Merge branch 'main' into Frando/improve-holepunching

Author: flub

.github/workflows/ci.yml

@@ -373,37 +373,25 @@ jobs:
       # Pin to the nightly that the pinned `cargo-check-external-types`
       # release was last tested against. Update both together.
       CARGO_CHECK_EXTERNAL_TYPES_VERSION: "0.4.0"
-      CARGO_CHECK_EXTERNAL_TYPES_NIGHTLY: "nightly-2025-10-18"
+      TOOLCHAIN: "nightly-2025-10-18"
     steps:
       - uses: actions/checkout@v6
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: ${{ env.CARGO_CHECK_EXTERNAL_TYPES_NIGHTLY }}
+          toolchain: ${{ env.TOOLCHAIN }}
       - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.9
 
       - name: Install cargo-binstall
         uses: cargo-bins/cargo-binstall@v1.18.1
 
+      - uses: taiki-e/install-action@cargo-make
+
       - name: Install cargo-check-external-types
-        # Match the version of wasm-bindgen used in Cargo.lock
         run: cargo binstall cargo-check-external-types@${{ env.CARGO_CHECK_EXTERNAL_TYPES_VERSION }} --locked --no-confirm
 
       - name: Check external types
-        run: |
-          set -e
-          fail=0
-          for crate in iroh-base iroh-dns iroh-relay iroh iroh-dns-server; do
-            echo "::group::$crate"
-            if ! cargo "+${CARGO_CHECK_EXTERNAL_TYPES_NIGHTLY}" check-external-types \
-                --manifest-path "$crate/Cargo.toml" \
-                --config external-types.toml \
-                --all-features; then
-              fail=1
-            fi
-            echo "::endgroup::"
-          done
-          exit $fail
+        run: cargo make check-external-types
 
   check_fmt:
     timeout-minutes: 30

.github/workflows/release.yml

@@ -198,7 +198,12 @@ jobs:
               # Native build on self-hosted linux runners; use musl-gcc from musl-tools.
               export CARGO_TARGET_$(echo ${{ matrix.cargo_targets }} | tr 'a-z-' 'A-Z_')_LINKER=musl-gcc
               export CC=musl-gcc
-              export RUSTFLAGS="${RUSTFLAGS:-} -C target-feature=+crt-static -C link-arg=-static"
+              # `relocation-model=static` is required so rustc selects the
+              # non-PIE musl crt1.o (not rcrt1.o) to match the ET_EXEC binary
+              # produced by `musl-gcc -static`. Without it the PIE startup
+              # code (rcrt1.o) ends up linked into a non-PIE binary and the
+              # process segfaults in `_start_c` before reaching `main`.
+              export RUSTFLAGS="${RUSTFLAGS:-} -C target-feature=+crt-static -C relocation-model=static -C link-arg=-static"
             fi
             cargo build --profile optimized-release --all-features --target ${{ matrix.cargo_targets }}
 

Cargo.lock

@@ -43,6 +43,6 @@ unexpected_cfgs = { level = "warn", check-cfg = ["cfg(iroh_docsrs)", "cfg(iroh_l
 unused-async = "warn"
 
 [patch.crates-io]
-noq = { git = "https://github.com/n0-computer/noq", branch = "Frando/feat-discover-off-path-probes" }
-noq-proto = { git = "https://github.com/n0-computer/noq", branch = "Frando/feat-discover-off-path-probes" }
-noq-udp = { git = "https://github.com/n0-computer/noq", branch = "Frando/feat-discover-off-path-probes" }
+noq = { git = "https://github.com/n0-computer/noq", branch = "flub/probe-peer-hard-nat" }
+noq-proto = { git = "https://github.com/n0-computer/noq", branch = "flub/probe-peer-hard-nat" }
+noq-udp = { git = "https://github.com/n0-computer/noq", branch = "flub/probe-peer-hard-nat" }

Cargo.toml

@@ -1,5 +1,14 @@
 # Use cargo-make to run tasks here: https://crates.io/crates/cargo-make
 
+[env]
+# Make per-member iterations inherit this Makefile so workspace tasks can be
+# defined here without needing a per-crate Makefile.toml.
+CARGO_MAKE_EXTEND_WORKSPACE_MAKEFILE = true
+# Workspace members to exclude when setting `workspace = true` for a task.
+# Must live at global env (not task-level) so it's read before workspace iteration
+# is generated. Only the `check-external-types` task uses this.
+CARGO_MAKE_WORKSPACE_SKIP_MEMBERS = ["iroh/bench"]
+
 [tasks.format]
 workspace = false
 command = "cargo"
@@ -31,3 +40,12 @@ args = [
 workspace = false
 command = "cargo"
 args = ["nextest", "run", "-p", "iroh", "--features", "qlog", "--test", "patchbay", "--profile", "patchbay", "${@}"]
+
+[tasks.check-external-types]
+description = "Run cargo check-external-types on workspace crates"
+workspace = true
+# cargo check-external-types needs a specific nightly toolchain,
+# see https://github.com/awslabs/cargo-check-external-types#how-to-use
+toolchain = "${TOOLCHAIN:nightly-2025-10-18}"
+command = "cargo"
+args = ["check-external-types", "--all-features"]

Makefile.toml

@@ -68,3 +68,10 @@ relay = [
 [package.metadata.docs.rs]
 all-features = true
 rustdoc-args = ["--cfg", "iroh_docsrs"]
+
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "n0_error::*",
+    "serde_core::*",
+    "url::*",
+]

external-types.toml

@@ -93,3 +93,10 @@ vergen-gitcl = "9.1"
 
 [package.metadata.docs.rs]
 all-features = true
+
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "iroh_metrics::*",
+    "n0_error::*",
+    "serde_core::*",
+]

iroh-base/Cargo.toml

@@ -45,3 +45,13 @@ tls-aws-lc-rs = ["rustls/aws-lc-rs", "hickory-resolver/https-aws-lc-rs"]
 [dev-dependencies]
 n0-tracing-test = "0.3"
 tokio = { version = "1", features = ["macros", "rt"] }
+
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "iroh_base::*",
+    "n0_error::*",
+    "rustls::*",
+    "url::*",
+    # only type alias
+    "futures_lite::future::Boxed",
+]

iroh-dns-server/Cargo.toml

@@ -182,3 +182,29 @@ required-features = ["server"]
 [package.metadata.docs.rs]
 all-features = true
 rustdoc-args = ["--cfg", "iroh_docsrs"]
+
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    # workspace crates
+    "iroh_base::*",
+    "iroh_dns::*",
+    # crates owned by us that will move to 1.0 as well
+    "iroh_metrics::*",
+    "n0_error::*",
+    "noq::*",
+    "noq_proto::*",
+    # 1.0 crates that we deem fine to be part of the public API
+    "bytes::*",
+    "http::*",
+    "http_body::*",
+    "hyper::*",
+    "rustls_pki_types::*",
+    "serde_core::*",
+    "tokio::*",
+    "url::*",
+    # non-1.0 crates that we decided to accept in the public API
+    "rustls::*",
+    "tokio_rustls::*",
+    "futures_core::stream::Stream",
+    "futures_sink::Sink",
+]