The audit of the lock against Debian's archive (qa.debian.org
madison, sid/trixie/bookworm) showed 255 of 291 crates packaged, the
36 missing ones all Windows/wasm/apple/redox-only. Making the tree
build against the Debian-packaged crates — the difference between a
vendored source package and a thin debcargo one — needed:
- sha1/sha2/md-5 bumped to the digest 0.11 line (sid moved, 0.10 is
trixie-only): finalize() now returns hybrid-array Output without
LowerHex (hex::encode it) and no io::Write impl (sha256_file reads
chunks into update()). The digest outputs are unchanged; the full
suite including the checksums tests passes.
- crossterm 0.28 -> 0.29: Debian skipped 0.28 entirely.
- reqwest 0.12 -> 0.13: the blocking/json/stream usages carried over
unchanged.
- suppaftp behind an opt-out 'ftp' feature: the one dependency absent
from the archive, used only by the plain-FTP upload fallback of
'pkh put' — the Debian build drops it and the SFTP failure path
reports the transport as unavailable instead.
- every patch-level requirement pin relaxed to the minor level
(4.5.51 -> 4.5, 1.0.228 -> 1.0, ...) — semver-compatible, and what
lets trixie's slightly older crates satisfy the manifest.
Result: 30 of 32 direct dependencies resolve from sid as-is; the
remaining two are indicatif 0.18 (sitting in experimental, migrating)
and the feature-gated suppaftp. No vendoring on sid.
The release-candidate version lands in 'pkh --version' and in the
build records' manifests, so an RC-tested tree is distinguishable
from the final release.
The runtime (multi-thread, for Runtime::new + block_on and task
spawning), time (retries, timeouts), sync (channels) and macros
(#[tokio::test]) cover every tokio:: path in the tree; 'full' also
pulled fs, io, net and process support nothing uses. Cargo.lock loses
the corresponding mio/signal deps if nothing else needs them.
Decode-only pure-Rust bzip2, matching flate2's pure-Rust default: no
new system packages for building pkh, and the archive-side origin of
the need is the busybox class of '.tar.bz2' upstream tarballs.
suppaftp 12 is the FTP client behind the put FTP fallback transport:
the maintained continuation of rust-ftp (4.2M downloads, releases this
month), used with its default features only — a plain blocking FTP
stream, no TLS, no async. It brings just lazy-regex into the tree;
chrono is shared.
parking_lot replaces std sync mutex unwrapping in test code, per the
project rule.
A binary crate should pin its dependency graph: without the lockfile
in git, source and snap builds float transitive versions, so a
0.1.0 artifact rebuilt later would not be the same binary.
vhaudiquet