fix(#1375): clean up pedantic warnings and re-enable -D warnings without pedantic bypass

hive-priv/src/main.rs

@@ -57,6 +57,7 @@ async fn main() -> Result<()> {
 }
 
 fn socket_listener() -> Result<UnixListener> {
+    use std::os::unix::fs::PermissionsExt as _;
     // Socket activation: systemd passes the socket as fd 3 when
     // LISTEN_FDS >= 1 and LISTEN_PID matches our pid.
     let listen_fds: Option<i32> = std::env::var("LISTEN_FDS")
@@ -92,7 +93,6 @@ fn socket_listener() -> Result<UnixListener> {
     let _ = std::fs::remove_file(path);
     let listener = UnixListener::bind(path).with_context(|| format!("bind {PRIV_SOCK}"))?;
     // Mode 0660: only the hive-core group can connect.
-    use std::os::unix::fs::PermissionsExt as _;
     std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o660))
         .context("chmod priv.sock")?;
     tracing::info!(path = PRIV_SOCK, "bound priv socket");
@@ -163,6 +163,7 @@ async fn write_line_event(writer: &mut OwnedWriteHalf, stream: PrivStream, data:
 /// For streaming ops (`CreateContainer`/`UpdateContainer` with `stream: true`)
 /// output lines are forwarded to `writer` as `PrivEvent::Line` messages and
 /// the returned strings are empty.
+#[allow(clippy::too_many_lines)]
 async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String, String)> {
     match req {
         PrivRequest::StartContainer { ref name } => {
@@ -232,7 +233,15 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
         } => {
             validate_container_system_name(container)?;
             read_container_journal(
-                container, lines, boot, output, unit, priority, grep, since, until,
+                container,
+                lines,
+                boot,
+                output,
+                unit.as_deref(),
+                priority.as_deref(),
+                grep.as_deref(),
+                since.as_deref(),
+                until.as_deref(),
             )
             .await
         }
@@ -308,9 +317,9 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
             ref agent_name,
             mode,
         } => {
+            use std::os::unix::fs::PermissionsExt as _;
             validate_agent_name(agent_name)?;
             let path = socket_dir_path(agent_name);
-            use std::os::unix::fs::PermissionsExt as _;
             std::fs::set_permissions(&path, std::fs::Permissions::from_mode(mode))
                 .with_context(|| format!("chmod {:o} {}", mode, path.display()))?;
             Ok((String::new(), String::new()))
@@ -597,17 +606,17 @@ async fn container_run_streaming(
 /// hard error — journalctl's own diagnostic (folded into `stderr` with
 /// the exit status) is what the caller surfaces to the operator, so the
 /// helper never bails.
-#[allow(clippy::too_many_arguments)]
+#[allow(clippy::too_many_arguments, clippy::too_many_lines)]
 async fn read_container_journal(
     container: &str,
     lines: u32,
     boot: bool,
     output: JournalOutput,
-    unit: &Option<String>,
-    priority: &Option<String>,
-    grep: &Option<String>,
-    since: &Option<String>,
-    until: &Option<String>,
+    unit: Option<&str>,
+    priority: Option<&str>,
+    grep: Option<&str>,
+    since: Option<&str>,
+    until: Option<&str>,
 ) -> Result<(String, String)> {
     let mut args: Vec<String> = vec![
         "-M".to_owned(),
@@ -622,11 +631,11 @@ async fn read_container_journal(
     }
     if let Some(u) = unit {
         args.push("-u".to_owned());
-        args.push(u.clone());
+        args.push(u.to_owned());
     }
     if let Some(p) = priority {
         args.push("-p".to_owned());
-        args.push(p.clone());
+        args.push(p.to_owned());
     }
     // `--grep=`/`--since=`/`--until=` use the `=`-joined form so a value
     // can never be parsed as a separate journalctl flag.
@@ -833,6 +842,7 @@ fn write_nspawn_flags(
     binds: &[BindMount],
     isolation: Option<&NetworkIsolation>,
 ) -> Result<()> {
+    use std::fmt::Write as _;
     let path = format!("/etc/nixos-containers/{container}.conf");
     let original = std::fs::read_to_string(&path).with_context(|| format!("read {path}"))?;
     let lines: Vec<&str> = original
@@ -855,10 +865,10 @@ fn write_nspawn_flags(
     if let Some(iso) = isolation {
         out.push_str("PRIVATE_NETWORK=1\n");
         out.push_str("HOST_ADDRESS=\n");
-        out.push_str(&format!("LOCAL_ADDRESS={}\n", iso.agent_ip));
+        let _ = writeln!(out, "LOCAL_ADDRESS={}", iso.agent_ip);
         out.push_str("HOST_ADDRESS6=\n");
         out.push_str("LOCAL_ADDRESS6=\n");
-        out.push_str(&format!("HOST_BRIDGE={}\n", iso.bridge));
+        let _ = writeln!(out, "HOST_BRIDGE={}", iso.bridge);
     } else {
         out.push_str("PRIVATE_NETWORK=0\n");
         out.push_str("HOST_ADDRESS=\n");
@@ -875,6 +885,6 @@ fn write_nspawn_flags(
         })
         .collect();
     let flags_joined = flags.join(" ");
-    out.push_str(&format!("EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"\n"));
+    let _ = writeln!(out, "EXTRA_NSPAWN_FLAGS=\"{flags_joined}\"");
     std::fs::write(&path, out).with_context(|| format!("write {path}"))
 }