neiam /gitgud

[package]
name = "gitgud_apt"
version = "0.1.0"
edition = "2021"
license = "MIT"
publish = false

[lib]
name = "gitgud_apt"
path = "src/lib.rs"
crate-type = ["cdylib"]

[dependencies]
rustler = "0.34"

# OpenPGP signing for the apt repository. OTP can't do this: `:public_key`
# speaks PKCS/X.509, and apt wants OpenPGP packets.
#
# Backend choice, which is the load-bearing decision here:
#
#   * `crypto-nettle` is the default and pulls libnettle + libgmp into
#     the *runtime* image. This project ships k8s manifests, and its
#     runner image installs no such packages — a NIF that dragged them
#     in would be a deployment change disguised as a dependency.
#   * `crypto-rust` builds with no system libraries at all, but sequoia
#     gates it behind `allow-experimental-crypto` and
#     `allow-variable-time-crypto`. This code holds a private key; a
#     variable-time implementation is not the right place to save a
#     package.
#   * `crypto-openssl` links libssl/libcrypto, which are already in
#     both images — the builder installs libssl-dev for gix, and the
#     runner installs openssl for the Erlang runtime. No new packages
#     in either, and constant-time audited crypto.
#
# So: openssl. `default-features = false` is what actually keeps nettle
# out; naming a backend alone does not.
sequoia-openpgp = { version = "2", default-features = false, features = [
  "crypto-openssl",
] }
anyhow = "1"

# Decompression for a .deb's control member. dpkg has used xz since
# squeeze and Ubuntu ships zstd, and OTP can decompress neither —
# `:erl_tar` handles gzip and nothing else. Both crates are pure Rust,
# so this stays a code dependency rather than another system library in
# the image. `lzma-rs` also encodes xz, which is what lets the
# repository offer `Packages.xz` as the Debian guidance asks.
lzma-rs = "0.3"
ruzstd = "0.7"