enricobuehler
51a005dd43
Acting on the 2026-08-13 dependency sweep. Every claim below was re-verified against
the tree before acting on it (greps carry a positive control; the advisories were
re-checked with cargo audit 0.22.2).
SECURITY
- event-listener 5.4.1 -> 5.4.2 (RUSTSEC-2026-0221, unsound Send/Sync on StackSlot;
reaches the tray via zbus and the host via ashpd). This sat unnoticed because
`cargo audit` reports unsoundness as a WARNING and the job fails only on
vulnerabilities — audit.toml now says so out loud.
- spin 0.9.8 -> 0.9.9. 0.9.8 is YANKED and was genuinely compiled (flume via mdns-sd
and relm4, plus lazy_static).
- wayland-scanner 0.31.10 -> 0.31.11, which moves quick-xml 0.39 -> 0.41. That is the
exact trigger audit.toml documented for RUSTSEC-2026-0194/0195, so both ignores are
deleted rather than left as permanent exceptions. Only RUSTSEC-2023-0071 (rsa
Marvin, still unfixed upstream) remains.
- Corrected audit.toml's claim that `paste` arrives "via utoipa-axum": rav1d pulls it
too, so every client has it through the decode path and dropping utoipa-axum would
not have cleared it.
TWO CI GATES THAT SCANNED NOTHING
- `cargo audit` only ever reads the ROOT Cargo.lock. The drivers lock was already in
this job's `paths:` filter, so edits to it triggered a run that then ignored them.
All four secondary workspaces now get an explicit `--file` (verified: clean, bar the
known `paste` warning in drivers).
- packaging/windows/pf-vkhdr-layer had NO lockfile at all while shipping as a DLL in
the host installer, so every build resolved fresh and neither cargo-audit nor
cargo-about ever saw it. Lockfile generated and committed, and added to `paths:`.
UNUSED / DUPLICATE DECLARATIONS
- punktfunk-host: removed 13 dependencies it never references — the Wayland stack
(client, protocols{,-wlr,-misc}, scanner, backend), xkbcommon, reis, khronos-egl,
ash, usbip-sim, parking_lot, bytemuck. The code moved to pf-inject and pf-zerocopy
in the subsystem extraction and those crates declare them; only the manifest entries
and their now-false comments stayed. Also dropped four redundant re-declarations
(tokio/serde_json/futures-util in the Linux block, tower in dev-deps).
- Removed genuinely unused: bytes (punktfunk-core), anyhow (pf-win-display),
tracing (clients/cli), anyhow (clients/session), serde (clients/windows).
- Removed the high-level `wdk` crate from all five driver crates and the drivers
workspace: none of them ever referenced `wdk::` (62 `wdk_sys::` uses; pf-umdf-util
is a full WDF crate that never declared it). `tracing`/`tracing-subscriber` remain
in that lock afterwards but ONLY as wdk-sys build-dependencies, not in the DLLs.
- pf-win-display took punktfunk-core with `quic` for one type (`Mode`) that lives in
the ungated `config` module; now `default-features = false`, which keeps
quinn/tokio/rcgen/opus out of a leaf crate's declared closure.
- pf-encode declared the windows-rs feature `Wdk_Graphics_Direct3D` for a call that
lives in pf-frame and is resolved via GetProcAddress on gdi32.
LATENT BREAKAGE (compiled only by feature unification)
- pf-inject uses `tokio::select!` without declaring `macros` (borrowed from
punktfunk-core's quic feature); pf-capture uses `tokio::sync::oneshot` without
declaring `sync` (borrowed from ashpd->zbus); pf-client-core uses the `minwindef`
and `winnt` windows-rs headers without declaring them (borrowed from
clients/windows). Each now declares what it uses, so an unrelated crate changing its
features cannot break them.
- pf-console-ui took pf-client-core WITHOUT `default-features = false`, unlike every
other consumer. That default is `pyrowave`, which compiles the vendored PyroWave C++
— "fatal on Windows ARM64". Only safe today because the ARM64 leg passes
--no-default-features (which also drops `ui`).
CORRECTED A FALSE INVARIANT
- clients/windows claimed "the workspace builds ONE windows-rs". It does not: wasapi
pulls the crates.io windows 0.62.2 beside the git-rev copy. The invariant that DOES
hold is narrower (reactor and that crate share one rev, which is what makes the
IDXGISwapChain1 hand-off type-check). Comment rewritten, with a warning against
"fixing" it via a blanket [patch.crates-io] — this rev uses header-named features
while a dozen other manifests use the old Win32_* namespace ones.
