enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
58 lines
2.8 KiB
TOML
58 lines
2.8 KiB
TOML
# Shared clipboard (plan §W6 shape, design/clipboard-and-file-transfer.md §4): the host-side
|
|
# session-clipboard backends — `ext-data-control-v1` (KWin/wlroots/Sway/Hyprland) and Mutter's
|
|
# *direct* `org.gnome.Mutter.RemoteDesktop.Session` clipboard on Linux, the Win32 clipboard
|
|
# (delayed rendering) on Windows — behind one `HostClipboard`, plus the backend-agnostic session
|
|
# coordinator bridging it to the QUIC clipboard plane. The wire protocol and the client half live
|
|
# in `punktfunk-core`; the orchestrator consumes only the portable facade (policy / `ClipCoordCmd` /
|
|
# `start`), so it stays free of platform cfg.
|
|
[package]
|
|
name = "pf-clipboard"
|
|
version.workspace = true
|
|
edition = "2021"
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host shared clipboard: per-OS session-clipboard backends behind one HostClipboard + the QUIC clipboard-plane coordinator."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
quinn = "0.11"
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "sync", "time", "macros"] }
|
|
# CF_DIB <-> PNG conversion (winfmt) - most Windows apps paste bitmaps, not the "PNG" format.
|
|
# Unconditional (not windows-gated) so winfmt's pure-conversion unit tests run on every host.
|
|
image = { version = "0.25", default-features = false, features = ["png", "bmp", "jpeg", "gif"] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# Mutter's direct RemoteDesktop clipboard is raw D-Bus via `ashpd::zbus` — NOT the xdg
|
|
# `org.freedesktop.portal.Clipboard`, which needs an interactive grant a headless host can't
|
|
# answer. Reusing ashpd's zbus re-export keeps one zbus version across the workspace.
|
|
ashpd = "0.13"
|
|
futures-util = "0.3"
|
|
# Raw fd plumbing on the paste pipes: `pipe2(O_CLOEXEC)` + `poll` on the data-control receive
|
|
# side, `fcntl` un-nonblocking on Mutter's transfer fd.
|
|
libc = "0.2"
|
|
wayland-client = "0.31"
|
|
# `staging`: `ext_data_control_v1` (the session-clipboard protocol) ships in the staging set.
|
|
wayland-protocols = { version = "0.32", features = ["client", "staging"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# The Win32 clipboard on a hidden message-loop window: `WM_CLIPBOARDUPDATE` listener + OLE
|
|
# delayed rendering (`WM_RENDERFORMAT`) for text / CF_HTML / RTF / PNG.
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
# WNDCLASSW/RegisterClassW reference HBRUSH/HICON/HCURSOR, so windows-rs only generates
|
|
# them with the Gdi feature on. The host build got it via workspace feature-unification;
|
|
# a standalone `cargo check -p pf-clipboard` didn't (E0432) — declare it honestly.
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_System_DataExchange",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Memory",
|
|
"Win32_System_Ole",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|