enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
64 lines
2.9 KiB
TOML
64 lines
2.9 KiB
TOML
[package]
|
|
name = "punktfunk-tray"
|
|
description = "System-tray status icon for the punktfunk streaming host (Windows notification area / Linux StatusNotifierItem)"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
|
|
[[bin]]
|
|
name = "punktfunk-tray"
|
|
path = "src/main.rs"
|
|
|
|
# Deliberately does NOT depend on punktfunk-host: the tray needs only the service name, the mgmt
|
|
# port, and the summary JSON shape — a dependency would drag the whole host (FFmpeg, PipeWire, …)
|
|
# into a 2 MB helper and make it un-buildable standalone. Non-Windows/non-Linux targets build a
|
|
# stub main (same pattern as the platform-gated clients).
|
|
[dependencies]
|
|
anyhow = "1"
|
|
|
|
[target.'cfg(any(windows, target_os = "linux"))'.dependencies]
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
# Loopback HTTPS poll of GET /api/v1/local/summary. Same sync ureq + rustls(ring) stack and
|
|
# custom-verifier pattern as the Linux client's library fetch (crates/pf-client-core/src/library.rs) —
|
|
# but ring-only (no default aws-lc-rs provider: it needs a C toolchain per target and the agent
|
|
# pins the ring provider explicitly anyway).
|
|
ureq = { version = "2", default-features = false, features = ["tls"] }
|
|
rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
|
|
# The one shared cert-fingerprint pin verifier (`punktfunk_core::tls::PinVerify`) + fingerprint
|
|
# hash, instead of the tray hand-rolling its own copy on a trust boundary. The light `tls` feature
|
|
# is rustls + sha2 only (no QUIC runtime / tokio), so this stays a lean helper; core is a pure-Rust
|
|
# leaf (no C toolchain), unlike the host dependency ruled out above.
|
|
punktfunk-core = { path = "../punktfunk-core", default-features = false, features = ["tls"] }
|
|
|
|
[target.'cfg(windows)'.dependencies]
|
|
# SCM QUERY_STATUS works unprivileged — the service-state probe. Same crate the host service uses.
|
|
windows-service = "0.7"
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_Security", # CreateMutexW's SECURITY_ATTRIBUTES parameter type
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Threading",
|
|
"Win32_UI_Shell",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
] }
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# StatusNotifierItem (pure Rust, zbus — the same zbus the host already pulls via ashpd). The tray
|
|
# is a plain-threads poller, so the blocking API over the small async-io executor (`blocking`
|
|
# alone is just the wrapper — zbus still needs an executor; no tokio runtime in a tray icon).
|
|
ksni = { version = "0.3", default-features = false, features = ["async-io", "blocking"] }
|
|
libc = "0.2"
|
|
|
|
# Build-time icon embedding (exe icon + the status-variant tray icons), host-gated like the
|
|
# Windows client's build.rs — cross-builds from Linux CI runners skip it.
|
|
[target.'cfg(windows)'.build-dependencies]
|
|
winresource = "0.1"
|
|
|
|
[lints]
|
|
workspace = true
|