kyleandClaude Opus 5.5
c151a7516d
`.envrc` runs `use flake` when Nix is present, so on the NixOS hosts (programs.direnv.enable brings direnv and nix-direnv) cd'ing into a clone gives the pinned Rust toolchain, clippy, rustfmt, cargo-deny and make; on titan, which has no Nix, it does nothing. nix-direnv's cache, .direnv/, is ignored. Checked on straylight in a throwaway copy: cargo 1.95.0, cargo-deny 0.19.6, rustc from the Nix store. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
39 lines
3.7 KiB
Markdown
39 lines
3.7 KiB
Markdown
# Dependencies
|
|
|
|
Every external crate has a row here. `scripts/check-dep-docs.sh` enforces it.
|
|
|
|
| Crate | Version | Used by | Why |
|
|
|---|---|---|---|
|
|
| `serde` | 1.0.229 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | Derives serialization for every shared type. MIT OR Apache-2.0. |
|
|
| `serde_json` | 1.0.151 | `bxcore`, `brokerd`, `toolkit`, `gatewayd` | JSON for frames and log files. MIT OR Apache-2.0. |
|
|
| `humantime` | 2.4.0 | `bxcore` | RFC 3339 timestamps. No dependencies of its own. MIT OR Apache-2.0. |
|
|
| `toml` | 1.1.6 | `bxcore` tests; `brokerd` and `bxctl` from M3, `gatewayd` from M4a | Parses grant files. MIT OR Apache-2.0. |
|
|
| `emsha` | 1.0.4 | `bxcore` | SHA-256. Written by the owner; no dependencies, no `unsafe`. Checked against `sha256sum` on 3,204 inputs. |
|
|
| `rustls` | 0.23.45 | `gatewayd` | TLS to Mattermost over the tailnet (M4a, owner's decision). `default-features = false` with `ring`, `std`, `tls12`. With its dependencies on Linux: `ring` (Apache-2.0 AND ISC; builds C and assembly), `rustls-webpki` and `untrusted` (ISC), `rustls-pki-types`, `subtle` (BSD-3-Clause), `zeroize`, `once_cell`, `getrandom`, `libc`, `cfg-if`. Apache-2.0 OR ISC OR MIT. |
|
|
| `rustls-native-certs` | 0.8.4 | `gatewayd` | The host's trusted certificates, so a CA installed on the host is trusted too; adds `openssl-probe`. Apache-2.0 OR ISC OR MIT. |
|
|
| `zeroize` | 1.9.0 | `bxcore`, feature `secrets` (enabled by `gatewayd`; never by `loopd`) | Wipes a secret's memory when it is dropped (`Secret`). Already a dependency of `rustls`. Apache-2.0 OR MIT. |
|
|
| `rusqlite` | 0.40.2 | `memoryd` from M5a | The full-text index (`index/memory.sqlite3`, FTS5), disposable and rebuilt from files. Feature `bundled`: `libsqlite3-sys` compiles SQLite from source with FTS5 on, so no system SQLite is needed. With its dependencies: `libsqlite3-sys` (MIT; build: `cc`, `pkg-config`, `vcpkg`), `hashlink`, `hashbrown`, `foldhash` (Zlib, added to `deny.toml` for it), `fallible-iterator`, `fallible-streaming-iterator`, `smallvec`, `bitflags`. MIT. |
|
|
| `roncho` | 1.0.0 | `memoryd` from M5c | The owner's Honcho client (`docs/specs/2026-09-25-roncho-requirements.md`). `default-features = false`, feature `tls` (which implies `blocking`): a blocking client over `std::net`, no async runtime; TLS through `rustls`, already a dependency of `gatewayd`. It adds only itself to the lock file: `serde`, `serde_json`, `thiserror`, `toml`, `zeroize` and the TLS crates are already there. Checked against its requirements on 2026-09-27 (every client built with `.without_config_file()`, spec M5c section 6). Apache-2.0. |
|
|
|
|
## Ported code
|
|
|
|
- `crates/bxcore/src/sanitize/flag.rs` (M5b): rules 1 to 7 translated from Hermes Agent's
|
|
`tools/threat_patterns.py` (github.com/NousResearch/hermes-agent at
|
|
d0288be5b3330d2442e3907185b8e9d0958297bb), Copyright (c) 2025 Nous Research, MIT License.
|
|
Patterns only, rewritten as word sequences with no regex crate; the rules left out, and why, are
|
|
in the module comment.
|
|
|
|
## Build inputs
|
|
|
|
`flake.nix` has one input, `nixpkgs`, pinned to `nixos-26.05` in `flake.lock`: the release the
|
|
owner's NixOS hosts run, so a host's config can use the flake with
|
|
`inputs.boxmaker.inputs.nixpkgs.follows = "nixpkgs"`. It has Rust 1.95.0, the workspace's
|
|
`rust-version`. Nix fetches it when building, never the harness when running, so it is not in
|
|
`docs/egress.md`.
|
|
|
|
- `nix build` builds every binary (`result/bin/`); the tests are not run there, only in `make gate`.
|
|
- `nix build .#tools-image` builds the tool containers' image (`deploy/tools-image.nix`).
|
|
- `nix develop` gives a shell with `cargo`, `rustc`, `clippy`, `rustfmt`, `cargo-deny` and `make`.
|
|
- With direnv (NixOS: `programs.direnv.enable`), `.envrc` enters that shell on `cd`; run
|
|
`direnv allow` once per clone. It does nothing on a host without Nix.
|