Plus the safe in-compat `cargo update` sweep (no manifest edits).
Verified on macOS: punktfunk-core 385, pf-update-check 32, c_abi 1 (with
LIBRARY_PATH=/opt/homebrew/opt/opus/lib), cargo audit clean bar the two known
unmaintained warnings. Linux and Windows legs follow.
65 lines
3.0 KiB
TOML
65 lines
3.0 KiB
TOML
# Unified in-tree workspace for punktfunk's all-Rust UMDF drivers, on microsoft/windows-drivers-rs
|
|
# (crates.io wdk/wdk-sys/wdk-build — NOT the dev-box ../../crates/wdk* path-deps). Part of the
|
|
# Windows-host rewrite (design/windows-host-rewrite.md, M1). pf-vdisplay + the gamepad drivers move here.
|
|
#
|
|
# Separate from the main cargo workspace (own [workspace] root) because driver crates are cdylibs built
|
|
# with the WDK toolchain (cargo-wdk / wdk-build) on Windows only. Path-deps the shared ABI crate
|
|
# crates/pf-driver-proto from the main tree.
|
|
[workspace]
|
|
resolver = "2"
|
|
members = ["wdk-probe", "wdk-iddcx", "pf-umdf-util", "pf-vdisplay", "pf-gamepad", "pf-xusb", "pf-mouse"]
|
|
|
|
[workspace.package]
|
|
edition = "2024"
|
|
version = "0.0.1"
|
|
license = "MIT OR Apache-2.0"
|
|
publish = false
|
|
|
|
# The same unsafe discipline as the main workspace (see its Cargo.toml for the full rationale).
|
|
# Restated here because THIS IS A SEPARATE WORKSPACE: the main tree's [workspace.lints] does not
|
|
# reach these crates, so any "workspace-wide" lint claim has to be made here too or it is false
|
|
# for the driver surface. Every member opts in with `[lints] workspace = true`.
|
|
# (`unsafe_op_in_unsafe_fn` is already the edition-2024 default; deny pins it explicitly.)
|
|
[workspace.lints.rust]
|
|
unsafe_op_in_unsafe_fn = "deny"
|
|
|
|
[workspace.lints.clippy]
|
|
undocumented_unsafe_blocks = "deny"
|
|
|
|
[workspace.dependencies]
|
|
# NOTE: the high-level `wdk` crate (0.4.1) used to be declared here and taken by five driver
|
|
# crates. None of them ever referenced `wdk::` — every driver goes through `wdk_sys`, including
|
|
# the WDF call macro, which wdk-sys re-exports (see pf-umdf-util, a full WDF crate that never
|
|
# declared `wdk` either). Removing it drops a normal (linked) dependency from all five.
|
|
# `tracing`/`tracing-subscriber` are still in the lock afterwards, but only as wdk-sys BUILD
|
|
# dependencies — build-script machinery, not code in the shipped DLLs.
|
|
wdk-sys = "0.5.1"
|
|
wdk-build = "0.5.1"
|
|
wdk-iddcx = { path = "wdk-iddcx" }
|
|
pf-umdf-util = { path = "pf-umdf-util" }
|
|
pf-driver-proto = { path = "../../../crates/pf-driver-proto" }
|
|
|
|
# Vendored windows-drivers-rs 0.5.1 (the published, self-contained crates) + an added `iddcx`
|
|
# ApiSubset (M1 — bindgens iddcx/1.10/IddCx.h reusing wdk_default for WDF type-identity). Redirect ALL
|
|
# wdk-sys/wdk-build refs to the patched copies so there is exactly one (iddcx-capable) wdk-sys in the
|
|
# graph. Pinned; do not chase upstream.
|
|
[patch.crates-io]
|
|
wdk-build = { path = "vendor/wdk-build" }
|
|
wdk-sys = { path = "vendor/wdk-sys" }
|
|
|
|
# wdk-sys's build script reads the WDK driver-model from the WORKSPACE metadata (a workspace build can't
|
|
# know which member it's building for). All our drivers are UMDF 2.x (incl. pf-vdisplay's IddCx), so set
|
|
# it once here; a member needing a different model would get its own [package.metadata.wdk.driver-model].
|
|
[workspace.metadata.wdk.driver-model]
|
|
driver-type = "UMDF"
|
|
umdf-version-major = 2
|
|
target-umdf-version-minor = 31
|
|
|
|
[profile.dev]
|
|
panic = "abort"
|
|
lto = true
|
|
|
|
[profile.release]
|
|
panic = "abort"
|
|
lto = true
|