hecks 2.9.0 → 3.0.1

data/rust/host/Cargo.toml

@@ -0,0 +1,61 @@
+[package]
+name = "rust_host"
+version = "0.1.0"
+edition = "2021"
+
+# Empty table: makes this crate its own workspace root instead of joining `rust`'s.
+[workspace]
+
+[[bin]]
+name = "bootstrap"
+path = "src/main.rs"
+
+# No path dependency on `rust`: the compiled `.wasm` is loaded through wasmtime as an untrusted
+# module, so dispatch runs sandboxed with no access to this crate's Postgres connection.
+[dependencies]
+wasmtime = "47.0.3"
+wasmtime-wasi = "47.0.3"
+lambda_runtime = "0.13"
+tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "sync"] }
+# Used by server.rs (HECKS_SERVE_MODE=1) to answer the ALB's HTTP on Fargate. HTTP/1.1 only;
+# the features are the minimal set its single fallback route needs.
+axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio"] }
+tokio-postgres = { version = "0.7", features = ["with-serde_json-1"] }
+# RDS requires TLS. rustls, not OpenSSL: -sys needs a cross-compiled sysroot for
+# aarch64-unknown-linux-gnu that is not set up when building from macOS.
+# Trust anchor is AWS's own RDS bundle (rds-ca-bundle.pem, embedded via include_bytes!), not
+# webpki-roots, which lacks the RDS CA.
+# default-features = false: rustls's default pulls in aws_lc_rs (C); "ring" keeps this pure Rust.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
+tokio-postgres-rustls = { version = "0.14", default-features = false, features = ["ring"] }
+rustls-pemfile = "2"
+# arbitrary_precision keeps a number as the text Ruby wrote (`1.0e+20`, integers past u64), which
+# approval.rs digests verbatim as Ruby's `JSON.generate` would.
+# preserve_order keeps JSON object key order, which approval.rs's `edge_digest` needs to match
+# `ApprovalDigest.edge_digest` (a translation edge's `renames` order is meaningful).
+serde_json = { version = "1", features = ["preserve_order", "arbitrary_precision"] }
+anyhow = "1"
+# Used by field_hints.rs; pure Rust, no aws-lc/openssl-sys.
+regex = "1"
+# Google sign-in (auth.rs). rustls-tls, not default-tls: no OpenSSL sysroot for the
+# aarch64 cross-compile. jsonwebtoken also uses ring.
+reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
+jsonwebtoken = "9"
+hmac = "0.12"
+sha2 = "0.10"
+uuid = { version = "1", features = ["v4"] }
+# Cross-lambda policy dispatch (lambda_client.rs). Both SDK crates take default-features = false:
+# their default TLS features resolve to aws-lc-rs, which needs a C toolchain to cross-compile.
+# aws-smithy-http-client with only `rustls-ring` supplies the client, which
+# `AwsLambdaInvoker::from_env` passes to `aws_config::ConfigLoader::http_client`.
+aws-config = { version = "1", default-features = false, features = ["rt-tokio", "behavior-version-latest", "credentials-process"] }
+aws-sdk-lambda = { version = "1", default-features = false, features = ["rt-tokio", "behavior-version-latest"] }
+# Secrets Manager (secrets.rs). Same default-features = false and rustls-ring treatment as
+# aws-sdk-lambda above, to avoid aws-lc-sys.
+aws-sdk-secretsmanager = { version = "1", default-features = false, features = ["rt-tokio", "behavior-version-latest"] }
+aws-smithy-http-client = { version = "1", default-features = false, features = ["rustls-ring"] }
+async-trait = "0.1.92"
+
+# CI never attaches a debugger to dev binaries, so skip debuginfo to save build time.
+[profile.dev]
+debug = 0

data/rust/host/HECKS_RELEASE

@@ -0,0 +1 @@
+3.0.1