Cargo.toml

[workspace]
resolver = "2"
# The DIG auto-update beacon workspace. The beacon is a TRANSIENT, scheduled process
# that wakes daily, performs ONE verified update pass, and exits — there is no resident
# socket. It is split into a privileged broker and an unprivileged fetch/verify worker
# so a compromise of the network-facing verify path cannot escalate to install/replace
# privilege. See SPEC.md for the normative trust contract.
#
#   * dig-updater-trust   — the SECURITY CORE (crate `dig_updater_trust`): the signed
#                           manifest + root->targets delegation types, the monotonic
#                           trust state (anti-rollback / anti-freeze / anti-downgrade),
#                           the Ed25519 signature + SHA-256 digest verify surface, and
#                           the pinned root public key. Pure, no I/O — trivially testable.
#   * dig-updater-broker  — the PRIVILEGED orchestration crate: drives one update pass, spawns
#                           the worker, applies verified installs, health-gates and rolls back
#                           (#504-E), holds the single-instance lock, owns the per-OS scheduler
#                           artifact + beacon self-update (#504-F), and persists the Admin-writable
#                           channel/pause config + the unprivileged status mirror (#504-G, SPEC §13).
#   * dig-updater-worker  — the UNPRIVILEGED, sandboxed fetch/verify crate: downloads the feed +
#                           artifacts and verifies them against the trust core, holding no
#                           install privilege.
#   * dig-updater-cli     — the `dig-updater` binary, the operator interface (#504-G): `check
#                           [--now|--dry-run]`, `run` (a full pass), `channel get|set`,
#                           `pause [--until <ts>] / resume`, `schedule install|uninstall|status`,
#                           and `status --json` (unprivileged — SPEC §13).
#   * dig-updater-feedsign — the CI-ONLY feed signer (crate `dig_updater_feedsign` + binary
#                           `dig-updater-feedsign`): resolves the latest release per component,
#                           assembles the signed manifest + root->targets delegation, and emits
#                           byte-exact feed JSON. It signs with the SAME `signing_bytes` the trust
#                           core verifies against, so signer and verifier can never drift. It is
#                           NEVER packaged into a shipped beacon release (release.yml builds only
#                           `--bin dig-updater` + `--bin dig-updater-worker`); it lives in the
#                           workspace purely so CI builds, lints, tests, and coverage-gates it
#                           (#504-I). See SPEC.md §10.
members = [
    "crates/dig-updater-trust",
    "crates/dig-updater-broker",
    "crates/dig-updater-worker",
    "crates/dig-updater-cli",
    "crates/dig-updater-feedsign",
]

[workspace.package]
# The RELEASE version of the beacon. The nightly-release orchestrator + version-increment CI read
# this `[workspace.package].version` from the ROOT manifest (§3.6 / SPEC §14); the members inherit
# it via `version.workspace = true`, so a release fires off this single value.
version = "0.15.0"
edition = "2021"
license = "GPL-2.0-only"
repository = "https://github.com/DIG-Network/dig-updater"
authors = ["DIG Network"]

[workspace.dependencies]
ed25519-dalek = "2"
sha2 = "0.11"
serde = { version = "1", features = ["derive"] }
# `raw_value` lets the verifier capture a signed payload's EXACT received byte slice
# (`serde_json::value::RawValue`) instead of a re-serialization of the parsed struct — the
# forward-compatibility fix at the heart of #504-D (SPEC §5.4).
serde_json = { version = "1", features = ["raw_value"] }
base64 = "0.22"
hex = "0.4"
thiserror = "2"
# The worker's only network dependency: a small, blocking HTTP/HTTPS client (rustls). The
# beacon is a transient single-pass process, so blocking I/O is the right model and avoids an
# async runtime in the security-sensitive fetch path.
ureq = "2"
# OS privilege primitives for the privileged broker's sandboxed spawn (`sandbox.rs`) and — on
# Unix — the state-dir hardening + single-instance lock's directory creation (`lock.rs`); Windows'
# lock uses `fs4` instead of `libc` there (see below). These are the only `unsafe` surfaces in the
# workspace; every other crate keeps `#![forbid(unsafe_code)]`.
libc = "0.2"
# Test-only: a minimal blocking HTTP server so the fetch/verify pipeline is exercised over a
# real socket on every OS runner.
tiny_http = "0.12"
tempfile = "3"
# The Unix side of the #504-F single-instance lock (src/lock.rs): a safe `flock` wrapper, the
# SAME crate `dig-node-core` already uses for its cross-process cache lock — one proven mechanism,
# not a second hand-rolled `unsafe` one. Windows uses a native named mutex instead (see below).
fs4 = { version = "1.1.0", features = ["sync"] }

[workspace.dependencies.windows]
version = "0.58"
features = [
    "Win32_Foundation",
    "Win32_Security",
    # SDDL -> SECURITY_DESCRIPTOR conversion, used to DACL-restrict the #504-F single-instance
    # mutex to Administrators + Local System (src/lock.rs) the same way `secure.rs` icacls-DACLs
    # the state/staging/last-known-good directories.
    "Win32_Security_Authorization",
    "Win32_System_Threading",
    "Win32_System_Pipes",
    "Win32_Storage_FileSystem",
    "Win32_System_IO",
    "Win32_System_Console",
]
# `Win32_Foundation` (already above) also carries `LocalFree`/`HLOCAL`, used to release the
# SECURITY_DESCRIPTOR `ConvertStringSecurityDescriptorToSecurityDescriptorW` allocates for the
# single-instance mutex's DACL (src/lock.rs) — no extra feature needed for that.

# Release hardening (matches dig-node/digstore): keep integer-overflow checks ON in
# release. The beacon parses an untrusted signed feed and does length/offset arithmetic
# over downloaded bytes; silent wrapping in release could turn a length bug into a
# memory/logic hazard on the privileged install path.
[profile.release]
overflow-checks = true