Cargo.toml

# dig-dns — the local `*.dig` resolver: a DNS responder + HTTP gateway that turns
# `http://<base32-storeId>.dig/<path>` into DIG store content fetched from a dig-node.
#
# A single package with BOTH a library (`dig_dns`, where all the logic lives so it is
# unit-testable) and the service binary (`dig-dns`, a thin CLI shell over the library).
#
# The RELEASE version is `[package].version` at the root manifest — the version-increment
# gate (.github/workflows/ensure-version-increment.yml) and the stable release workflow
# (.github/workflows/nightly-release.yml, a nightly cron + manual dispatch) read it from here,
# so it MUST live at the root and increase on every PR (CLAUDE.md §2.4 / §3.6).
[package]
name = "dig-dns"
version = "0.15.1"
edition = "2021"
description = "Local *.dig name resolution: a DNS responder + HTTP gateway resolving <storeId>.dig to DIG store content via a dig-node."
license = "GPL-2.0-only"
repository = "https://github.com/DIG-Network/dig-dns"
readme = "README.md"

# --- Native OS install packages (dig_ecosystem #503) ----------------------------------------
# The Ubuntu `.deb` is built by cargo-deb from this metadata + the systemd unit under
# packaging/linux, published as a GitHub release asset, and ingested + GPG-signed into the apt
# repo by apt.dig.net (#425). The control fields are kept apt-correct + stable (Package name is
# the crate name `dig-dns`; Architecture is derived from the build target; Depends is auto-computed
# from the binary's shared-library needs). The Windows `.msi` (wix/main.wxs) + macOS `.pkg`
# (packaging/macos) are built by the release workflow, not cargo — see .github/workflows/release.yml.
[package.metadata.deb]
maintainer = "DIG Network <dev@dig.net>"
section = "net"
priority = "optional"
# REQUIRED for cargo-deb to wire the systemd maintainer scripts: cargo-deb only emits the
# enable/start postinst (+ prerm/postrm) when `maintainer-scripts` is set, EVEN when
# `[package.metadata.deb.systemd-units]` is present. Without it, cargo-deb still installs the unit
# file but silently ships NO postinst, so the service is never enabled or started on install
# (dig_ecosystem #525 — the .deb installed but `systemctl is-enabled` reported "disabled"). The
# directory holds the unit file PLUS hand-written maintainer scripts (postinst/prerm/postrm, each
# carrying the `#DEBHELPER#` token cargo-deb substitutes with its systemd enable/start/stop/purge
# fragments) that additionally call `dig-dns configure-os` / `unconfigure-os` to wire OS-level
# *.dig resolution at install + reverse it on removal (dig_ecosystem #530).
maintainer-scripts = "packaging/linux"
extended-description = """
dig-dns is the local *.dig resolver: a DNS responder + HTTP gateway that resolves
<storeId>.dig hostnames to DIG Network store content fetched from a dig-node. It installs as an
auto-starting systemd service (net.dignetwork.dig-dns) bound to a loopback IP; it holds no secret
and never acts as an open proxy."""

# cargo-deb wires the systemd unit: it installs packaging/linux/net.dignetwork.dig-dns.service to
# /usr/lib/systemd/system and (given `maintainer-scripts` above) generates the maintainer scripts
# (daemon-reload + enable + start on install, stop on remove, unmask + purge on purge). The
# service needs CAP_NET_BIND_SERVICE for :53/:80 (granted in the unit) and a machine-wide state dir
# /var/lib/dig-dns (created via the unit's StateDirectory).
[package.metadata.deb.systemd-units]
unit-name = "net.dignetwork.dig-dns"
unit-scripts = "packaging/linux"
enable = true
start = true

[lib]
name = "dig_dns"
path = "src/lib.rs"

[[bin]]
name = "dig-dns"
path = "src/main.rs"

# `digd` — a FIRST-CLASS alias binary for `dig-dns` (dig_ecosystem #548), mirroring how
# `digs` is the first-class alias for `digstore` (digstore #434). It shares the SINGLE
# entrypoint `dig_dns::cli::run()` (see src/bin/digd.rs) so there is no duplicated logic:
# `digd <args>` behaves identically to `dig-dns <args>` — the SAME command surface, incl.
# every service verb (install/serve/run-service/…) — and each binary reflects its OWN
# invoked name in --help/--version (clap parses with the arg0 stem as the program name).
# `cargo install` / the release workflow produce BOTH `dig-dns` and `digd`.
[[bin]]
name = "digd"
path = "src/bin/digd.rs"

[dependencies]
# base32 (RFC 4648) for the DNS-label <-> 32-byte storeId codec, and hex for the
# storeId's canonical lowercase-hex form used in the dig-node RPC.
data-encoding = "2"
hex = "0.4"
# CLI + machine-readable (--json) output (CLAUDE.md §6.2 agent-friendly).
clap = { version = "4", features = ["derive"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
thiserror = "2"
# base64 for the dig-node wire (ciphertext + inclusion-proof are base64-encoded).
base64 = "0.22"
# The `.dig` read-crypto: Bytes32 / Urn / retrieval-key / MerkleProof / resource_leaf /
# derive_decryption_key / decrypt_chunk — reused verbatim so dig-dns is byte-identical to
# digstore + dig-client-wasm. Pinned to the SAME digstore rev dig-node consumes. Light,
# wasm-clean (no BLS/blst): sha2 + hkdf + aes-gcm-siv only.
digstore-core = { git = "https://github.com/DIG-Network/digstore.git", rev = "099f88aecc63d767b392a1f70162a55b35023203" }
# The DIG_NODE_PORT constant (single source of truth for the §5.3 client->node localhost port,
# 9778) shared with dig-node, dig-installer, dig-sdk and digstore so no consumer hardcodes it.
# Not yet on crates.io, so sourced from git; pinned to the v0.3.0 release commit.
dig-constants = { version = "0.3", git = "https://github.com/DIG-Network/dig-constants", rev = "438ac8caf9ffb80cadd10362deacd63763a7f141" }

