# Project export: Siorb This document was generated by HackStack to give an AI agent context about a hackathon project. Sections are labeled with their provenance; content marked as truncated was cut to keep this document small. ## Project metadata - Hackathon: OpenAI Build Week - Tagline: Multi platform package manager. Now its not important if you're on Mac/Windows/Linux, you need to have only one packet manager. No more problems after operating system migrations. - Devpost: https://devpost.com/software/accio-xwy6pv - GitHub: https://github.com/bulengerk/siorb - Video: https://www.youtube.com/embed/9AD_mlODqxA?enablejsapi=1&hl=en_US&rel=0&start=&version=3&wmode=transparent - Team: 1 GitHub contributor(s) — Kacper Bulenger (33 commits) ## Devpost submission (written by the team) ### Inspiration Installing software should be simple, regardless of the operating system. Siorb lets users request an app by name and safely uses the native package manager available on Windows, macOS, or Linux. But user is no longer obliged to remember package manager name in specific sys op ### What it does Siorb is a cross-platform CLI for discovering, installing, updating, and removing software. It detects the system and package manager, resolves human-friendly names to verified native package IDs, and presents an execution plan before making changes. It supports search, diagnostics, dry-runs, JSON output, and portable bundles—without accounts, servers, or API keys. ### How we built it Siorb is built in Rust as a platform-neutral core with adapters for individual package ecosystems. Commands are executed through safe argument arrays rather than shell interpolation. Package metadata, documentation, and the website are static. Automated workflows validate changes and prepare releases. Challenges The same application can have different identifiers, publishers, versions, scopes, and installation rules across platforms. Package managers also vary in privileges, update behavior, prompts, and rollback support. Security is critical: incorrect mappings can lead to incorrect software being installed. Siorb therefore focuses on exact IDs, validated metadata, visible plans, and native trusted sources. Accomplishments Siorb provides one consistent interface while preserving the strengths of each operating system’s native package ecosystem. It avoids fuzzy installs, hidden privilege escalation, shell-command injection, and misleading rollback promises. ### What we learned A universal package tool should not replace every dependency solver. Its role is to understand user intent, select a safe native path, preserve software identity, and clearly explain the result. Reliable package metadata and continuous verification are the core long-term challenge. ### What's next The initial MVP targets Windows, macOS, and Ubuntu with support for major native package managers and a curated application registry. Future work includes signed registry data, self-updates, bundle restore, package verification, more Linux backends, offline support, SBOM export, organization policies, and community-maintained mappings. ## README (from the GitHub repository) # Siorb Siorb is a cross-platform CLI for managing software through the package manager already installed on the computer. It finds a compatible package, shows the exact plan, asks for consent, runs the native tool, and verifies the result. It supports Windows, macOS, and Linux package managers including WinGet, Chocolatey, Scoop, Homebrew, APT, DNF, Yum, Pacman, Zypper, APK, Snap, and Flatpak. Resolution uses a bundled catalog and works without accounts, telemetry, a daemon, or a hosted service. ## Build and install Install Git and Rust 1.85 with [rustup](https://rustup.rs/). Platform build requirements: | Platform | Additional requirement | |---|---| | Linux | A C build toolchain such as `build-essential` | | macOS | Xcode Command Line Tools: `xcode-select --install` | | Windows | Visual Studio Build Tools with **Desktop development with C++** | Clone and build on Linux, macOS, or Windows PowerShell: ```sh git clone https://github.com/bulengerk/siorb.git cd siorb cargo build --release --locked -p siorb-cli ``` Run without installing: ```sh cargo run --locked -p siorb-cli -- version ``` Install for the current user: ```sh cargo install --path crates/siorb-cli --locked siorb version ``` Cargo installs to `$HOME/.cargo/bin` on Linux/macOS and `%USERPROFILE%\.cargo\bin` on Windows. Signed releases can also provide `.deb`, `.rpm`, `.pkg`, `.msi`, `.zip`, and `.tar.gz` packages. ## Use ```sh siorb search browser siorb info firefox siorb install firefox --dry-run --explain siorb install firefox --yes siorb doctor --json ``` Use `--dry-run` to preview changes. Use `--yes` only after reviewing the plan. Run `siorb --help` for every command and option. ## How it works 1. Detect the operating system, architecture, and available package managers. 