fix(deps): take peripheral-core from the registry, not the sibling repo - #24
Merged
Conversation
This repo declared
peripheral-core = { version = "0.8", path = "../peripheral-forensic/core" }
which leaves the repository. CI clones usb-forensic alone, so the directory is
absent, `cargo metadata` fails at manifest loading, and every cargo-based job
dies before doing any work -- 15 checks red for one cause, with an error naming
none of them.
The manifest stated the exit condition: the path bridge existed only because
peripheral-core's ShellBags reader was unpublished. peripheral-core 0.8.2 ships
it (verified against the published .crate: `pub mod shellbag` is present), so
the bridge goes.
The version requirement does not change. 0.8.2 is a patch release within the
existing "0.8" caret, so dropping `path` is the whole edit; Cargo.lock now
records the registry source and checksum for 0.8.2.
The stale comment above the dependency justified the old pin and would have
outlived the reason for it, so it now records what 0.8.2 buys instead.
Verified: the fleet path-dep check reports every path dependency staying inside
the repository, the workspace compiles, fmt and clippy are clean, and all 10
suites pass.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
…rom h4x0r Both were first-party while peripheral-core came in by path: nothing was fetched from a registry, so nothing needed a supply-chain record. Taking peripheral-core from crates.io makes it, and the forensicnomicon-core it pulls with it, real registry downloads with a real vetting obligation. Both are ours, published by h4x0r, so both take ADR-0018 mechanism 2 -- `cargo vet trust`, not an `[[exemptions]]` entry. A trust record binds to the publisher rather than a version, so it survives the next release instead of going stale on it. `cargo vet --locked` -- CI's exact invocation -- now succeeds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What was wrong
15 of 18 checks were red on
main, for one cause. The manifest declared:That path leaves the repository. CI clones usb-forensic alone, so the directory
is absent,
cargo metadatafails at manifest loading, and every cargo-basedjob dies before doing any work — Clippy, Format, Test, MSRV, Docs, Coverage,
cargo-deny, Cargo Vet, four fuzz targets and both release-plz jobs, none of
which is actually broken. The error names none of them.
It resolved on a developer machine because the whole fleet is checked out side
by side, which is precisely why it survived.
Why it can go now
The manifest stated its own exit condition: the path bridge existed only because
peripheral-core's ShellBags reader was unpublished. peripheral-core 0.8.2
ships it — verified against the published
.crate, wherepub mod shellbagis present, rather than inferred from the changelog.
The version requirement doesn't change: 0.8.2 is a patch release inside the
existing
"0.8"caret, so droppingpathis the entire edit.Cargo.locknowrecords the registry source and checksum for 0.8.2.
The comment above the dependency justified the old pin and would have outlived
its reason, so it now records what 0.8.2 buys instead.
Verification
cargo check --workspace --all-targets— compilescargo fmt --all -- --check— cleancargo clippy --workspace --all-targets -- -D warnings— cleancargo test --workspace— 10 suites, 0 failuresNote on what stays red
The four
Fuzz *jobs were never able to run while metadata was broken. If anystay red after this lands, those are genuine findings that were masked, not
regressions from this change — the same pattern that turned up real bugs in
sqlite-core and luks-forensic.