Cargo.toml

Rama main · réplica de lectura del repositorio original.

[workspace]
resolver = "2"
members = ["backend"]

[workspace.package]
version = "1.12.0"
edition = "2021"
license = "MIT"
repository = "https://github.com/yourorg/artifact-keeper"

# Release codegen settings. All three are about the SIZE of the shipped binary
# and none of them changes what it does (issue #3637).
#
#   strip = true    symbols out. Already here for #1544; kept. `cargo
#                   auditable`'s `.dep-v0` section survives it, which is why
#                   the embedded-SBOM release gate still has something to read
#                   (release.yml, "Verify the shipped binary carries its
#                   dependency graph").
#   lto = "thin"    cross-crate LTO over the whole graph. This is where the
#                   reduction comes from: the binary links ~1k crates and most
#                   of what LTO drops is code no call graph reaches.
#   codegen-units   1, so LTO sees one module per crate rather than 16
#                   partially optimised ones.
#
# Measured cold on this tree, aarch64-unknown-linux-gnu, `--features
# vendored-openssl`, stripped in every case:
#
#   lto=false cgu=16 (before)  103,053,744 B  (40,747,417 B gzipped)  400 s
#   lto="thin" cgu=1           87,414,376 B  (36,171,289 B gzipped)  707 s
#   lto="fat"  cgu=1           85,357,736 B  (36,793,059 B gzipped)  922 s
#
# "thin" over "fat" deliberately. Fat buys another 2.0 MiB uncompressed for
# another ~30% build time across a five-target release matrix and every
# `docker/Dockerfile.backend` build -- and every asset now ships compressed, so
# what an operator actually downloads is the gzip column, where thin is the
# SMALLER of the two.
#
# `panic = "abort"` is deliberately NOT set. It would save several more MiB of
# landing pads and unwind tables, but this codebase relies on unwinding at
# runtime: `services/wasm_runtime.rs` wraps WASM execution in
# `std::panic::catch_unwind` precisely so a panicking plugin module cannot take
# the process down, and `telemetry.rs`, `permission_service.rs` and
# `auth_config_service.rs` catch unwinds as well. Under `panic = "abort"`
# `catch_unwind` never returns `Err` -- the process aborts instead -- which is a
# runtime behaviour change, and this issue is explicitly not that.
[profile.release]
strip = true
lto = "thin"
codegen-units = 1

# Per-PR image builds only (`CARGO_PROFILE=ci` in ci.yml's build-backend-image
# job, passed through to docker/Dockerfile.backend). Those images feed the
# smoke/E2E jobs and are never published. Inherits release, so `strip` is
# kept, but drops LTO, uses 16 codegen units and opt-level 2 instead of 3:
# thin LTO over a single codegen unit is where the release build spends its
# time. Measured on this tree, `cargo build --bin artifact-keeper` at -j8,
# cold, aarch64: 317 s vs 601 s for `release` (the LTO'd bin step alone
# 191 s -> 13 s), peak rustc RSS 12.1 vs 11.4 GiB (16 codegen units in flight,
# not LTO), stripped binary 97 MiB vs 81 MiB. opt-level 1 was measured too: a
# further 33 s for another 5 MiB and a less release-like image.
#
# Everything that publishes (docker-publish.yml, release.yml) and every other
# build of the Dockerfile (e2e.yml, the compose files) keeps the default
# `release`; do not pass this profile to a build whose output ships.
[profile.ci]
inherits = "release"
lto = false
codegen-units = 16
opt-level = 2

# The lib test harness is one crate with ~17.5k inline tests, and its rustc
# is the process that hits the unit job's memory ceiling. 256 codegen units
# (what incremental builds use anyway) keep fewer LLVM modules live at once.
# Measured instrumented, as ci.yml builds it (`--lib --no-run`, 4 jobs,
# debuginfo off, aarch64): 16.55 -> 15.56 GiB peak RSS for that rustc, same
# wall time, +0.04 GiB in the link. Package-scoped on purpose: `cargo test`
# builds dependencies under the test profile too, so the profile-wide
# CARGO_PROFILE_TEST_CODEGEN_UNITS recompiles ~650 crates (and shifts the
# dependency cache key) for the same saving; this touches only this crate.
[profile.test.package.artifact-keeper-backend]
codegen-units = 256

[workspace.dependencies]
# Async runtime
tokio = { version = "1.50", features = ["full"] }

# Web framework
axum = { version = "0.7", features = ["multipart", "tokio"] }
tower = { version = "0.5", features = ["full"] }
tower-http = { version = "0.7", features = ["cors", "trace", "compression-gzip", "compression-br"] }

# Database
sqlx = { version = "0.9", features = ["runtime-tokio", "postgres", "uuid", "chrono", "json", "tls-rustls"] }

# Serialization
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"

# Authentication
jsonwebtoken = { version = "11.1", features = ["aws_lc_rs"] }
bcrypt = "0.19"

# Checksums
sha2 = "0.10"
md-5 = "0.10"
# `oid` exposes `AssociatedOid` for Sha1, which `rsa::pkcs1v15::SigningKey<Sha1>`
# needs to build the PKCS#1 v1.5 DigestInfo prefix. Required by the apk
# `.SIGN.RSA` index signature, whose digest algorithm apk fixes to SHA-1.
sha1 = { version = "0.10", features = ["oid"] }
hmac = "0.12"