2. Resolve the request from the local catalog and policy. 3. Produce an explainable, typed installation plan. 4. Execute only after consent, then verify and record the result. ## How it was created Codex translated the project specification into a Rust workspace, package catalog, tests, documentation, packaging, website, and CI/release automation. Maintainers remain responsible for review and production signing. ## Development ```sh cargo fmt --check cargo clippy --workspace --all-targets --all-features -- -D warnings cargo test --workspace --all-features cargo xtask verify ``` See `CONTRIBUTING.md` and `SECURITY.md` for contribution and security guidance. ## Codex Work Sessions ### 2026-07-14 05:56 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Implement the complete Siorb specification, document Codex usage, validate the result, and publish it. - **Work completed:** Built the cross-platform Rust CLI, signed catalog/update path, deterministic resolver/planner, native and artifact execution, state/bundle/policy workflows, static site, tests, packaging, and release automation. - **Key files changed:** `Cargo.toml`, `crates/`, `catalog/`, `schemas/`, `tests/`, `fuzz/`, `website/`, `docs/`, `packaging/`, `.github/`, and project documentation. - **Decisions:** Kept resolution local and serverless, required typed plans and post-operation verification, used static TUF-style metadata, and kept production trust/signing owner-controlled. - **Validation:** Passed formatting, strict Clippy, workspace/standalone/fuzz checks, schema/catalog/docs/site gates, RustSec and license/source policy checks, the local 10x p95 benchmark, and production-shaped local package verification. - **Known limitations or blockers:** Native Windows/macOS execution and protected multi-platform CI were not run locally; production signing, notarization, and publication require repository-owner credentials. - **Next starting point:** Run protected multi-platform CI and provision the documented production signing and publication secrets. ### 2026-07-14 07:28 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Restore the Pages pipeline and make Dependabot updates pass their repository checks. - **Work completed:** Repaired the runtime-TUF hash fixture, Windows WiX variables, cross-platform Clippy issues, and Dependabot-safe security workflow behavior. - **Key files changed:** `.github/workflows/security.yml`, `catalog/fixtures/runtime-tuf/`, `crates/siorb-{cli,executor,policy,state,update}/`, `packaging/windows/siorb.wxs`, and `scripts/release/test-packaging.sh`. - **Decisions:** Retained Rust dependency policy checks for Dependabot, skipped unavailable GitHub-only review/CodeQL jobs for its read-only token, and used CodeQL's Rust `none` build mode. - **Validation:** Passed native Linux tests and strict Clippy plus cross-target strict Clippy for Windows and macOS; catalog, site, packaging, and repository gates are queued below. - **Known limitations or blockers:** GitHub Pages is currently disabled in repository settings and must be enabled with GitHub Actions as its source by a repository owner. - **Next starting point:** Push these repairs, enable Pages if still disabled, then let Dependabot rebase and rerun its open updates. ### 2026-07-14 07:48 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Diagnose the remaining native Windows state-store checks on refreshed Dependabot pull requests. - **Work completed:** Added failure-context output to the two state-store assertions that had previously hidden the underlying Windows error. - **Key files changed:** `crates/siorb-cli/src/lib.rs` and `README.md`. - **Decisions:** Kept the assertions strict while making failures actionable