boxmaker/docs/dependencies.md

Dependencies

Every external crate has a row here. scripts/check-dep-docs.sh enforces it.

Crate	Version	Used by	Why
serde	1.0.229	proto, brokerd, toolkit, gatewayd	Derives serialization for every shared type. MIT OR Apache-2.0.
serde_json	1.0.151	proto, brokerd, toolkit, gatewayd	JSON for frames and log files. MIT OR Apache-2.0.
humantime	2.4.0	proto	RFC 3339 timestamps. No dependencies of its own. MIT OR Apache-2.0.
toml	1.1.6	proto tests; brokerd and bxctl from M3, gatewayd from M4a	Parses grant files. MIT OR Apache-2.0.
emsha	1.0.4	proto	SHA-256. Written by the owner; no dependencies, no unsafe. Checked against sha256sum on 3,204 inputs.
rustls	0.23.45	gatewayd	TLS to Mattermost over the tailnet (M4a, owner's decision). default-features = false with ring, std, tls12. With its dependencies on Linux: ring (Apache-2.0 AND ISC; builds C and assembly), rustls-webpki and untrusted (ISC), rustls-pki-types, subtle (BSD-3-Clause), zeroize, once_cell, getrandom, libc, cfg-if. Apache-2.0 OR ISC OR MIT.
rustls-native-certs	0.8.4	gatewayd	The host's trusted certificates, so a CA installed on the host is trusted too; adds openssl-probe. Apache-2.0 OR ISC OR MIT.
zeroize	1.9.0	gatewayd	Wipes a secret's memory when it is dropped (Secret). Already a dependency of rustls. Apache-2.0 OR MIT.
rusqlite	0.40.2	memoryd from M5a	The full-text index (index/memory.sqlite3, FTS5), disposable and rebuilt from files. Feature bundled: libsqlite3-sys compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: libsqlite3-sys (MIT; build: cc, pkg-config, vcpkg), hashlink, hashbrown, foldhash (Zlib, added to deny.toml for it), fallible-iterator, fallible-streaming-iterator, smallvec, bitflags. MIT.

Build inputs

flake.nix has one input, nixpkgs, pinned to nixos-26.05 in flake.lock: the release the owner's NixOS hosts run, so a host's config can use the flake with inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs". It has Rust 1.95.0, the workspace's rust-version. Nix fetches it when building, never the harness when running, so it is not in docs/egress.md.

• nix build builds every binary (result/bin/); the tests are not run there, only in make gate.
• nix build .#tools-image builds the tool containers' image (deploy/tools-image.nix).
• nix develop gives a shell with cargo, rustc, clippy, rustfmt, cargo-deny and make.