server/repository/znippy-conda/Cargo.toml
[package]
name = "holger-znippy-conda-repository"
# 0.1.4: local source DRIFTED from the published 0.1.3 under the same version number.
# crates.io bytes are immutable, so the edit can only reach consumers as a new
# version. Bumped 2026-08-23 by the release cascade: Gate B refused nornir 0.5.5
# because the published copies of this repo are stale.
version = "3.1.1"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Conda / Anaconda repository backend for holger — serves a real per-subdir repodata.json plus the packages, with name/version/build/subdir read from each package's parsed info/index.json rather than guessed from the filename."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["command-line-utilities","development-tools"]
keywords = ["conda", "anaconda", "repodata", "python", "airgap"]
# Development notes, agent instructions and machine-local tooling stay in the
# repository; they are not part of the published crate.
exclude = [
".nornir/",
]
[dependencies]
anyhow = "1.0.104"
traits = { package = "holger-traits", version = "3.0.0", path = "../../../traits" }
znippy-common = { version = "0.10.4", features = ["host-decompressors"] }
# repodata.json `sha256` field — a REAL SHA-256 of the served package bytes,
# which checksum-validating conda/mamba clients verify (a blake3 value under
# the `sha256` key would abort the download). REUSE-law: the ONE shared
# content-hash primitive (edda `nornir_hash::sha256_hex`) replaces the local `Sha256`.
nornir-hash = { version = "0.1.1" }
# Retained for the non-standard `blake3` field (content-addressing parity).
blake3 = "1"
# repodata.json is built via serde_json (not string interpolation) so the
# attacker-controlled name/version/build/subdir from info/index.json can't inject JSON.
serde_json = "1"
log = "0.4"
# nornir-testmatrix functional-status emitter — gated, optional, compiled OUT for
# release. `--features testmatrix` turns the self-test emit calls into real rows
# that `nornir test` reads; OFF by default the dep is never pulled.
[dependencies.nornir-testmatrix]
version = "0.2.13"
optional = true
[features]
testmatrix = ["dep:nornir-testmatrix", "nornir-testmatrix/testmatrix"]
[dev-dependencies]
traits = { package = "holger-traits", path = "../../../traits", features = ["test-support"] }
# Plugin READ-API test: compress a real `.tar.bz2` fixture WITH the conda plugin
# (so name/version/build/subdir columns are written from info/index.json), then
# serve via the view + assert repodata.json is built from those coords (R4).
znippy-compress = { version = "0.10.0" }
tar = "0.4"
bzip2 = "0.6"
tempfile = "3"
# Independent SHA-256 oracle: the read-view test recomputes the expected `sha256`
# with a *different* implementation than production (which now consumes the edda
# `nornir_hash` leaf), so the assert stays a real cross-check, not a tautology.
sha2 = "0.11"