cf7d357f17
The docs, option descriptions and comments that named the swarm root, the swarm CA or the hive CA as an existing trust anchor now name the secret store's pki root or the trust bundle that holds it: - docs/swarm/README.md, secrets.md, bao.md - deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions - comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs, swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs, hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao, swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix, hive-forge/Cargo.toml and the flake-update workflow Nothing behaves differently: every edit is a nix, Rust or TOML comment, an option description, or a test assertion message. The Rust edits change the workspace source, which this PR already rebuilds for hivectl. Refs #4588
48 lines
1.7 KiB
TOML
48 lines
1.7 KiB
TOML
[package]
|
|
name = "hive-forge"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[[bin]]
|
|
name = "hive-forge"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true }
|
|
clap-markdown = "0.1"
|
|
# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend comes
|
|
# from feature unification on reqwest — which only works because forgejo-api
|
|
# and this crate now resolve to the SAME reqwest version; cargo unifies
|
|
# features per (crate, version), so the claim is a fact about the lockfile,
|
|
# not about the workspace. See the pin note on `forgejo-api` in the root
|
|
# `Cargo.toml`.
|
|
forgejo-api = { workspace = true, features = ["sync"] }
|
|
url.workspace = true
|
|
time.workspace = true
|
|
reqwest = { workspace = true, features = [
|
|
"json",
|
|
# `rustls` carries the platform verifier, which reads the OS trust store
|
|
# (and honours `SSL_CERT_FILE`), so hive-forge validates the hive
|
|
# gateway's self-signed leaf once the store's root is in the agent's trust
|
|
# store — embedded into agent flakes via `security.pki.certificateFiles`
|
|
# — while public CAs still validate.
|
|
#
|
|
# The separate `rustls-native-certs` / `webpki-roots` features this entry
|
|
# used to name were 0.13.1-era and no longer exist; naming a feature that
|
|
# is gone is a hard resolution error, not a silent no-op, so this list has
|
|
# to move with the pin.
|
|
"rustls",
|
|
"blocking",
|
|
"multipart",
|
|
] }
|
|
serde = { workspace = true }
|
|
strum = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
# Only for restoring the default SIGPIPE disposition at startup — see
|
|
# `restore_sigpipe` in src/main.rs. std has no safe API for it.
|
|
libc = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|