# Encryption
aes-gcm = "0.10"

# Secret-material zeroization: wipes plaintext key buffers on drop so the
# decrypted PEM / OpenPGP armor bytes don't linger in freed heap memory
# between SigningService::load_openpgp_secret_key and the rPGP parser
# (artifact-keeper #1328).
zeroize = { version = "1.8", features = ["alloc", "derive"] }

# S3 storage using Apache object_store crate (supports custom CA certs for TLS)
object_store = { version = "0.14", features = ["aws"] }

# HTTP types (used for presigned URL methods)
http = "1"
http-body = "1"
http-body-util = "0.1"

# Logging/Tracing
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json", "registry"] }

# OpenTelemetry (opt-in via OTEL_EXPORTER_OTLP_ENDPOINT)
opentelemetry = "0.33"
# The backend's dev-dependencies add `testing` (in-memory log exporter) and
# `experimental_metrics_custom_reader` (`ManualReader`) for the #4337 tests
# only; the production build does not compile either.
opentelemetry_sdk = { version = "0.33.1", features = ["rt-tokio"] }
# The HTTP/protobuf exporter must use the BLOCKING reqwest client, supplied by
# opentelemetry-otlp's default `reqwest-blocking-client` feature. Do not add
# `reqwest-client` here: when it is enabled the builder picks the async client
# first (its documented priority order), and `BatchSpanProcessor` then drives
# that client from its own OS thread, which has no Tokio runtime -- the first
# export panics with "there is no reactor running". The blocking impl runs the
# request synchronously inside the future, so it needs no reactor.
# Construction is also safe inside `#[tokio::main]`: otlp builds the blocking
# client on a spawned OS thread (`exporter/http/mod.rs` joins
# `std::thread::spawn`) so it never calls `reqwest::blocking` on the runtime.
# Do not re-add a direct `opentelemetry-http` pin with `features = ["reqwest"]`
# -- that is the async impl, unused in this tree, and the most likely prompt
# to re-enable `reqwest-client` on otlp. #835 pinned it for two coexisting
# reqwest versions; otlp 0.33 resolves to the same reqwest 0.13 the app uses.
opentelemetry-otlp = { version = "0.33", features = ["grpc-tonic", "http-proto", "logs"] }
tracing-opentelemetry = "0.34"

# Metrics
metrics = "0.24"
metrics-exporter-prometheus = "0.18"
# `layers::Fanout` puts the Prometheus and OTel recorders side by side (#4337);
# it needs no feature. The backend's dev-dependencies add `debugging` for the
# `DebuggingRecorder` tests.
metrics-util = { version = "0.20", default-features = false }

# Error handling
thiserror = "2.0"
anyhow = "1.0"

# Config
dotenvy = "0.15"

# UUID
uuid = { version = "1.7", features = ["v4", "serde"] }

# Time
chrono = { version = "0.4", features = ["serde"] }
cron = "0.17"

# HTTP client (for proxy repos)
reqwest = { version = "0.13", features = ["json", "stream", "form"] }

# URL encoding
serde_urlencoded = "0.7"

# Async streams
futures = "0.3"
tokio-util = { version = "0.7", features = ["io"] }
tokio-stream = "0.1"
bytes = "1.5"

# CLI
clap = { version = "4.5", features = ["derive", "env"] }

# WASM runtime
wasmtime = { version = "36.0.20", features = ["component-model", "async"] }
wasmtime-wasi = "36.0.20"

# Git operations
git2 = "0.21"

# OpenSSL (vendored feature for cross-compilation in release builds)
openssl = { version = "0.10" }
opensearch = "2"

# OpenAPI
utoipa = { version = "5", features = ["axum_extras", "chrono", "uuid"] }
utoipa-axum = "0.2"
utoipa-swagger-ui = { version = "8", features = ["axum"] }

# gRPC
tonic = "0.14"
tonic-prost = "0.14"
tonic-reflection = "0.14"
prost = "0.14"
prost-types = "0.14"
tonic-prost-build = "0.14"
prost-build = "0.14"

# URL parsing and resolution
url = "2.5"

# XML Digital Signatures (SAML signature verification).
# Pinned to 0.3.x: 0.4.0 pulls in `kryptering 0.1.0` (HSM/PKCS11 support),
# which fails to cross-compile on Windows because it does u64.into() on
# `cryptoki::types::Ulong`, but `Ulong: From<u32>` only on Windows targets
# where CK_ULONG = u32. Unblock once kryptering ships a Windows-portable fix.
bergshamra = "=0.5.1"

# SMTP email delivery
lettre = { version = "0.11", features = ["tokio1-native-tls", "builder"] }

# In-memory cache with TTL eviction (used by #2079 Maven metadata cache).
moka = { version = "0.12", features = ["future"] }

# Optional shared backend for the npm computed-packument cache (#2162).
# rustls TLS so rediss:// URLs work; connection-manager for auto-reconnect.
redis = { version = "1.2", default-features = false, features = [
    "tokio-rustls-comp",
    "connection-manager",
] }