enricobuehler
f373dffb5e
The safety half of the rust-safety programme's §8.4: `std::env::set_var`/`remove_var` are
`unsafe fn` in edition 2024, converting the class of bug the programme found the hard way
(the 972af299 environ data race lived in a file with ZERO occurrences of the word
`unsafe`) from invisible to counted and compiler-enforced.
Manifests: [workspace.package] edition 2021→2024, rust-version 1.82→1.85 (the pinned
toolchain is 1.96.0, so no toolchain bump — only the declared floor rises); the 13 crates
pinning `edition = "2021"` literally now inherit it (Trap 1: the root bump alone reaches
only `edition.workspace = true` crates and would have left pf-encode/pf-capture/pf-inject
et al. on 2021 while reading as complete); pf-driver-proto's stale rust-version 1.82 pin
now inherits; pf-vkhdr-layer (a separate workspace, inherits nothing) bumped to 2024. The
four vendored crates (fec-rs, cros-codecs, usbip-sim, the patched ndk) stay on 2021
deliberately — upstream code stays pristine. The excluded usbip-poc standalone PoC is
untouched.
Mechanical, done textually across ALL cfg branches so no platform's half is left behind
(Trap 3 — 44% of the host's unsafe is Windows-only and a one-platform `cargo fix` misses
it): 148 `#[no_mangle]` → `#[unsafe(no_mangle)]` (83 in abi.rs); 12 bare extern blocks →
`unsafe extern`; `gen` is a reserved keyword, so pf-vdisplay's generation stamps
(registry.rs, windows/manager.rs) and the WinUI shell's animation counters rename
gen → generation (internal identifiers only, no serde/wire surface); two
match-ergonomics patterns take the compiler's suggested reference form.
env mutation: every `set_var`/`remove_var` site (20 files) now sits in an `unsafe` block
whose SAFETY comment states the real serialization argument (pf-vdisplay's ENV_LOCK,
CONFIG_DIR_TEST_LOCK, ART_ROOTS_LOCK, vkdecode's gpu_lock, the `--test-threads=1`
contracts of the hardware spikes, or single-threaded startup). Two genuine hazards
surfaced en route — exactly the WP3b-class finds this migration exists to make visible —
and are fixed here:
- windows/service.rs spawned the network-profile warner thread BEFORE `load_host_env()`,
so a child-spawning thread (child spawn snapshots the env block) was live while
`set_var` ran in a loop; the load now precedes the spawn.
- pf-console-ui's `fake_home()` re-set HOME outside its OnceLock on EVERY call, so two
parallel tests could race the write; the set now happens exactly once inside
`get_or_init`.
cbindgen (Trap 2): 0.29.4 parses `#[unsafe(no_mangle)]` — verified empirically; the
header regenerates byte-identical. The ci.yml drift check could never catch "failed to
regenerate" (build.rs demotes a cbindgen failure to a warning and writes nothing, leaving
the checked-in header untouched and the diff clean), so the step now first asserts the
"punktfunk-core: wrote" line and the absence of "cbindgen failed" (sh -e safe: no `!`
pipeline, no tee-masked exit).
rustfmt: style_edition pinned to 2021 at the root — edition 2024 would otherwise flip the
style edition and reformat ~370 untouched files inside this same commit, burying the
migration diff. The drivers workspace pins its already-current 2024 style. Adopting the
2024 style tree-wide is its own future one-line-plus-reformat commit.
Census: the primary metric moves UP BY DESIGN — 2435 → 2453 operations, unsafe blocks
1534 → 1577, and env_set_var is now a counted category (45 ops). The newly counted env
sites are a truer number, not a regression; baseline snapshot saved as punktfunk-planning
design/rust-safety-census-baseline-2026-08-12-edition-2024.txt. Gate C's env ratchet is
now compiler-enforced (the hygiene-script header says so); the two shrunk file counts
(nvenc_cuda 49→2 via the test helpers, shell/tests 2→1) are lowered in the same commit
per the gate's own rule.
