kyleandClaude Opus 5.5
d2e6cfa51f
The owner's hosts (titan, talos) run 1.98.1; nixos-26.05's Rust is 1.95.0, so builds and lints differed by host. The flake gains a second input, oxalica's rust-overlay (following our nixpkgs, so host configs can still follow theirs), and both the package build and the dev shell use its stable 1.98.1 with clippy and rustfmt. The workspace's rust-version rises to 1.98 to match; AGENTS.md, docs/dependencies.md and the M5c-1 plan follow. Checked on straylight: nix build gives all seven binaries; the dev shell has rustc, cargo and clippy 1.98.1, rustfmt 1.9.0, cargo-deny 0.19.6; make gate in it passes with 1122 tests, as on titan. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
45 lines
4.0 KiB
Markdown
45 lines
4.0 KiB
Markdown
# Dependencies
|
|
|
|
Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
|
|
|
|
| Crate | Version | Used by | Why |
|
|
|---|---|---|---|
|
|
| `serde` | 1.0.229 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | Derives serialization for every shared type. MIT OR Apache-2.0. |
|
|
| `serde_json` | 1.0.151 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | JSON for frames and log files. MIT OR Apache-2.0. |
|
|
| `humantime` | 2.4.0 | `bxcore` | RFC 3339 timestamps. No dependencies of its own. MIT OR Apache-2.0. |
|
|
| `toml` | 1.1.6 | `bxcore` tests; `brokerd` and `bxctl` from M3, `gatewayd` from M4a | Parses grant files. MIT OR Apache-2.0. |
|
|
| `emsha` | 1.0.4 | `bxcore` | SHA-256. Written by the owner; no dependencies, no `unsafe`. Checked against `sha256sum` on 3,204 inputs. |
|
|
| `rustls` | 0.23.45 | `gatewayd` | TLS to Mattermost over the tailnet (M4a, owner's decision). `default-features = false` with `ring`, `std`, `tls12`. With its dependencies on Linux: `ring` (Apache-2.0 AND ISC; builds C and assembly), `rustls-webpki` and `untrusted` (ISC), `rustls-pki-types`, `subtle` (BSD-3-Clause), `zeroize`, `once_cell`, `getrandom`, `libc`, `cfg-if`. Apache-2.0 OR ISC OR MIT. |
|
|
| `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
|
|
| `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
|
|
| `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. |
|
|
| `roncho` | 1.0.0 | `memoryd` from M5c | The owner's Honcho client (`docs/specs/2026-09-25-roncho-requirements.md`). `default-features = false`, feature `tls` (which implies `blocking`): a blocking client over `std::net`, no async runtime; TLS through `rustls`, already a dependency of `gatewayd`. It adds only itself to the lock file: `serde`, `serde_json`, `thiserror`, `toml`, `zeroize` and the TLS crates are already there. Checked against its requirements on 2026-09-27 (every client built with `.without_config_file()`, spec M5c section 6). Apache-2.0. |
|
|
|
|
## Ported code
|
|
|
|
- `crates/bxcore/src/sanitize/flag.rs` (M5b): rules 1 to 7 translated from Hermes Agent's
|
|
`tools/threat_patterns.py` (github.com/NousResearch/hermes-agent at
|
|
d0288be5b3330d2442e3907185b8e9d0958297bb), Copyright (c) 2025 Nous Research, MIT License.
|
|
Patterns only, rewritten as word sequences with no regex crate; the rules left out, and why, are
|
|
in the module comment.
|
|
|
|
## Build inputs
|
|
|
|
`flake.nix` has two inputs, pinned in `flake.lock`:
|
|
|
|
- `nixpkgs`, `nixos-26.05`: the release the owner's NixOS hosts run, so a host's config can use
|
|
the flake with `inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`;
|
|
- `rust-overlay` (github.com/oxalica/rust-overlay, MIT), following that `nixpkgs`: the Rust
|
|
toolchain, pinned to 1.98.1, the workspace's `rust-version` and the version titan and talos run
|
|
(owner, 2026-09-27), so every host builds and lints with the same compiler and clippy. The
|
|
release's own Rust is 1.95.0.
|
|
|
|
Nix fetches them when building, never the harness when running, so they are not in
|
|
`docs/egress.md`.
|
|
|
|
- `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
|
|
- `nix build .#tools-image` builds the tool containers' image (`deploy/tools-image.nix`).
|
|
- `nix develop` gives a shell with `cargo`, `rustc`, `clippy`, `rustfmt`, `cargo-deny` and `make`.
|
|
- With direnv (NixOS: `programs.direnv.enable`), `.envrc` enters that shell on `cd`; run
|
|
`direnv allow` once per clone. It does nothing on a host without Nix.
|