kyleandClaude Opus 5.5
7b40686def
The owner's Honcho client, blocking, with TLS: default features off, feature tls. It adds only itself to the lock file (checksum a5ccccc2…, as checked against crates.io in review). cargo deny passes. The dependency and the egress to rift are documented; the egress table also lists the design model's probe of rift in a throwaway workspace. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
37 lines
3.6 KiB
Markdown
37 lines
3.6 KiB
Markdown
# Dependencies
|
|
|
|
Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
|
|
|
|
| Crate | Version | Used by | Why |
|
|
|---|---|---|---|
|
|
| `serde` | 1.0.229 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | Derives serialization for every shared type. MIT OR Apache-2.0. |
|
|
| `serde_json` | 1.0.151 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | JSON for frames and log files. MIT OR Apache-2.0. |
|
|
| `humantime` | 2.4.0 | `bxcore` | RFC 3339 timestamps. No dependencies of its own. MIT OR Apache-2.0. |
|
|
| `toml` | 1.1.6 | `bxcore` tests; `brokerd` and `bxctl` from M3, `gatewayd` from M4a | Parses grant files. MIT OR Apache-2.0. |
|
|
| `emsha` | 1.0.4 | `bxcore` | SHA-256. Written by the owner; no dependencies, no `unsafe`. Checked against `sha256sum` on 3,204 inputs. |
|
|
| `rustls` | 0.23.45 | `gatewayd` | TLS to Mattermost over the tailnet (M4a, owner's decision). `default-features = false` with `ring`, `std`, `tls12`. With its dependencies on Linux: `ring` (Apache-2.0 AND ISC; builds C and assembly), `rustls-webpki` and `untrusted` (ISC), `rustls-pki-types`, `subtle` (BSD-3-Clause), `zeroize`, `once_cell`, `getrandom`, `libc`, `cfg-if`. Apache-2.0 OR ISC OR MIT. |
|
|
| `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
|
|
| `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
|
|
| `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. |
|
|
| `roncho` | 1.0.0 | `memoryd` from M5c | The owner's Honcho client (`docs/specs/2026-09-25-roncho-requirements.md`). `default-features = false`, feature `tls` (which implies `blocking`): a blocking client over `std::net`, no async runtime; TLS through `rustls`, already a dependency of `gatewayd`. It adds only itself to the lock file: `serde`, `serde_json`, `thiserror`, `toml`, `zeroize` and the TLS crates are already there. Checked against its requirements on 2026-09-27 (every client built with `.without_config_file()`, spec M5c section 6). Apache-2.0. |
|
|
|
|
## Ported code
|
|
|
|
- `crates/bxcore/src/sanitize/flag.rs` (M5b): rules 1 to 7 translated from Hermes Agent's
|
|
`tools/threat_patterns.py` (github.com/NousResearch/hermes-agent at
|
|
d0288be5b3330d2442e3907185b8e9d0958297bb), Copyright (c) 2025 Nous Research, MIT License.
|
|
Patterns only, rewritten as word sequences with no regex crate; the rules left out, and why, are
|
|
in the module comment.
|
|
|
|
## Build inputs
|
|
|
|
`flake.nix` has one input, `nixpkgs`, pinned to `nixos-26.05` in `flake.lock`: the release the
|
|
owner's NixOS hosts run, so a host's config can use the flake with
|
|
`inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`. It has Rust 1.95.0, the workspace's
|
|
`rust-version`. Nix fetches it when building, never the harness when running, so it is not in
|
|
`docs/egress.md`.
|
|
|
|
- `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
|
|
- `nix build .#tools-image` builds the tool containers' image (`deploy/tools-image.nix`).
|
|
- `nix develop` gives a shell with `cargo`, `rustc`, `clippy`, `rustfmt`, `cargo-deny` and `make`.
|