Drop order (the semantic change most likely to bite this codebase): the migration lint
`-W tail-expr-drop-order` reports zero findings on the macOS-visible halves of
pf-encode / pf-zerocopy / pf-capture / pf-frame; the Linux and Windows halves run the
same lint on the gate boxes. The four #[ignore]d alloc/drop-cycle tests on the hardware
boxes remain owed, as before this change.
110 lines
6.2 KiB
TOML
110 lines
6.2 KiB
TOML
[package]
|
|
name = "punktfunk-client-windows"
|
|
description = "Native Windows punktfunk/1 client — WinUI 3 (windows-reactor) shell, SDL3 gamepads; streaming runs in the spawned punktfunk-session binary"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
# Not workspace-inherited (1.85): windows-reactor at the pinned rev declares rust-version 1.95+
|
|
# and edition 2024. rust-toolchain.toml pins 1.96, so this records reality rather than raising it.
|
|
rust-version = "1.96"
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
|
|
[[bin]]
|
|
name = "punktfunk-client"
|
|
path = "src/main.rs"
|
|
|
|
# The couch/HTPC Start-menu entry. Its own executable because an MSIX <Application> cannot
|
|
# pass arguments to a full-trust exe — see the binary's own docs.
|
|
[[bin]]
|
|
name = "punktfunk-console"
|
|
path = "src/bin/punktfunk-console.rs"
|
|
|
|
# Everything is Windows-gated so `cargo build --workspace` stays green on Linux/macOS (the
|
|
# other native clients live in clients/linux and clients/apple); on other
|
|
# platforms this builds as a stub binary. Mirrors the Linux client's cfg(target_os="linux")
|
|
# gating exactly.
|
|
[target.'cfg(windows)'.dependencies]
|
|
# The protocol core, linked directly (no C ABI) — same as the GTK Linux client. NativeClient
|
|
# is Sync (mutexed plane receivers), so it drops into a UI app cleanly.
|
|
punktfunk-core = { path = "../../crates/punktfunk-core", features = ["quic"] }
|
|
# The shared client service layer: the trust/settings stores (ONE `Settings` struct for the
|
|
# shell and the spawned session binary — src/trust.rs re-exports it) and the game-library
|
|
# data model (fetch + art pipeline) behind the library page.
|
|
#
|
|
# `default-features = false` drops pf-client-core's default `pyrowave`, which would otherwise
|
|
# build the vendored PyroWave C++ INTO THE SHELL — dead weight here (the shell never decodes;
|
|
# it only offers "pyrowave" as a codec preference string the session binary acts on) and fatal
|
|
# on ARM64, where Granite's math falls back to x86 SSE intrinsics and stops at
|
|
# `simd.hpp: #error "Implement me."`. This does NOT drop PyroWave from the Windows client:
|
|
# decode lives in the spawned punktfunk-session binary, whose own default enables the feature,
|
|
# and cargo's feature unification turns it back on for the shared pf-client-core whenever that
|
|
# binary is in the same build (x64). On the ARM64 leg both are built --no-default-features, so
|
|
# nothing enables it and the C++ is never compiled.
|
|
pf-client-core = { path = "../../crates/pf-client-core", default-features = false }
