update-bundle/Cargo.toml
[package]
name = "holger-update-bundle"
version.workspace = true
edition = "2021"
description = "Holger Secure Update Gateway — network-free signed update-bundle format (holger.update-bundle/v1), two-person approval + release-signature trust model, and offline verifier. No outbound networking by construction."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
[lib]
name = "holger_update_bundle"
# NETWORK-FREE by construction: this crate must never gain reqwest/ureq/curl/etc.
# The zero-egress link-audit (build-space/tests/auth_ship_small.rs) asserts it.
[dependencies]
# The FROZEN `holger-<subsystem>-<n>` error codes. A ZERO-dependency leaf crate —
# it does not compromise this crate's network-free self-containment.
# Floor 0.1.0 -> 0.1.1: 0.1.0 is what the release gate reports as missing the
# AUDIT_*/AUTH_*/PROMOTE_*/SERVER_* codes. It is NOT actually missing them — they
# are declared inside the `wired` macro, so a source-text scan of the published
# tarball cannot see them — but 0.1.1 is the version this repo now ships anyway.
holger-errcode = { version = "3.0.0", path = "../errcode" }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
ron = "0.12"
thiserror = "2"
# Dual content digests. sha2 (SHA-256) + blake3 — the two hashes every bundle member
# carries. Self-contained (bundle digests are a closed domain); no edda coupling.
sha2 = "0.11"
blake3 = "1"
# The house fan-out engine (stinky 30): prepare digests every member's SHA-256
# and BLAKE3 as separate units on one gatling fan-out, and stages members in
# parallel. Published as `rotaryengine`; the LIBRARY name is `gatling`. Registry
# only — the one copy the workspace lock already holds. Never rayon.
gatling = { package = "rotaryengine", version = "0.1.13" }
# Signatures: standard ed25519 over exact stored bytes (no new algorithm, no
# proprietary format). X.509 signer certs parsed with the workspace's x509-parser.
ed25519-dalek = { version = "3", features = ["pkcs8", "alloc"] } # 3.0: PKCS#8 encoding needs `alloc`
# `verify` enables single-level certificate chain checking (leaf signed by a trusted
# root) via ring — no OpenSSL, no network. ring is already in-tree (rustls).
x509-parser = { version = "0.18", features = ["verify"] }
# UTC RFC 3339 timestamps.
chrono = { version = "0.4", features = ["serde", "clock"] }
# The bundle container is a znippy archive — no new binary archive format is invented.
# znippy-common (read) + znippy-compress (write); both are offline compression libs,
# patched to the sibling checkout by the workspace [patch.crates-io]. host-decompressors
# registers the standard decoders so an archive opens without a plugin registry.
znippy-common = { version = "0.10.4", features = ["host-decompressors"] }
znippy-compress = { version = "0.10.0" }
# Atomic staging for pack + extract (temp dir + rename). No network.
tempfile = "3"
# The bundle tool's commands (`holger-cli bundle …` and `holger-cli verify`, src/cli).
clap = { version = "4", features = ["derive"] }
anyhow = "1"
[dev-dependencies]
# Test-only PKI: mint ed25519 signer/CA certs in-process — never a committed private key.
rcgen = "0.14"