enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
40 lines
1.3 KiB
Rust
40 lines
1.3 KiB
Rust
//! `punktfunk-client` — the native Linux punktfunk/1 desktop shell (relm4/libadwaita).
|
|
//!
|
|
//! Hosts, pairing/trust, settings, and the desktop library page; every stream (and the
|
|
//! console game library) runs in the spawned `punktfunk-session` Vulkan binary — the
|
|
//! shell never touches video (punktfunk-planning `linux-client-rearchitecture.md`).
|
|
#![forbid(unsafe_code)]
|
|
|
|
// The UI-agnostic plumbing lives in `pf-client-core`, shared with the session binary.
|
|
// Root re-exports keep every `crate::trust`-style path resolving unchanged.
|
|
#[cfg(target_os = "linux")]
|
|
pub use pf_client_core::{discovery, gamepad, library, trust, video, wol};
|
|
|
|
#[cfg(target_os = "linux")]
|
|
mod app;
|
|
#[cfg(target_os = "linux")]
|
|
mod cli;
|
|
#[cfg(target_os = "linux")]
|
|
mod spawn;
|
|
#[cfg(target_os = "linux")]
|
|
mod ui_hosts;
|
|
#[cfg(target_os = "linux")]
|
|
mod ui_library;
|
|
#[cfg(target_os = "linux")]
|
|
mod ui_settings;
|
|
#[cfg(target_os = "linux")]
|
|
mod ui_trust;
|
|
|
|
#[cfg(target_os = "linux")]
|
|
fn main() -> gtk::glib::ExitCode {
|
|
app::run()
|
|
}
|
|
|
|
/// GTK4/SDL3 are Linux turf; this stub keeps `cargo build --workspace` green on macOS
|
|
/// (the Mac client lives in clients/apple).
|
|
#[cfg(not(target_os = "linux"))]
|
|
fn main() {
|
|
eprintln!("punktfunk-client is Linux-only — the macOS client lives in clients/apple");
|
|
std::process::exit(2);
|
|
}
|