plugins/native/znippy-plugin-elf/Cargo.toml
[package]
name = "znippy-plugin-elf"
version = "0.2.0"
edition = "2024"
description = "ELF binary provenance metadata plugin for znippy (native builtin — no WASM)"
license = "MIT"
repository = "https://git.gunnar.rs/nordisk/znippy"
authors = ["Ignalina ApS"]
# Native-only handler: a plain rlib linked into znippy-cli's builtin register.
# Mirrors znippy-plugin-skidbladnir / znippy-plugin-rust-toolchain — a compiled-in
# host handler discovered via `meta()`; it does NOT build a cdylib and is NOT
# compiled to WASM.
[lib]
crate-type = ["rlib"]
[dependencies]
znippy-common = { version = "0.10.0", path = "../../../znippy-common", optional = true }
anyhow = { version = "1", optional = true }
serde_json = { version = "1", optional = true }
# The ELF reader. Pure Rust (gimli project), already in this workspace's Cargo.lock
# at 0.39.1 — no new lock entry, no FFI, no shelling. `read_core` + `elf` only:
# we never write an object file and never touch mach-o/pe/wasm/archive.
object = { version = "0.40", default-features = false, features = ["read_core", "elf", "std"], optional = true }
# `.dep-v0` (cargo-auditable) is zlib-compressed JSON. znippy-common already
# depends on this leaf for the precompressed probe, so inflating a section costs
# the graph nothing new — and it is the nordisk inflate, not a second one (LAW).
linflate = { version = "0.1.0", path = "../../../../znippy-zoomies/linflate", optional = true }
# `provenance` only: the subject digest of an in-toto statement is a SHA-256, and
# it must be recomputed from the bytes on disk at every verification.
sha2 = { version = "0.11", optional = true }
[features]
default = ["znippy-handler"]
# The znippy handler itself. ON by default so `znippy-cli`'s builtin register and
# every existing consumer are unchanged.
#
# `--no-default-features` leaves ONLY `src/claim.rs`: the pure path->architecture
# CLAIM reader, which has no dependency at all and therefore compiles for
# `wasm32-unknown-unknown`. Same seam as the sibling plugins' `member` module.
znippy-handler = ["dep:znippy-common", "dep:anyhow", "dep:serde_json", "dep:object", "dep:linflate"]
# The DSSE / in-toto / SLSA binding. OFF by default, and that is not timidity:
# it turns on `znippy-common/sign`, which pulls ed25519-dalek, p256, x509-cert
# and the CMS stack. A plugin that only fills index columns must not make every
# znippy consumer pay for a signature verifier it never calls.
#
# It adds NO new signing scheme: the envelope, PAE, sign and verify are
# `znippy_common::sign`'s, the payloadType and predicateType are the ones
# holger's AttestStore already accepts. See .nornir/elf-design.md §6.
provenance = ["znippy-handler", "dep:sha2", "znippy-common/sign"]