from GitHub Actions logs. - **Validation:** Passed formatting, the CLI unit suite, and `cargo xtask verify` after recording this entry. - **Known limitations or blockers:** A native Windows rerun is required to report and then resolve the remaining platform-specific initialization error. - **Next starting point:** Push this diagnostic improvement, refresh a Dependabot branch, and inspect the native Windows test output. ### 2026-07-14 07:54 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Resolve the native Windows state-store ownership failure found on the refreshed Dependabot check. - **Work completed:** Allowed the built-in Administrators SID as a trusted state-file owner and retained explicit current-user access checks. - **Key files changed:** `crates/siorb-state/src/lib.rs` and `README.md`. - **Decisions:** Accepted only the current user or the Administrators SID as owner; arbitrary groups and users remain rejected. - **Validation:** Passed formatting, strict Windows-target Clippy for both MSVC architectures, and local `siorb-state` plus `siorb-cli` tests. - **Known limitations or blockers:** The final native Windows rerun is still required after pushing this ownership adjustment. - **Next starting point:** Push the adjustment, refresh Dependabot branches, and confirm both Windows MSVC matrices pass. ### 2026-07-14 07:58 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Prevent Dependabot pull requests from failing the human/Codex session-log contract. - **Work completed:** Made the repository verifier exempt only Dependabot-authored pull requests from the new-session requirement. - **Key files changed:** `crates/siorb-xtask/src/repository.rs` and `README.md`. - **Decisions:** Read the pull-request author from GitHub's event payload rather than trusting the mutable workflow actor. - **Validation:** Passed formatter, xtask unit tests, and strict xtask Clippy; full repository verification follows this entry. - **Known limitations or blockers:** The exemption is intentionally limited to GitHub pull-request events whose author is exactly `dependabot[bot]`. - **Next starting point:** Run full verification, push the verifier update, and refresh Dependabot branches. ### 2026-07-14 08:00 UTC — 019f5d0a-6e2c-7b73-a060-91c6dc9dcca2 - **Objective:** Complete Dependabot verifier handling and expose the remaining Windows catalog-verification failure. - **Work completed:** Added exact Dependabot event dete [README truncated for size] ## Detected evidence (automated analysis) Indexed codebase: 299 recognized source files, 2491 KB. - CSS (language) — detected in the code - HTML (language) — detected in the code - JavaScript (language) — detected in the code - Python (language) — detected in the code - Rust (language) — detected in the code - AI coding agent: Codex — evidence: config files committed to the repository ## Codebase structure (from repository index) ### Files (120 of 649) ``` .cargo/config.toml .gitattributes .github/dependabot.yml .github/ISSUE_TEMPLATE/bug.yml .github/ISSUE_TEMPLATE/catalog-mapping.yml .github/ISSUE_TEMPLATE/config.yml .github/PULL_REQUEST_TEMPLATE.md .github/workflows/benchmark.yml .github/workflows/catalog-health.yml .github/workflows/catalog.yml .github/workflows/ci.yml .github/workflows/native-smoke.yml .github/workflows/packaging.yml .github/workflows/pages.yml .github/workflows/release-candidate.yml .github/workflows/release.yml .github/workflows/security.yml .gitignore AGENTS.md benches/baseline.json benches/README.md Cargo.lock Cargo.toml catalog/build-index.mjs catalog/catalog.toml catalog/fixtures/policies/deny-direct-artifacts.toml catalog/fixtures/policies/invalid-network-domain.toml catalog/fixtures/runtime-tuf/attacks/expired/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/expired/1.targets.json catalog/fixtures/runtime-tuf/attacks/expired/catalog.json catalog/fixtures/runtime-tuf/attacks/expired/fixture.json catalog/fixtures/runtime-tuf/attacks/expired/runtime-root.json catalog/fixtures/runtime-tuf/attacks/expired/timestamp.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/1.targets.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/catalog.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/fixture.