by the release cascade: Gate B refused nornir 0.5.5
# because the published copies of this repo are stale.
version = "3.1.1"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Composer / PHP (Packagist) repository backend for holger — passthrough of a Composer metadata repository held in a read-only znippy archive; unlike the deb/rpm siblings it synthesizes no index, so the archive must already carry one."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["command-line-utilities","development-tools"]
keywords = ["composer", "php", "packagist", "znippy", "airgap"]
# Development notes, agent instructions and machine-local tooling stay in the
# repository; they are not part of the published crate.
exclude = [
".nornir/",
]
[dependencies]
anyhow = "1.0.104"
traits = { package = "holger-traits", version = "3.0.0", path = "../../../traits" }
znippy-common = { version = "0.10.4", features = ["host-decompressors"] }
log = "0.4"
serde_json = "1"
# The shared, bounded zip member reader. A Composer dist IS a zip, and the
# composer.json inside it is the package definition every p2 document is built
# from; before this crate existed holger could not open one, which is the
# composer half of the ?23 finding.
zip_entry = { package = "holger-zip-entry", version = "3.1.0", path = "../zip-entry" }
# ROOT LAW #0: the catalog fan-out -- open every dist, read its composer.json --
# runs on gatling, never rayon. Already in every holger binary via server-lib.
znippy-zoomies = { version = "0.1.26" }
# Composer verifies a downloaded dist against `dist.shasum` with sha1_file, so
# the digest in a p2 document is SHA-1 and not the house SHA-256. Already in the
# workspace lock, so this adds no crate to the airgap surface.
sha1 = "0.11"
# nornir-testmatrix functional-status emitter — gated, optional, compiled OUT for
# release. `--features testmatrix` turns the self-test emit calls into real rows
# that `nornir test` reads; OFF by default the dep is never pulled.
[dev-dependencies]
traits = { package = "holger-traits", path = "../../../traits", features = ["test-support"] }
# The tests build REAL Composer dist zips to drive the p2 synthesis end to end.
# The fixtures feature exposes the zip WRITER that lives beside the reader.
zip_entry = { package = "holger-zip-entry", version = "3.1.0", path = "../zip-entry", features = ["fixtures"] }
[dependencies.nornir-testmatrix]
version = "0.2.13"
optional = true
[features]
testmatrix = ["dep:nornir-testmatrix", "nornir-testmatrix/testmatrix"]