|
|
|
|
# WinUI 3 UI via windows-reactor (a declarative React-like framework backed by WinUI).
|
|
# Unpublished (version 0.0.0) and fast-moving, so pinned to a verified commit. Pin bumped
|
|
# 2026-07-29 (from the 2026-07-01 rev) for: reconciler keyed-child-order fix (#4728), widget
|
|
# validation (#4727), DPI collision fix (#4751), icon elements (#4736), multi-window (#4730),
|
|
# scroll virtualization (#4710). All three windows-rs deps here MUST share this rev, and it
|
|
# must match pf-client-core's `windows` pin, so the workspace builds ONE windows-rs.
|
|
windows-reactor = { git = "https://github.com/microsoft/windows-rs", rev = "acb5a1a7441033d9312b16842af02eb0c2b403dc" }
|
|
# Win32 / DXGI for the GPU picker and the shell's window plumbing. Pulled from the SAME
|
|
# windows-rs commit as windows-reactor so their `windows-core` unifies — the `IDXGISwapChain1`
|
|
# we hand to `SwapChainPanelHandle::set_swap_chain` must satisfy reactor's `windows_core::Interface`.
|
|
# Features are header-named since the in-house-metadata rework (#4689) — one feature per SDK
|
|
# header, replacing the old `Win32_*` namespace features.
|
|
windows = { git = "https://github.com/microsoft/windows-rs", rev = "acb5a1a7441033d9312b16842af02eb0c2b403dc", features = [
|
|
# GetCurrentPackageFullName — the packaged-run probe guarding the explicit
|
|
# AppUserModelID (main.rs; MSIX identity must win over the dev-run tag).
|
|
"appmodel",
|
|
# CoCreateInstance/CoInitializeEx (+ objbase/objidl/wtypesbase below) for the
|
|
# "Create shortcut" writer (deeplink.rs).
|
|
"combaseapi",
|
|
# SetWindowSubclass/DefSubclassProc — the deep-link WM_COPYDATA subclass hook.
|
|
"commctrl",
|
|
"consoleapi",
|
|
"dxgi",
|
|
"errhandlingapi",
|
|
"libloaderapi",
|
|
"objbase",
|
|
"objidl",
|
|
# SetCurrentProcessExplicitAppUserModelID + ShellLink/IShellLinkW.
|
|
"shobjidl_core",
|
|
"synchapi",
|
|
"winerror",
|
|
# Windowing, messages, icons — and COPYDATASTRUCT, which lives in winuser now too.
|
|
"winuser",
|
|
] }
|
|
|
|
# Gamepad enumeration + pin persistence for Settings runs on pf-client-core's shared SDL service
|
|
# (see the `gamepad` field in app/); the spawned punktfunk-session does the actual forwarding. SDL3
|
|
# itself (built from source via the bundled CMake on Windows) is pulled transitively by
|
|
# pf-client-core with the same `build-from-source,hidapi` features, so it is not a direct dep here.
|
|
mdns-sd = "0.20"
|
|
async-channel = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# The reactor's own headless test harness, at the SAME pinned rev: the `test` feature gates
|
|
# `RenderCx::for_test`/`ChannelDispatcher`; `test_reactor` is the upstream repo's
|
|
# RecordingBackend crate (cargo resolves a git dep's workspace member by package name).
|
|
# These power tests/reactor_semantics.rs — the characterization suite for the re-render
|
|
# semantics this client's architecture depends on. Re-run it on every future SHA bump.
|
|
[target.'cfg(windows)'.dev-dependencies]
|
|
windows-reactor = { git = "https://github.com/microsoft/windows-rs", rev = "acb5a1a7441033d9312b16842af02eb0c2b403dc", features = ["test"] }
|
|
test_reactor = { git = "https://github.com/microsoft/windows-rs", rev = "acb5a1a7441033d9312b16842af02eb0c2b403dc" }
|
|
|
|
# Embeds the app icon as an exe resource (build.rs) — Windows hosts only (rc.exe from the SDK).
|
|
# windows-reactor-setup stages the Windows App SDK runtime bootstrap (framework-dependent) next
|
|
# to the exe — the new-model replacement for the old windows-reactor build.rs; same pinned rev.
|
|
[target.'cfg(windows)'.build-dependencies]
|
|
winresource = "0.1"
|
|
windows-reactor-setup = { git = "https://github.com/microsoft/windows-rs", rev = "acb5a1a7441033d9312b16842af02eb0c2b403dc" }
|
|
|
|
[lints]
|
|
workspace = true
|