molluskandClaude Opus 4.8
465c7ba2b0
Supersede bare cargo-audit with an enforceable four-part policy, validated against the current tree with cargo-deny 0.19.9 (advisories/bans/licenses/ sources all pass): - advisories: deny vulnerabilities + yanked; ignore the two *unmaintained* warnings (paste RUSTSEC-2024-0436, audiopus_sys RUSTSEC-2026-0150) with rationale. Both are transitive and pinned via Cargo.lock, so a future malicious release can't reach us until a deliberate cargo update. - sources: trust only crates.io; deny unknown registries and git sources (core anti-hijack control). - bans: deny wildcard version reqs; warn on duplicate versions. - licenses: permissive allow-list covering the current graph. Mark peerspeak publish = false (it's an application, not a published library): blocks accidental cargo publish and lets [licenses.private] skip the missing-license check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
51 lines
1.5 KiB
TOML
51 lines
1.5 KiB
TOML
[package]
|
|
name = "peerspeak"
|
|
version = "0.2.0"
|
|
edition = "2024"
|
|
# Application crate, not a crates.io library — refuse `cargo publish` and let
|
|
# cargo-deny's [licenses.private] skip the missing-license check.
|
|
publish = false
|
|
|
|
[lib]
|
|
name = "peerspeak"
|
|
path = "src/lib.rs"
|
|
|
|
[[bin]]
|
|
name = "peerspeak"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "test_net"
|
|
path = "src/bin/test_net.rs"
|
|
|
|
[[bin]]
|
|
name = "specview"
|
|
path = "src/bin/specview.rs"
|
|
|
|
[dependencies]
|
|
anyhow = "1.0.102"
|
|
async-trait = "0.1.89"
|
|
base64 = "0.22.1"
|
|
bytes = "1.11.1"
|
|
dirs = "6.0.0"
|
|
iced = { version = "0.14.0", features = ["canvas", "image"] }
|
|
# W4 custom avatars: decode/resize an arbitrary user image (png/jpeg only to keep
|
|
# the codec surface small) and a native file picker (xdg-portal backend, no GTK).
|
|
image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
|
|
rfd = { version = "0.17", default-features = false, features = ["xdg-portal"] }
|
|
iroh = "1.0.0-rc.0"
|
|
iroh-gossip = "0.99.0"
|
|
opus = "0.3.1"
|
|
# v0_3_49 exposes `Buffer::requested()` (the graph's per-cycle quantum), used by
|
|
# the playback RT callback to fill exactly what the device asks for instead of
|
|
# pinning the buffer to a hard-coded 1024-frame quantum (crackle on non-1024
|
|
# hardware). The field has existed in libpipewire since 0.3.49 (2022).
|
|
pipewire = { version = "0.9", features = ["v0_3_49"] }
|
|
rand = "0.10.1"
|
|
ringbuf = "0.5.0"
|
|
serde = { version = "1.0.228", features = ["derive"] }
|
|
serde_json = "1.0.150"
|
|
thiserror = "2.0.18"
|
|
tokio = { version = "1.52.3", features = ["full"] }
|
|
tokio-stream = "0.1.18"
|