# --- Phase 2b: the async HTTP gateway server + node transport ---
# Async runtime for the listener + the node client. Loopback-only, so no need for the
# broader net stack — just TCP, timers (ladder probe timeouts), signal (graceful shutdown).
tokio = { version = "1", features = [
    "rt-multi-thread",
    "net",
    "macros",
    "time",
    "signal",
    "io-util",
    # `sync` = the watch channel that fans one shutdown signal out to every serve subtask
    # (gateway + DNS + dig.local), so a Windows-service Stop tears the whole service down.
    "sync",
] }
# The HTTP/1.1 server for the gateway. Raw hyper (not axum) because the gateway must see
# absolute-form proxy URIs + the CONNECT method to enforce the "never an open proxy" rule
# (SPEC §4.1/§4.2) — routing frameworks assume origin-form requests.
hyper = { version = "1", features = ["server", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }
http-body-util = "0.1"
bytes = "1"
# The node transport is an async trait object (`Arc<dyn NodeClient>`); async-trait boxes the
# futures as Send so per-connection tasks spawn cleanly on the multi-thread runtime.
async-trait = "0.1"
# The dig-node JSON-RPC client. rustls + **ring** with bundled webpki roots, NO provider
# auto-selected (we install ring explicitly) — this keeps aws-lc-rs (needs a C toolchain +
# cross-compiles poorly to x86_64-apple-darwin) and OpenSSL out of the tree, so every
# release target builds without a cross C-toolchain (release.yml intent).
reqwest = { version = "0.12", default-features = false, features = [
    "json",
    "rustls-tls-webpki-roots-no-provider",
] }
rustls = { version = "0.23", default-features = false, features = [
    "ring",
    "std",
    "tls12",
    "logging",
] }
# Structured, loud logging (which port bound, the resolved node tier) for the OS service.
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
# OS-service registration across Windows (SCM), Linux (systemd) and macOS (launchd) — the SAME
# crate + version the sibling dig-node service uses, so it cross-compiles to every release
# target the way dig-node's already does. `dig-dns install` registers the service; the
# clean-reinstall (stop → delete → recreate) lives in `src/service.rs`.
service-manager = "0.7"
# Encrypted upstream DNS for dig-dns's OWN outbound lookups (dig_ecosystem #574) — the ONE
# public name it ever resolves is `rpc.dig.net` (SPEC §6.3's terminal ladder tier); this crate
# supplies the actual DoH/DoT protocol engine so `src/secure_dns.rs` never hand-rolls it.
# `tls-ring`/`https-ring` pick the same **ring** crypto backend as the `rustls` dependency above
# (no aws-lc-rs/C-toolchain requirement); `webpki-roots` gives hostname-verified TLS against the
# Mozilla root store — deliberately NOT leaf-cert pinning (a provider's leaf rotates; a pin would
# brick resolution on rotation). `system-config` is left OFF: dig-dns never reads the OS
# resolver's own configuration, only uses the OS resolver as the tier-4 availability net via
# plain `tokio::net::lookup_host`.
hickory-resolver = { version = "0.26.1", default-features = false, features = [
    "tokio",
    "tls-ring",
    "https-ring",
    "webpki-roots",
] }

# Windows Service Control Protocol. service-manager only REGISTERS the service in the SCM; the
# executable the SCM launches must itself speak the service protocol (StartServiceCtrlDispatcher)
# or the SCM kills it with error 1053. `src/win_service.rs` (the `run-service` entrypoint) is
# that dispatcher. Windows-only, so it never enters the non-Windows build/coverage.
[target.'cfg(unix)'.dependencies]
# `O_NOFOLLOW` for the symlink-safe atomic `/etc` policy writer (src/os_config.rs atomic_write,
# #650). Unix-only; the value differs per platform so the constant comes from libc, not a literal.
libc = "0.2"

[target.'cfg(windows)'.dependencies]
windows-service = "0.7"
# `GetSystemDirectoryW` for the trusted system-tool resolver (src/system_tool.rs, #657): the real
# System32 path from the syscall, immune to a poisoned %SystemRoot% — the anti-search-order-hijack
# base for every elevated bare-name spawn (sc/net/powershell/reg).
windows-sys = { version = "0.59", features = ["Win32_System_SystemInformation"] }

[dev-dependencies]
# `assert_cmd` + `predicates` drive the REAL built binaries (`dig-dns` AND the `digd` alias)
# end-to-end, proving the second `[[bin]]` target actually builds and behaves identically —
# the same harness digstore uses for its `digs` alias tests (#434).
assert_cmd = "2"
predicates = "3"
# The integration test spins a real stub dig-node (hyper) + drives the real gateway over
# loopback with reqwest, and builds .dig fixtures with the same read-crypto primitives.
tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "time"] }
reqwest = { version = "0.12", default-features = false, features = [
    "json",
    "rustls-tls-webpki-roots-no-provider",
] }
hyper = { version = "1", features = ["server", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }
http-body-util = "0.1"
bytes = "1"
base64 = "0.22"
serde_json = "1"
digstore-core = { git = "https://github.com/DIG-Network/digstore.git", rev = "099f88aecc63d767b392a1f70162a55b35023203" }

# Release hardening, matching digstore/dig-node: keep integer-overflow checks ON in
# release. The gateway does offset/length arithmetic over untrusted network input, so a
# silent wrap in release would turn a length bug into a memory/logic hazard.
[profile.release]
overflow-checks = true