Cargo.toml

[package]
name = "systemd-hardening-helper"
authors = ["Maxime Desbrus <maxime.desbrus@synacktiv.com>"]
description = "Automatic systemd service hardening guided by strace profiling"
readme = "README.md"
repository = "https://github.com/desbma/shh"
keywords = ["systemd", "hardening", "strace", "system", "security"]
categories = ["command-line-utilities"]
license = "GPL-3.0-only"
version = "2026.3.8"
rust-version = "1.88"
edition = "2024"
exclude = ["test-env/target"]

[[bin]]
name = "shh"
path = "src/main.rs"

[profile.release]
lto = true
codegen-units = 1
strip = true

[build-dependencies]
const-gen = { version = "1.6.9", default-features = false, features = ["std", "phf"] }

[dependencies]
anyhow = { version = "1.0.103", default-features = false, features = ["std", "backtrace"] }
postcard = { version = "1.1.3", default-features = false, features = ["use-std"] }
chrono = { version = "0.4.45", default-features = false, features = ["clock", "std"] }
clap = { version = "4.6.1", default-features = false, features = ["std", "color", "help", "usage", "error-context", "suggestions", "derive"] }
clap_complete = { version = "4.6.7", default-features = false, optional = true }
clap_mangen = { version = "0.3.0", default-features = false, optional = true }
function_name = { version = "0.3.0", default-features = false }
goblin = { version = "0.10.7", default-features = false, features = ["std", "elf32", "elf64", "endian_fd"] }
itertools = { version = "0.15.0", default-features = false, features = ["use_std"] }
log = { version = "0.4.33", default-features = false, features = ["max_level_trace", "release_max_level_debug"] }
nix = { version = "0.31.3", default-features = false, features = ["fs", "user", "process", "signal"] }
nom = { version = "8.0.0", default-features = false, features = ["std"] }
path-clean = { version = "1.0.1", default-features = false }
phf = { version = "0.14.0", default-features = false, features = ["std", "macros"] }
rand = { version = "0.10.2", default-features = false, features = ["std", "thread_rng"] }
regex = { version = "1.12.4", default-features = false, features = ["std", "perf"] }
serde = { version = "1.0.228", default-features = false, features = ["std", "derive"] }
shlex = { version = "2.0.1", default-features = false, features = ["std"] }
signal-hook = { version = "0.4.4", default-features = false, features = ["iterator"] }
simple_logger = { version = "5.2.0", default-features = false, features = ["colors", "stderr"] }
strum = { version = "0.28.0", default-features = false, features = ["std", "derive"] }
tempfile = { version = "3.27.0", default-features = false }
thiserror = { version = "2.0.18", default-features = false, features = ["std"] }
ecow = { version = "0.3.0", default-features = false, features = ["serde", "std"] }
systemd-duration = { version = "0.3.1", default-features = false }

[dev-dependencies]
assert_cmd = { version = "2.2.2", default-features = false, features = ["color", "color-auto"] }
compact_str = { version = "0.9.1", default-features = false }
fastrand = { version = "2.4.1", default-features = false, features = ["std"] }
insta = { version = "1.48.0", default-features = false, features = ["colors", "ron"] }
nix = { version = "0.31.3", default-features = false, features = ["user"] }
predicates = { version = "3.1.4", default-features = false, features = ["color", "regex"] }
pretty_assertions = { version = "1.4.1", default-features = false, features = ["std"] }
smol_str = { version = "0.3.2", default-features = false }
ron = { version = "0.12.2", default-features = false, features = ["std"] }
ureq = { version = "3.3.0", default-features = false }

[features]
default = []
generate-extras = ["dep:clap_complete", "dep:clap_mangen"]
test-env-vm = [] # for integration tests only
nightly = [] # for benchmarks only

[lints.rust]
# https://doc.rust-lang.org/rustc/lints/listing/allowed-by-default.html
explicit_outlives_requirements = "warn"
missing_docs = "warn"
non_ascii_idents = "deny"
redundant-lifetimes = "warn"
single-use-lifetimes = "warn"
unit-bindings = "warn"
unreachable_pub = "warn"
# unused_crate_dependencies = "warn"
unused-lifetimes = "warn"
unused-qualifications = "warn"

[lints.clippy]
pedantic = { level = "warn", priority = -1 }
similar_names = "allow"
unnecessary_debug_formatting = "allow"
# below lints are from clippy::restriction
# https://rust-lang.github.io/rust-clippy/master/index.html#/?levels=allow&groups=restriction
allow_attributes = "warn"
as_pointer_underscore = "warn"
cfg_not_test = "warn"
clone_on_ref_ptr = "warn"
cognitive_complexity = "warn"
dbg_macro = "warn"
empty_enum_variants_with_brackets = "warn"
expect_used = "warn"
field_scoped_visibility_modifiers = "warn"
fn_to_numeric_cast_any = "warn"
if_then_some_else_none = "warn"
impl_trait_in_params = "warn"
implicit_clone = "warn"
indexing_slicing = "warn"
infinite_loop = "warn"
lossy_float_literal = "warn"
map_with_unused_argument_over_ranges = "warn"
# missing_docs_in_private_items = "warn"
mixed_read_write_in_expression = "warn"
module_name_repetitions = "warn"
# multiple_inherent_impl = "warn"
mutex_integer = "warn"
needless_raw_strings = "warn"
non_zero_suggestions = "warn"
panic = "warn"
pathbuf_init_then_push = "warn"
precedence_bits = "warn"
pub_without_shorthand = "warn"
redundant_test_prefix = "warn"
redundant_type_annotations = "warn"
ref_patterns = "warn"
renamed_function_params = "warn"
rest_pat_in_fully_bound_structs = "warn"
return_and_then = "warn"
same_name_method = "warn"
self_named_module_files = "warn"
semicolon_inside_block = "warn"
shadow_unrelated = "warn"
str_to_string = "warn"
string_lit_chars_any = "warn"
string_slice = "warn"
tests_outside_test_module = "warn"
todo = "warn"
try_err = "warn"
undocumented_unsafe_blocks = "warn"
unnecessary_safety_comment = "warn"
unnecessary_safety_doc = "warn"
unneeded_field_pattern = "warn"
unseparated_literal_suffix = "warn"
unused_result_ok = "warn"
unused_trait_names = "warn"
unwrap_used = "warn"
verbose_file_reads = "warn"

[package.metadata.deb]
name = "shh"
depends = "$auto, strace"
assets = [
  ["target/release/shh", "usr/bin/", "755"],
  ["target/man/*.1.gz", "usr/share/man/man1/", "644"],
  ["target/shellcompletions/*.bash", "/usr/share/bash-completion/completions/", "644"],
  ["target/shellcompletions/*.fish", "/usr/share/fish/vendor_completions.d/", "644"],
  ["target/shellcompletions/_shh", "/usr/share/zsh/vendor-completions/", "644"]
]