neiam /gitgud

[package]
name = "gitgud_apt"
version = "0.1.0"
edition = "2021"
license = "MIT"
publish = false

[lib]
name = "gitgud_apt"
path = "src/lib.rs"
crate-type = ["cdylib"]

[dependencies]
rustler = "0.34"

# OpenPGP signing for the apt repository. OTP can't do this: `:public_key`
# speaks PKCS/X.509, and apt wants OpenPGP packets.
#
# Backend choice, which is the load-bearing decision here:
#
#   * `crypto-nettle` is the default and needs nettle-dev + libgmp-dev
#     in the *builder* image on top of libclang-dev, and the builder
#     installs none of them. This project ships k8s manifests, and a
#     NIF that changes an image's package list is a deployment change
#     disguised as a dependency. (The runtime image does carry
#     libnettle/libgmp already, but only as a transitive dependency of
#     git — not something to hang signing on.)
#   * `crypto-rust` builds with no system libraries at all, but sequoia
#     gates it behind `allow-experimental-crypto` and
#     `allow-variable-time-crypto`. This code holds a private key; a
#     variable-time implementation is not the right place to save a
#     package.
#   * `crypto-openssl` links libssl/libcrypto, which both images
#     already name outright — libssl-dev in the builder for gix,
#     openssl in the runner for the Erlang runtime. It costs one
#     build-stage package, libclang-dev, because openssl-sys generates
#     its bindings with bindgen; every C-binding backend needs that,
#     so it is not a reason to prefer another. Constant-time, audited.
#
# So: openssl. `default-features = false` is what actually keeps nettle
# out; naming a backend alone does not.
sequoia-openpgp = { version = "2", default-features = false, features = [
  "crypto-openssl",
] }
anyhow = "1"

# Decompression for a .deb's control member. dpkg has used xz since
# squeeze and Ubuntu ships zstd, and OTP can decompress neither —
# `:erl_tar` handles gzip and nothing else. Both crates are pure Rust,
# so this stays a code dependency rather than another system library in
# the image. `lzma-rs` also encodes xz, which is what lets the
# repository offer `Packages.xz` as the Debian guidance asks.
lzma-rs = "0.3"
ruzstd = "0.9"