enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
101 lines
5.4 KiB
TOML
101 lines
5.4 KiB
TOML
[package]
|
|
name = "punktfunk-client-windows"
|
|
description = "Native Windows punktfunk/1 client — WinUI 3 (windows-reactor) shell, SDL3 gamepads; streaming runs in the spawned punktfunk-session binary"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
|
|
[[bin]]
|
|
name = "punktfunk-client"
|
|
path = "src/main.rs"
|
|
|
|
# The couch/HTPC Start-menu entry. Its own executable because an MSIX <Application> cannot
|
|
# pass arguments to a full-trust exe — see the binary's own docs.
|
|
[[bin]]
|
|
name = "punktfunk-console"
|
|
path = "src/bin/punktfunk-console.rs"
|
|
|
|
# Everything is Windows-gated so `cargo build --workspace` stays green on Linux/macOS (the
|
|
# other native clients live in clients/linux and clients/apple); on other
|
|
# platforms this builds as a stub binary. Mirrors the Linux client's cfg(target_os="linux")
|
|
# gating exactly.
|
|
[target.'cfg(windows)'.dependencies]
|
|
# The protocol core, linked directly (no C ABI) — same as the GTK Linux client. NativeClient
|
|
# is Sync (mutexed plane receivers), so it drops into a UI app cleanly.
|
|
punktfunk-core = { path = "../../crates/punktfunk-core", features = ["quic"] }
|
|
# The shared client service layer: the trust/settings stores (ONE `Settings` struct for the
|
|
# shell and the spawned session binary — src/trust.rs re-exports it) and the game-library
|
|
# data model (fetch + art pipeline) behind the library page.
|
|
#
|
|
# `default-features = false` drops pf-client-core's default `pyrowave`, which would otherwise
|
|
# build the vendored PyroWave C++ INTO THE SHELL — dead weight here (the shell never decodes;
|
|
# it only offers "pyrowave" as a codec preference string the session binary acts on) and fatal
|
|
# on ARM64, where Granite's math falls back to x86 SSE intrinsics and stops at
|
|
# `simd.hpp: #error "Implement me."`. This does NOT drop PyroWave from the Windows client:
|
|
# decode lives in the spawned punktfunk-session binary, whose own default enables the feature,
|
|
# and cargo's feature unification turns it back on for the shared pf-client-core whenever that
|
|
# binary is in the same build (x64). On the ARM64 leg both are built --no-default-features, so
|
|
# nothing enables it and the C++ is never compiled.
|
|
pf-client-core = { path = "../../crates/pf-client-core", default-features = false }
|
|
|
|
# WinUI 3 UI via windows-reactor (a declarative React-like framework backed by WinUI). Its
|
|
# `build.rs` downloads the Windows App SDK NuGets and stages the bootstrap DLL + resources.pri
|
|
# next to the exe; it requires `CARGO_WORKSPACE_DIR` to be set in the build env. Unpublished
|
|
# (version 0.0.0) and fast-moving, so pinned to a verified commit.
|
|
windows-reactor = { git = "https://github.com/microsoft/windows-rs", rev = "a4f7b2cb7c63c6bb7fc77a2affe57145be1d8c4f" }
|
|
# Win32 / Direct3D11 / DXGI for the SwapChainPanel composition swapchain. Pulled from the SAME
|
|
# windows-rs commit as windows-reactor so their `windows-core` unifies — the `IDXGISwapChain1`
|
|
# we hand to `SwapChainPanelHandle::set_swap_chain` must satisfy reactor's `windows_core::Interface`.
|
|
windows = { git = "https://github.com/microsoft/windows-rs", rev = "a4f7b2cb7c63c6bb7fc77a2affe57145be1d8c4f", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Graphics_Dxgi",
|
|
"Win32_Graphics_Dxgi_Common",
|
|
# GetCurrentPackageFullName — the packaged-run probe guarding the explicit
|
|
# AppUserModelID (main.rs; MSIX identity must win over the dev-run tag).
|
|
"Win32_Storage_Packaging_Appx",
|
|
"Win32_Graphics_Direct3D",
|
|
"Win32_Graphics_Direct3D11",
|
|
"Win32_Graphics_Direct3D_Fxc",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_System_Console",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Threading",
|
|
"Win32_UI_HiDpi",
|
|
"Win32_UI_Input_KeyboardAndMouse",
|
|
# Win32 window subclassing (SetWindowSubclass/DefSubclassProc) — the stream input hooks
|
|
# subclass the WinUI window + its content-island children to swallow WM_SETCURSOR so the
|
|
# local cursor stays hidden while the pointer is locked (WinUI otherwise re-asserts the arrow
|
|
# on every pointer move, defeating a one-shot ShowCursor(false)).
|
|
"Win32_UI_Shell",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
] }
|
|
|
|
# FFmpeg — used only to enumerate which codecs this client can decode (probe::decodable_codecs),
|
|
# advertised to the host on the speed-test connect. Same pin as the host/Linux client. (Real
|
|
# decode + present live in the spawned punktfunk-session binary.)
|
|
ffmpeg-next = "8"
|
|
|
|
# Gamepad enumeration + pin persistence for Settings runs on pf-client-core's shared SDL service
|
|
# (see the `gamepad` field in app/); the spawned punktfunk-session does the actual forwarding. SDL3
|
|
# itself (built from source via the bundled CMake on Windows) is pulled transitively by
|
|
# pf-client-core with the same `build-from-source,hidapi` features, so it is not a direct dep here.
|
|
mdns-sd = "0.20"
|
|
async-channel = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# Embeds the app icon as an exe resource (build.rs) — Windows hosts only (rc.exe from the SDK).
|
|
# windows-reactor-setup stages the Windows App SDK runtime bootstrap (framework-dependent) next
|
|
# to the exe — the new-model replacement for the old windows-reactor build.rs; same pinned rev.
|
|
[target.'cfg(windows)'.build-dependencies]
|
|
winresource = "0.1"
|
|
windows-reactor-setup = { git = "https://github.com/microsoft/windows-rs", rev = "a4f7b2cb7c63c6bb7fc77a2affe57145be1d8c4f" }
|
|
|
|
[lints]
|
|
workspace = true
|