enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
64 lines
2.8 KiB
TOML
64 lines
2.8 KiB
TOML
# Frame capture (plan §7 / §W6): the Linux xdg-ScreenCast/PipeWire portal capturer and the Windows
|
|
# IDD direct-push capturer, plus the synthetic sources + the Capturer trait, extracted into a
|
|
# subsystem crate. Depends on the shared frame vocabulary (pf-frame), the zero-copy plumbing
|
|
# (pf-zerocopy), and the display leaves (pf-win-display) — never on pf-encode: the encode-backend
|
|
# facts arrive pre-resolved (ZeroCopyPolicy) and the sealed-channel delivery as a closure
|
|
# (FrameChannelSender), so the capture→encode edge is one-way (plan §2.4).
|
|
[package]
|
|
name = "pf-capture"
|
|
version.workspace = true
|
|
edition = "2021"
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host frame capture: Linux PipeWire portal + Windows IDD direct-push capturers behind one Capturer trait."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
pf-frame = { path = "../pf-frame" }
|
|
pf-zerocopy = { path = "../pf-zerocopy" }
|
|
pf-win-display = { path = "../pf-win-display" }
|
|
pf-gpu = { path = "../pf-gpu" }
|
|
pf-host-config = { path = "../pf-host-config" }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# The xdg ScreenCast + RemoteDesktop portals, and the PipeWire consumer for the capture frames.
|
|
ashpd = { version = "0.13", features = ["screencast", "remote_desktop"] }
|
|
pipewire = "0.9"
|
|
libc = "0.2"
|
|
# ashpd 0.13 uses the tokio runtime for the one-time portal handshake (control plane).
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "net", "time"] }
|
|
# XFixes cursor source for gamescope (remote-desktop-sweep Phase C): gamescope paints no
|
|
# `SPA_META_Cursor`, so the pointer never reaches the PipeWire node. We read the shape/hotspot/
|
|
# visibility from gamescope's nested Xwayland via XFixes instead and feed the existing cursor slot.
|
|
# `RustConnection` is the pure-Rust default (no libxcb link → no new C dependency on the host); the
|
|
# `xfixes` feature (auto-pulls `render` + `shape`) is what exposes GetCursorImage/SelectCursorInput.
|
|
x11rb = { version = "0.13", default-features = false, features = ["xfixes"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# The host<->driver wire contract for the sealed frame channel (control IOCTL structs + frame header).
|
|
pf-driver-proto = { path = "../pf-driver-proto" }
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Security",
|
|
"Win32_Security_Authorization",
|
|
"Win32_Graphics_Direct3D",
|
|
"Win32_Graphics_Direct3D11",
|
|
"Win32_Graphics_Direct3D_Fxc",
|
|
"Win32_Graphics_Dxgi",
|
|
"Win32_Graphics_Dxgi_Common",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_StationsAndDesktops",
|
|
"Win32_System_Memory",
|
|
"Win32_System_Threading",
|
|
"Win32_UI_HiDpi",
|
|
"Win32_UI_Input_KeyboardAndMouse",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|