enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
70 lines
4.4 KiB
TOML
70 lines
4.4 KiB
TOML
[package]
|
|
name = "punktfunk-client-android"
|
|
description = "punktfunk Android client — JNI bridge ('nativecore') over punktfunk-core (Rust-heavy client model)"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
authors.workspace = true
|
|
repository.workspace = true
|
|
|
|
[lib]
|
|
# `libpunktfunk_android.so` — loaded by Kotlin via `System.loadLibrary("punktfunk_android")`.
|
|
name = "punktfunk_android"
|
|
crate-type = ["cdylib"]
|
|
|
|
[dependencies]
|
|
# The whole protocol/transport/FEC/crypto + the embeddable NativeClient connector. `quic` pulls
|
|
# the punktfunk/1 control plane (now ring-only — no aws-lc, see punktfunk-core/Cargo.toml).
|
|
punktfunk-core = { path = "../../../crates/punktfunk-core", features = ["quic"] }
|
|
jni = "0.21"
|
|
log = "0.4"
|
|
# LAN host discovery: browse the host's `_punktfunk._udp` mDNS advert — the SAME crate + service the
|
|
# Linux/Windows clients use (`crates/pf-client-core/src/discovery.rs`), replacing Android's per-OEM
|
|
# `NsdManager` system daemon with one tested browse path. Pure Rust (socket2/if-addrs/mio), so it
|
|
# cross-compiles to the Android targets AND builds on the host (the JNI seam links into
|
|
# `cargo build --workspace`). Kotlin keeps only the Wi-Fi `MulticastLock` + permission UX.
|
|
mdns-sd = "0.20"
|
|
|
|
# Android-only deps. Gated so `cargo build --workspace` on the Linux/macOS dev boxes + CI still
|
|
# compiles this crate (as a host cdylib) — the Android-framework glue (logging, AMediaCodec + AAudio
|
|
# via `ndk`, the Opus codec) is only pulled in for the real `*-linux-android` targets.
|
|
[target.'cfg(target_os = "android")'.dependencies]
|
|
android_logger = "0.14"
|
|
# Feature bridge, no code here: punktfunk-core logs through `tracing`, but this client only
|
|
# installs `android_logger` (a `log` backend). Core transport warnings (e.g. "UDP socket buffer
|
|
# capped well below target") reach logcat only via tracing's "log" feature, which forwards events
|
|
# as `log` records when no tracing subscriber is set (always, here). Today that feature happens to
|
|
# be enabled transitively — quinn's default `log` feature unifies `tracing/log` onto the whole
|
|
# graph — but nothing about this client's logging should hinge on a QUIC crate's default feature
|
|
# set, so declare it explicitly.
|
|
tracing = { version = "0.1", default-features = false, features = ["std", "log"] }
|
|
# NDK bindings. "media" = AMediaCodec/ANativeWindow (video); "audio" = AAudio (audio playback).
|
|
# Pure-Rust FFI to libmediandk/libnativewindow/libaaudio — no C++/libc++_shared to bundle. Decode +
|
|
# audio run entirely in Rust on native threads (the "no async on the hot path" invariant).
|
|
# api-level-28 matches the app's minSdk floor (Android 9). AAudio (26), AMediaCodec (21) and
|
|
# ANativeWindow_setBuffersDataSpace (28) are all ≤28; every call above the floor —
|
|
# ANativeWindow_setFrameRate (30), …WithChangeStrategy (31), AMediaCodec_setOnFrameRenderedCallback
|
|
# (33), the ADPF hints — is dlsym-resolved at runtime (decode::try_set_frame_rate,
|
|
# decode::install_render_callback, adpf), never linked, so the .so still loads on API 28+.
|
|
ndk = { version = "0.9", features = ["media", "audio", "nativewindow", "api-level-28"] }
|
|
# Raw FFI *types* for the one AMediaCodec entry point the `ndk` wrapper lacks:
|
|
# `AMediaCodec_setOnFrameRenderedCallback` — the per-frame render-timestamp callback behind the
|
|
# HUD's `display` stage (see decode::DisplayTracker). The symbol is API 33 ("Available since
|
|
# Android T"), ABOVE the minSdk-28 floor, so it is dlsym-resolved at runtime
|
|
# (decode::install_render_callback), NEVER hard-linked: 0.9.0 hard-linked it and
|
|
# `System.loadLibrary` failed on every pre-Android-13 device. Only ndk-sys's pointer/typedef
|
|
# types are referenced, which creates no import. Reaching it needs the codec's raw pointer, which
|
|
# is why the workspace pins `ndk` to the vendored copy whose only patch makes `MediaCodec::as_ptr`
|
|
# public (vendor/ndk, wired in the root Cargo.toml).
|
|
ndk-sys = { version = "0.6", features = ["media"] }
|
|
# setpriority/gettid to raise the decode thread toward URGENT_DISPLAY (see decode::boost_thread_priority).
|
|
libc = "0.2"
|
|
# Opus decode for the host→client audio plane (0xC9: 48 kHz stereo, 5 ms frames). Same crate the
|
|
# host + Linux client use. audiopus_sys vendors libopus (pure C) and builds it static via cmake —
|
|
# the cargo-ndk build sets LIBOPUS_STATIC=1/LIBOPUS_NO_PKG=1 so it links the bundled lib, not the host's.
|
|
opus = "0.3"
|
|
|
|
[lints]
|
|
workspace = true
|