Cargo.toml

# SPDX-License-Identifier: GPL-3.0-or-later

[workspace]
resolver = "3"
members = [
    "crates/vault-core",
    "crates/vault-api",
    "crates/vault-store",
    "crates/vault-agent",
    "crates/vault-ipc",
    "crates/vault-cli",
    "crates/vault-tui",
    "crates/vault-theme",
    "crates/vault-config",
]
# The cargo-fuzz harness is a standalone workspace (nightly + sanitizer only);
# keep it out of `cargo <cmd> --workspace` and the CI gates.
exclude = ["fuzz"]

[workspace.package]
version = "0.0.1"
# Internal application crates — distributed as the `vault` / `vault-agent`
# binaries, never published to crates.io as libraries. Keeps cargo-deny's
# wildcard check happy with intra-workspace `path` deps (allow-wildcard-paths).
publish = false
edition = "2024"
rust-version = "1.95"
license = "GPL-3.0-or-later"
authors = ["Mohamed Hammad <Mohamed.Hammad@SpacecraftSoftware.org>"]
homepage = "https://Vault.SpacecraftSoftware.org/"
repository = "https://github.com/Spacecraft-Software/Vault"
readme = "README.md"

[workspace.lints.rust]
unsafe_code = "deny"
missing_debug_implementations = "warn"
rust_2024_compatibility = { level = "warn", priority = -1 }

[workspace.lints.clippy]
pedantic = { level = "warn", priority = -1 }
nursery = { level = "warn", priority = -1 }
unwrap_used = "warn"
expect_used = "warn"
panic = "warn"
todo = "warn"
dbg_macro = "warn"

[workspace.dependencies]
anyhow = "1"
thiserror = "2"
clap = { version = "4", features = ["derive", "wrap_help"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "0.8"
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "io-util", "signal", "sync", "time", "fs"] }
tokio-test = "0.4"
zeroize = { version = "1", features = ["zeroize_derive"] }

# Crypto — RustCrypto family (MIT/Apache-2.0; GPL-3.0-or-later compatible).
aes = "0.8"
cbc = { version = "0.1", features = ["alloc"] }
cipher = { version = "0.4", features = ["block-padding"] }
hmac = "0.12"
sha1 = "0.10"
sha2 = "0.10"
# RSA-2048-OAEP-SHA1 — unwraps organization keys (Bitwarden type-4 EncStrings).
# `ring` has no RSA decryption, so this is the one non-ring asymmetric path.
# Carries RUSTSEC-2023-0071 (Marvin timing sidechannel, no upstream fix); see the
# justified `cargo audit` ignore in `justfile` / CI. Not reachable as a network
# oracle here — org keys are unwrapped once, locally, at unlock.
rsa = "0.9"
pbkdf2 = { version = "0.12", default-features = false, features = ["hmac", "sha2"] }
argon2 = { version = "0.5", default-features = false, features = ["alloc"] }
hkdf = "0.12"
subtle = "2"
base64 = "0.22"
hex = "0.4"
rand = "0.8"
getrandom = "0.2"

# HTTP, IO, identifiers.
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "charset", "http2"] }
url = "2"
uuid = { version = "1", features = ["v4", "serde"] }
dirs = "5"
# Linux kernel keyring (pure Rust, no C lib — avoids the ring/-flto link
# breakage). MIT/Apache-2.0; GPL-3.0-or-later compatible. Linux-only, gated
# behind `cfg(target_os = "linux")` in vault-agent.
linux-keyutils = "0.2"
# fprintd over D-Bus for the off-by-default `fingerprint` unlock feature
# (vault-agent, Linux). Pure-Rust D-Bus; MIT; GPL-3.0-or-later compatible.
# `futures-util` drives the VerifyStatus signal stream. Both optional, pulled
# only by `--features fingerprint`.
zbus = { version = "5", default-features = false, features = ["tokio"] }
futures-util = { version = "0.3", default-features = false }
time = { version = "0.3", features = ["serde", "serde-well-known"] }
fs2 = "0.4"
# Terminal control — disable echo while reading secrets at an interactive
# prompt (master password, PIN, card number/CVV, identity SSN/passport/license).
# Pure-Rust syscalls, so the CLI keeps `forbid(unsafe_code)`; already in the tree
# transitively via `secmem-proc`. MIT / Apache-2.0; GPL-3.0-or-later compatible.
rustix = { version = "1", features = ["termios"] }

# TUI — ratatui + crossterm (MIT; GPL-3.0-or-later compatible). No cursive
# (license-tree hygiene per PRD §7.2).
ratatui = "0.29"
crossterm = "0.28"

# Clipboard — arboard (MIT/Apache-2.0; GPL-3.0-or-later compatible). Held by
# the agent for `vault` copy. `wayland-data-control` lets a copied secret
# persist after the writing process exits on wlroots compositors.
arboard = { version = "3.6", default-features = false, features = ["wayland-data-control"] }

tempfile = "3"
ciborium = "0.2"
ciborium-io = "0.2"

# Dev-only.
wiremock = "0.6"

[profile.release]
lto = "thin"
codegen-units = 1
strip = "symbols"
overflow-checks = true