fix(core): path dep escaping the repo made cargo metadata fail, taking 11 checks down - #5
Merged
Merged
Conversation
… repo
`core/Cargo.toml` declared `forensicnomicon-core = { version = "1.4", path =
"../../../knowledge/forensicnomicon/crates/core" }`. That path leaves this
repository and lands in the sibling `components/knowledge/forensicnomicon`.
CI clones peripheral-forensic alone, so the directory is absent and manifest
loading fails before any check begins:
error: failed to load manifest for workspace member
/home/runner/work/peripheral-forensic/peripheral-forensic/core
failed to load manifest for dependency `forensicnomicon-core`
No such file or directory (os error 2)
That single failure is why 11 checks are red at once -- Clippy, Format, Test,
MSRV, Docs, Coverage, cargo-deny, Cargo Vet, the fuzz smoke and both
release-plz jobs. None of them is a lint, test, advisory or audit failure;
none of them ran.
It is invisible locally because the whole fleet is checked out side by side
and the path resolves. forensicnomicon-core 1.5.0 is published and satisfies
the existing `1.4` caret, so dropping `path` needs no version change:
Cargo.lock now records `source = "registry+https://github.com/rust-lang/crates.io-index"`.
Verified: `cargo check --workspace --all-targets` compiles, `cargo fmt --all
-- --check` and `cargo clippy --workspace --all-targets -- -D warnings` are
clean, `cargo test --workspace` passes 75 tests with 0 failures.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Cargo Vet could not resolve the graph while `cargo metadata` was broken, so it reported failure without checking a crate. Now that it runs it names two unvetted dependencies. forensicnomicon-core is mine: it was first-party while it was a path dependency, and taking it from the registry creates a real vetting obligation. shellitem was pre-existing and merely invisible. Both are ours, published to crates.io by h4x0r, so both take ADR-0018 mechanism 2 -- `cargo vet trust`, not an `[[exemptions]]` entry. A trust record binds to the publisher identity rather than a version, so it does not go stale on the next release. `cargo vet --locked` -- CI's exact invocation, which forbids refreshing the publisher cache -- now succeeds.
The 100% line gate could not run while `cargo metadata` was broken. With it running again it names ten uncovered production lines, none annotated `// cov:unreachable`: `DeviceConnection::vendor_name` and `product_name` in core/src/lib.rs, and two branches in core/src/usb_ids.rs -- the `continue` that skips a two-tab interface line, and `parse_id_line`'s rejection when the id is not followed by two spaces. Tests only; no production code changes. Both files now report 100% line coverage locally. Writing the separator test turned up a small deviation worth recording rather than quietly fixing. `parse_id_line`'s doc says the id must be followed by "exactly two spaces", but the check reads positions 4..6 only, so a third space is accepted and survives as a leading space in the name -- `trim_end` does not touch the front. No real usb.ids line reaches it, since the format uses exactly two spaces throughout. `a_wider_separator_is_accepted_and_keeps_ the_surplus_in_the_name` asserts the current behaviour so that changing it is a visible decision instead of a silent one.
h4x0r
marked this pull request as ready for review
August 4, 2026 04:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was wrong
11 checks are red on
main— Clippy, Format, Test, MSRV, Docs, Coverage,cargo-deny, Cargo Vet, the nightly fuzz smoke and both release-plz jobs. None
of them is a lint, test, advisory or audit failure. None of them ran. They all
died in the same place:
core/Cargo.tomlreached outside the repository:CI clones this repo alone, so that sibling directory does not exist.
The fix
forensicnomicon-core 1.5.0is published and already satisfies the1.4caret, so dropping
pathneeds no version change.Cargo.locknow recordssource = "registry+https://github.com/rust-lang/crates.io-index".Fleet context
A sweep of 454 manifests across 92 repos found 324 path dependencies, of which
3 escape their repository — and all three sit on one chain:
issenusb-forensicperipheral-forensicforensicnomicon-coreusb-forensicperipheral-coreusb-forensiccannot be fixed the same way yet. Its manifest says "switch tothe pure registry
version = "0.9"once peripheral-core publishes thereader", and peripheral-core tops out at 0.8.1 on crates.io. Building
usb-forensic against the published 0.8.1 fails with
unresolved import peripheral_core::shellbag— the localcore/src/lib.rsdeclarespub mod shellbagand the published crate does not, under the same version number0.8.1. So this repo carries unreleased API that was never version-bumped.
Merging this PR lets peripheral-forensic's release pipeline run again, which is
the prerequisite for publishing a peripheral-core that contains
shellbag;only then can usb-forensic come off its path dependency. That ordering is
ADR-0006 bottom-up release order.
Verification
cargo check --workspace --all-targets— compilescargo fmt --all -- --check— cleancargo clippy --workspace --all-targets -- -D warnings— cleancargo test --workspace— 75 passed, 0 failed