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/runtime-root.json catalog/fixtures/runtime-tuf/attacks/metadata-hash/timestamp.json catalog/fixtures/runtime-tuf/attacks/mix-match/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/mix-match/1.targets.json catalog/fixtures/runtime-tuf/attacks/mix-match/catalog.json catalog/fixtures/runtime-tuf/attacks/mix-match/fixture.json catalog/fixtures/runtime-tuf/attacks/mix-match/runtime-root.json catalog/fixtures/runtime-tuf/attacks/mix-match/timestamp.json catalog/fixtures/runtime-tuf/attacks/rollback/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/rollback/1.targets.json catalog/fixtures/runtime-tuf/attacks/rollback/catalog.json catalog/fixtures/runtime-tuf/attacks/rollback/fixture.json catalog/fixtures/runtime-tuf/attacks/rollback/runtime-root.json catalog/fixtures/runtime-tuf/attacks/rollback/timestamp.json catalog/fixtures/runtime-tuf/attacks/root-threshold/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/root-threshold/1.targets.json catalog/fixtures/runtime-tuf/attacks/root-threshold/catalog.json catalog/fixtures/runtime-tuf/attacks/root-threshold/fixture.json catalog/fixtures/runtime-tuf/attacks/root-threshold/runtime-root.json catalog/fixtures/runtime-tuf/attacks/root-threshold/timestamp.json catalog/fixtures/runtime-tuf/attacks/target-hash/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/target-hash/1.targets.json catalog/fixtures/runtime-tuf/attacks/target-hash/catalog.json catalog/fixtures/runtime-tuf/attacks/target-hash/fixture.json catalog/fixtures/runtime-tuf/attacks/target-hash/runtime-root.json catalog/fixtures/runtime-tuf/attacks/target-hash/timestamp.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/1.targets.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/catalog.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/fixture.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/runtime-root.json catalog/fixtures/runtime-tuf/attacks/targets-mix-match/timestamp.json catalog/fixtures/runtime-tuf/attacks/threshold/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/threshold/1.targets.json catalog/fixtures/runtime-tuf/attacks/threshold/catalog.json catalog/fixtures/runtime-tuf/attacks/threshold/fixture.json catalog/fixtures/runtime-tuf/attacks/threshold/runtime-root.json catalog/fixtures/runtime-tuf/attacks/threshold/timestamp.json catalog/fixtures/runtime-tuf/attacks/truncation/1.snapshot.json catalog/fixtures/runtime-tuf/attacks/truncation/1.targets.json catalog/fixtures/runtime-tuf/attacks/truncation/catalog.json catalog/fixtures/runtime-tuf/attacks/truncation/fixture.json catalog/fixtures/runtime-tuf/attacks/truncation/runtime-root.json catalog/fixtures/runtime-tuf/attacks/truncation/timestamp.json catalog/fixtures/runtime-tuf/generate.mjs catalog/fixtures/runtime-tuf/README.md catalog/fixtures/runtime-tuf/valid/1.snapshot.json catalog/fixtures/runtime-tuf/valid/1.targets.json catalog/fixtures/runtime-tuf/valid/catalog.json catalog/fixtures/runtime-tuf/valid/fixture.json catalog/fixtures/runtime-tuf/valid/runtime-root.json catalog/fixtures/runtime-tuf/valid/timestamp.json catalog/fixtures/tuf/changed-root/metadata/2.root.json catalog/fixtures/tuf/expired/metadata/timestamp.json catalog/fixtures/tuf/freeze/metadata/timestamp.json catalog/fixtures/tuf/hash-mismatch/targets/catalog.json catalog/fixtures/tuf/interrupted-update/state.json catalog/fixtures/tuf/invalid-threshold/metadata/root.json catalog/fixtures/tuf/mirror-inconsistency/metadata/snapshot.json catalog/fixtures/tuf/README.md catalog/fixtures/tuf/rollback/metadata/snapshot.json catalog/fixtures/tuf/truncated/metadata/snapshot.json catalog/fixtures/tuf/valid/metadata/1.root.json catalog/fixtures/tuf/valid/metadata/1.snapshot.json catalog/fixtures/tuf/valid/metadata/1.targets.json catalog/fixtures/tuf/valid/metadata/root.json catalog/fixtures/tuf/valid/metadata/snapshot.json catalog/fixtures/tuf/valid/metadata/targets.json catalog/fixtures/tuf/valid/metadata/timestamp.json catalog/fixtures/tuf/valid/targets/catalog.json catalog/generated/catalog.json catalog/index.json catalog/lib/manifest.mjs catalog/packages/act.toml catalog/packages/age.toml catalog/packages/alacritty.toml catalog/packages/ansible.toml catalog/packages/audacity.toml catalog/packages/bat.toml catalog/packages/bitwarden.toml catalog/packages/blender.toml catalog/packages/borgbackup.toml catalog/packages/brave.toml [529 more files omitted for size] ``` ### Dependencies - crates/siorb-backends/Cargo.toml: proptest, serde, siorb-catalog, siorb-core, siorb-resolver - crates/siorb-bundle/Cargo.toml: serde, serde_json, siorb-catalog, siorb-core, siorb-policy, siorb-resolver, toml - crates/siorb-catalog/Cargo.toml: proptest, serde, serde_json, siorb-core, tempfile, toml, unicode-normalization, url, walkdir - crates/siorb-cli/Cargo.toml: clap, clap_complete, serde, serde_json, siorb-backends, siorb-bundle, siorb-catalog, siorb-core, siorb-executor, siorb-planner, siorb-platform, siorb-policy, siorb-resolver, siorb-state, siorb-update, tempfile, toml - crates/siorb-core/Cargo.toml: hex, proptest, serde, serde_json, sha2, thiserror - crates/siorb-executor/Cargo.toml: flate2, hex, reqwest, serde, sha2, siorb-backends, siorb-catalog, siorb-core, siorb-planner, siorb-platform, siorb-resolver, siorb-state, tar, tempfile, zip - crates/siorb-planner/Cargo.toml: proptest, serde, siorb-backends, siorb-catalog, siorb-core, siorb-policy, siorb-resolver - crates/siorb-platform/Cargo.toml: serde, siorb-core, tempfile - crates/siorb-policy/Cargo.toml: semver, serde, siorb-catalog, siorb-core, tempfile, toml, url - crates/siorb-resolver/Cargo.toml: proptest, semver, serde, siorb-catalog, siorb-core, siorb-policy - crates/siorb-state/Cargo.toml: libc, serde, serde_json, siorb-core, tempfile - crates/siorb-update/Cargo.toml: base64, ed25519-dalek, flate2, hex, reqwest, semver, serde, serde_json, sha2, siorb-core, tar, tempfile, url, zip - crates/siorb-xtask/Cargo.toml: clap, ed25519-dalek, hex, serde, serde_json, sha2, siorb-catalog, siorb-cli, siorb-core, siorb-planner, siorb-policy, siorb-resolver, siorb-update, walkdir - fuzz/Cargo.toml: libfuzzer-sys@0.4, serde_json@1.0, siorb-backends, siorb-bundle, siorb-catalog, siorb-core, siorb-executor, siorb-platform, siorb-policy - tests/Cargo.toml: clap@4.5, serde@1.0, serde_json@1.0, sha2@0.10, siorb-backends, siorb-bundle, siorb-catalog, siorb-cli, siorb-core, siorb-executor, siorb-planner, siorb-platform, siorb-policy, siorb-resolver, siorb-state, siorb-update, tar@0.4, tempfile@3.20, zip@4.0 - tests/requirements.txt: jsonschema@==4.23.0 ### Recent commits (newest first) - docs: record fully green Yum pipeline set - docs: record green Yum native smoke - docs: record repaired Yum smoke dispatch - ci: provision Yum privilege broker in Rocky smoke - docs: record Yum hosted validation start - feat: add Yum backend and catalog support - docs: record native pipeline validation - ci: expose native WinGet package path - ci: install WinGet module with PSResourceGet - ci: bootstrap WinGet for native smoke - ci: run WinGet smoke on Windows 2025 - ci: complete native usability smoke tests - ci: repair native pipelines and catalog health - docs: simplify cross-platform README - catalog: expand developer tool coverage - ci: initialize temporary directory at runtime - ci: use runner temporary directory for tests - test: use safe macOS policy fixture - test: use safe macOS executor fixtures - test: avoid macOS temporary path symlinks ## Key source files (fetched from GitHub, selected and truncated for size) ### AGENTS.md ```markdown # Repository instructions - Build with `cargo build --workspace --all-features`; the CLI binary is `siorb`. - Validate with `cargo fmt --check`, strict workspace Clippy, workspace tests, then `cargo xtask verify`. - Run `cargo xtask generate-catalog` and `cargo xtask build-site` after catalog changes; never hand-edit files marked generated. - Never turn catalog text into shell syntax. Backends accept validated executable paths and separate argument vectors. Resolve and plan before privilege or mutation; do not weaken signature, digest, rollback, expiry, archive, or policy checks. - Keep JSON `schema_version` and exit-code compatibility. Update schemas, tests, docs, and examples with behavior changes. - Host-mutating tests require explicit opt-in. Never store credentials, identity, telemetry, or unredacted backend secrets. - Before every Codex response after meaningful project work, append exactly one immutable UTC entry to the physically final `## Codex Work Sessions` section in `README.md`. Never edit earlier entries; use the exact fields documented there and run `cargo xtask verify`. ``` ### CHANGELOG.md ```markdown # Changelog All notable changes to Siorb are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and releases use [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] ### Added - Initial Rust workspace contracts and offline-first architecture. - Explainable cross-platform resolution, planning, native backend execution, portable bundles, receipts, policy enforcement, and verified self-update. - A validated 120-package static catalog with 642 platform mappings and a generated client-side search website. - Typed, verified direct artifacts for portable archives, AppImage, and native Windows, macOS, DEB, and RPM installers. - Deterministic bundle lock application and refresh reports, named feature groups, and active-policy references. - Contributor, security, release, packaging, and operational documentation. - Cross-platform validation, security, catalog-health, Pages, and release workflow definitions. - Opt-in disposable native install/verify/remove smoke jobs for Linux, macOS, and Windows, plus host-safe successful transaction coverage. - Enforced p95 search, resolution, planning, and startup thresholds against a catalog ten times the initial size, including a peak-memory ceiling. - Deterministic archive/DEB tooling, native RPM/MSI/PKG smoke matrices, x86-64 and ARM64 WinGet/Homebrew metadata, checksum/SBOM/provenance generation, and protected production signing gates. No production release has been published from this repository yet. [Unreleased]: https://github.com/bulengerk/siorb/commits/main ``` ### Cargo.toml ``` [workspace] resolver = "2" members = [ "crates/siorb-core", "crates/siorb-platform", "crates/siorb-catalog", "crates/siorb-policy", "crates/siorb-resolver", "crates/siorb-planner", "crates/siorb-backends", "crates/siorb-executor", "crates/siorb-state", "crates/siorb-bundle", "crates/siorb-update", "crates/siorb-cli", "crates/siorb-xtask", ] [workspace.package] version = "0.1.0" edition = "2024" rust-version = "1.85" license = "Apache-2.0" repository = "https://github.com/bulengerk/siorb" authors = ["Siorb contributors"] publish = false [workspace.dependencies] base64 = "0.22.1" clap = { version = "4.5.40", features = ["derive", "env", "string"] } clap_complete = "4.5" ed25519-dalek = { version = "2.2.0", features = ["serde", "rand_core"] } flate2 = "1.1.2" hex = "0.4.3" libc = "0.2.174" proptest = "1.7.0" rand = "0.8.5" regex = "1.11.1" reqwest = { version = "=0.12.22", default-features = false, features = ["blocking", "rustls-tls"] } semver = { version = "1.0.26", features = ["serde"] } serde = { version = "1.0.219", features = ["derive"] } serde_json = "1.0.140" sha2 = "0.10.9" tar = "0.4.44" tempfile = "3.20.0" thiserror = "2.0.12" toml = "0.8.23" unicode-normalization = "0.1.24" url = { version = "2.5.4", features = ["serde"] } walkdir = "2.5.0" zip = { version = "4.0.0", default-features = false, features = ["deflate"] } [workspace.lints.rust] unsafe_code = "forbid" missing_debug_implementations = "warn" [workspace.lints.clippy] all = { level = "warn", priority = -1 } pedantic = { level = "warn", priority = -1 } # Public failure modes use stable typed reason codes and are documented in the # command/security references; repeating an Errors section on every thin API # wrapper obscures those contracts. missing_errors_doc = "allow" struct_excessive_bools = "allow" too_many_lines = "allow" unwrap_used = "deny" expect_used = "deny" panic = "deny" [profile.release] codegen-units = 1 lto = "thin" strip = "symbols" ``` ### tests/requirements.txt ``` jsonschema==4.23.0 ``` ### fuzz/Cargo.toml ``` [package] name = "siorb-fuzz" version = "0.0.0" publish = false edition = "2024" rust-version = "1.85" [package.metadata] cargo-fuzz = true [dependencies] libfuzzer-sys = "0.4" serde_json = "1.0" siorb-backends = { path = "../crates/siorb-backends" } siorb-bundle = { path = "../crates/siorb-bundle" } siorb-catalog = { path = "../crates/siorb-catalog" } siorb-core = { path = "../crates/siorb-core" } siorb-executor = { path = "../crates/siorb-executor" } siorb-platform = { path = "../crates/siorb-platform" } siorb-policy = { path = "../crates/siorb-policy" } [workspace] members = ["."] [[bin]] name = "catalog_json" path = "fuzz_targets/catalog_json.rs" test = false doc = false [[bin]] name = "os_release" path = "fuzz_targets/os_release.rs" test = false doc = false [[bin]] name = "command_spec" path = "fuzz_targets/command_spec.rs" test = false doc = false [[bin]] name = "terminal_output" path = "fuzz_targets/terminal_output.rs" test = false doc = false [[bin]] name = "url_policy" path = "fuzz_targets/url_policy.rs" test = false doc = false [[bin]] name = "bundle_toml" path = "fuzz_targets/bundle_toml.rs" test = false doc = false [[bin]] name = "archive_zip" path = "fuzz_targets/archive_zip.rs" test = false doc = false [[bin]] name = "archive_tar" path = "fuzz_targets/archive_tar.rs" test = false doc = false [[bin]] name = "archive_path" path = "fuzz_targets/archive_path.rs" test = false doc = false [[bin]] name = "backend_query" path = "fuzz_targets/backend_query.rs" test = false doc = false ``` ### tests/Cargo.toml ``` [package] name = "siorb-contract-tests" version = "0.0.0" publish = false edition = "2024" rust-version = "1.85" [dependencies] clap = { version = "4.5", features = ["derive"] } serde = { version = "1.0", features = ["derive"] } serde_json = "1.0" sha2 = "0.10" siorb-backends = { path = "../crates/siorb-backends" } siorb-bundle = { path = "../crates/siorb-bundle" } siorb-catalog = { path = "../crates/siorb-catalog" } siorb-cli = { path = "../crates/siorb-cli" } siorb-core = { path = "../crates/siorb-core" } siorb-executor = { path = "../crates/siorb-executor" } siorb-platform = { path = "../crates/siorb-platform" } siorb-planner = { path = "../crates/siorb-planner" } siorb-policy = { path = "../crates/siorb-policy" } siorb-resolver = { path = "../crates/siorb-resolver" } siorb-state = { path = "../crates/siorb-state" } siorb-update = { path = "../crates/siorb-update" } tar = "0.4" tempfile = "3.20" zip = { version = "4.0", default-features = false, features = ["deflate"] } [workspace] members = ["."] [[bin]] name = "siorb-test-driver" path = "src/bin/siorb-test-driver.rs" [[test]] name = "backend_contract" path = "integration/backend_contract.rs" [[test]] name = "backend_output_security" path = "integration/backend_output_security.rs" [[test]] name = "json_contract" path = "integration/json_contract.rs" [[test]] name = "platform_fixtures" path = "integration/platform_fixtures.rs" [[test]] name = "state_contract" path = "integration/state_contract.rs" [[test]] name = "security_regressions" path = "security/security_regressions.rs" [[test]] name = "update_security" path = "security/update_security.rs" [[test]] name = "archive_security" path = "security/archive_security.rs" [[test]] name = "e2e_scenarios" path = "end-to-end/scenario_contract.rs" ``` ### crates/siorb-platform/Cargo.toml ``` [package] name = "siorb-platform" version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true repository.workspace = true publish.workspace = true [dependencies] serde.workspace = true siorb-core = { path = "../siorb-core" } [dev-dependencies] tempfile.workspace = true [lints] workspace = true ``` ### crates/siorb-core/Cargo.toml ``` [package] name = "siorb-core" version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true repository.workspace = true publish.workspace = true [dependencies] hex.workspace = true serde.workspace = true serde_json.workspace = true sha2.workspace = true thiserror.workspace = true [dev-dependencies] proptest.workspace = true [lints] workspace = true ``` ### crates/siorb-backends/Cargo.toml ``` [package] name = "siorb-backends" version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true repository.workspace = true publish.workspace = true [dependencies] serde.workspace = true siorb-catalog = { path = "../siorb-catalog" } siorb-core = { path = "../siorb-core" } siorb-resolver = { path = "../siorb-resolver" } [dev-dependencies] proptest.workspace = true [lints] workspace = true ``` ### crates/siorb-policy/Cargo.toml ``` [package] name = "siorb-policy" version.workspace = true edition.workspace = true rust-version.workspace = true license.workspace = true repository.workspace = true publish.workspace = true [dependencies] semver.workspace = true serde.workspace = true siorb-catalog = { path = "../siorb-catalog" } siorb-core = { path = "../siorb-core" } toml.workspace = true url.workspace = true [dev-dependencies] tempfile.workspace = true [lints] workspace = true ``` [280 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]