server/scan-worker/Cargo.toml
[package]
name = "holger-scan-worker"
version = "3.1.2"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Holger's scan worker: the one program the scan sandbox runs, in a container with no network, over one read-only artifact. It holds holger-inspect (the walk and YARA), the model, licence and SBOM scanners, the image cataloger and holger-provenance, and answers one JSON report on stdout."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
# Publish-ready (HOL-PRODUCTS): the by-hand guide builds the scan sandbox's image from
# `cargo install --target x86_64-unknown-linux-musl holger-scan-worker`.
[[bin]]
name = "holger-scan-worker"
path = "src/main.rs"
# The worker's code is server-lib's own (`sandbox::worker`), so the verdicts are
# the ones the server reached in-process before the sandbox. No network crate is
# linked: `default-features = false` drops `online`. `maven-pgp` (T9b): the worker
# checks the `.asc` of every server that hands it pgp keys; a server built without
# the verifier refuses those keys at load, so it never hands the worker any.
# `heimdall-wasm` (lane HOL-HEIMDALL-04): the verify-bundle job runs Heimdall's released split
# guest when the server names it. `sign` (lane HOL-CDS-5): the verify-bundle job checks an airgap export's DSSE
# scan-evidence attestations, which server-lib reads only with `sign`.
[dependencies]
server-lib = { package = "holger-server-lib", version = "3.1.2", path = "../lib", default-features = false, features = ["supply-chain", "jobs", "maven-pgp", "sign", "heimdall-wasm"] }
serde_json = "1"
# The artifact is mapped, not read: an image of a few GB stays out of the heap.
memmap2 = "0.9"
# `serve`: the sidecar (lane B4), holger_sandbox::remote's serving half.
holger-sandbox = { version = "5.0.0", path = "../sandbox" }
# The sidecar is PID 1 in its container: SIGTERM (the kubelet) ends it.
ctrlc = { version = "3.5.2", features = ["termination"] }
# `probe`: SIGXFSZ ignored, so a write past the sidecar's scratch cap is an error it reports.
libc = "0.2"
[dev-dependencies]
tempfile = "3"
# tests/jobs_through_the_sidecar.rs: a signed bundle a verify-bundle job checks.
update-bundle = { package = "holger-update-bundle", version = "3.0.0", path = "../../update-bundle" }
# The released split verify-bundle guest against Holger's own verifier (lane HOL-HEIMDALL-02).
holger-job-runner = { version = "4.1.0", path = "../../jobs/runner", features = ["heimdall-wasm"] }
base64 = "0.23"
heimdall-run = { package = "nordisk-heimdall-run", version = "0.3" }
rcgen = "0.14"
chrono = { version = "0.4", default-features = false, features = ["clock"] }
# SIGTERM to the sidecar under test.
rustix = { version = "1.1", default-features = false, features = ["process", "std"] }
sha2 = "0.11"
holger-inspect = { version = "4.0.0", path = "../inspect" }
# a_booted_holger_scans_in_its_real_sidecar: a holger BOOTED from a RON beside the real
# sidecar, driven through its HTTP doors (static tokens, raw repositories, the image
# fixtures' layers). Test builds only; the shipped worker keeps the features above.
server-lib = { package = "holger-server-lib", version = "3.1.2", path = "../lib", default-features = false, features = ["supply-chain", "jobs", "maven-pgp", "sign", "auth-bearer", "fmt-raw", "heimdall"] }
tokio = { version = "1.54.1", features = ["rt-multi-thread"] }
tar = "0.4"
flate2 = "1"