Cargo.toml

[package]
name = "rustchan"
version = "1.7.1"
edition = "2021"
# Rust 1.99 is the supported minimum for the package and build tooling.
rust-version.workspace = true
license = "MIT"
description = "Self-contained imageboard — single binary, zero runtime dependencies"
repository = "https://github.com/csd113/RustChan"
keywords = ["imageboard", "forum", "rust"]
categories = ["web-programming", "multimedia::images"]

# Keep `cargo-msrv` metadata aligned with `rust-version`.
[package.metadata]
msrv = "1.99"

[workspace]
resolver = "2"
exclude = ["vendor/symphonia-codec-aac"]

[workspace.package]
rust-version = "1.99"

[profile.release]
opt-level      = 3
lto            = "thin"
codegen-units  = 1
strip          = true
panic          = "abort"

# Native startup verifies complete executable copies even in source/debug builds.
# Keep the hashing backend fast without changing application debug checks or the
# bounded lifecycle/test deadlines. The test profile inherits this override.
[profile.dev.package."sha2:0.11.0"]
opt-level = 3

[[bin]]
name = "rustchan-cli"
path = "src/main.rs"

[lib]
name  = "chan"
path  = "src/lib.rs"

[dependencies]
axum       = { version = "0.8.9",  features = ["multipart"] }
axum-extra = { version = "0.12.6", features = ["cookie"] }
tower      = "0.5.3"
tower-http = { version = "0.7.1", features = ["fs", "set-header", "compression-full", "limit", "trace"] }
tokio      = { version = "1.53.2", features = ["full"] }
tokio-util = "0.7.19"
captcha    = { version = "1.0.0", default-features = false }

# Arti 0.47 permits rusqlite >=0.36,<0.41. Keep the latest application and
# Tor directory-cache SQLite dependencies on the same bundled library.
rusqlite    = { version = "0.40.2", features = ["bundled", "backup", "hooks", "blob"] }
r2d2        = "0.8.10"
r2d2_sqlite = "0.35.0"
time        = "0.3.55"

serde      = { version = "1.0.229", features = ["derive"] }
serde_json = "1.0.151"
# toml 1.0: serde parsing is built-in, no feature flag needed.
toml  = "1.1.6"

argon2  = "0.6.0"
sha2    = "0.11.0"
# Signed update verification reuses the TLS provider and existing compression/semver crates.
ring = "0.17.14"
semver = "1.0.28"
flate2 = "1.1.10"
tar = { version = "0.4.46", default-features = false }
reqwest = { version = "0.13.5", default-features = false, features = ["rustls-no-provider", "blocking"] }

subtle  = "2.6.1"
hex    = "0.4.3"
# Token and password-salt generation read OS entropy through getrandom::SysRng.
rand_core = "0.10.1"
getrandom = { version = "0.4.3", features = ["sys_rng"] }

image = { version = "0.25.10", default-features = false, features = ["jpeg", "png", "gif", "webp", "bmp", "tiff", "ico"] }
# Already used by image; inspect GIF repeat/disposal metadata without retaining frames.
gif = { version = "0.14.2", default-features = false, features = ["std", "color_quant"] }
# Container inspection only for video; no video decoders are enabled.
symphonia = { version = "0.6.1", default-features = false, features = ["aac", "adpcm", "alac", "flac", "mp1", "mp2", "mp3", "pcm", "vorbis", "isomp4", "mkv", "ogg", "wav", "exp-video-codecs"] }
# Symphonia supplies Opus packets; this decoder avoids native libopus.
opus-pure = "0.2.2"
# HEVC intra still pictures only; no native library or video framework.
heic-rs = { version = "0.1.1", default-features = false, features = ["std"] }

# Pure-Rust first-page PDF previews, with embedded standard fonts.
hayro = { version = "0.7.1", default-features = false, features = ["embed-fonts"] }

# Apply JPEG Orientation tags before thumbnailing so phone photos display upright.
kamadak-exif = "0.6.1"

clap = { version = "4.6.7", features = ["derive"] }

uuid      = { version = "1.27.0", features = ["v4", "serde"] }
chrono    = { version = "0.4.45", features = ["serde"] }
dashmap      = "6.2.1"
parking_lot  = "0.12.5"
anyhow       = "1.0.104"
regex     = "1.13.1"
ipnet     = "2.12.2"

# Backup preflight scans use `file_names()` without decompressing entries.
zip = { version = "8.6.0", default-features = false, features = ["deflate-flate2-zlib-rs"] }

# URL validation for admin-supplied external banner links.
url = "2.5.8"

# Keep a direct lower bound on the RUSTSEC-2026-0049 CRL
# distribution-point fix. The crate is consumed transitively through rustls;
# this declaration intentionally constrains future lockfile regeneration.
rustls-webpki = { version = "0.103.15", default-features = false }

tracing            = "0.1.44"
tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt", "json"] }
tracing-appender   = "0.2.5"

thiserror = "2.0.21"
tempfile  = "3.27.0"

# Tor / onion-service stack
# Use rustls throughout; native-tls links OpenSSL and breaks the supported
# aarch64-unknown-linux-gnu cross-compilation path.
#
# `default-features = false` is required on every Arti crate.
# Cargo features are purely additive — without it, `arti-client`'s default
# feature set enables `native-tls` IN ADDITION TO `rustls`, pulling in
# openssl-sys even though rustls is also listed. The `rustls` feature alone
# does not prevent the native-tls default from activating.
#
# Verification:
#   cargo tree --edges features | grep -iE "openssl|native.tls"   # expect nothing
#   cargo tree -i openssl-sys                                       # expect error: not found
# Arti 0.47.0 requires Rust 1.92. Congestion control is unconditional;
# the former flowctl-cc feature has been removed upstream.
arti-client = { version = "0.47.0", default-features = false, features = ["tokio", "rustls", "onion-service-service"] }

# tor-hsservice / tor-cell: also part of the arti workspace.  Their `full`
# default feature bundle can activate the native-tls TLS backend through
# tor-rtcompat.  Disable defaults; add back only what the build requires.
# If compilation fails with "feature X not found", re-add that feature here.
tor-hsservice = { version = "0.47.0", default-features = false }
tor-cell      = { version = "0.47.0", default-features = false }

futures       = "0.3.34"
sha3          = "0.12.0"
data-encoding = "2.11.1"

# TLS
# rustls-pki-types provides the certificate and key types used by src/tls/mod.rs.
rustls-pki-types = "1.15.1"
# RustChan installs rustls's ring provider explicitly at startup. Keep every
# TLS consumer on that provider instead of also compiling the unused aws-lc-rs
# defaults; logging, TLS 1.2, and the system-independent root set stay enabled.
tokio-rustls   = { version = "0.26.6", default-features = false, features = ["logging", "ring", "tls12"] }
rustls         = { version = "0.23.45", default-features = false, features = ["logging", "ring", "std", "tls12"] }

# Optional — gated by Cargo features
rustls-acme    = { version = "0.15.4", default-features = false, features = ["ring", "tls12", "tokio", "webpki-roots"], optional = true }
rcgen          = { version = "0.14.10", optional = true }
pem-rfc7468    = { version = "1.0.0", optional = true, features = ["std"] }
x509-cert      = { version = "0.3.0", optional = true }

# HTTPS listen integration for Axum (handles Static cert path)
axum-server    = { version = "0.8.0", features = ["tls-rustls-no-provider"] }
hyper          = { version = "1.11.1", features = ["http1", "http2", "server"], optional = true }
hyper-util     = { version = "0.1.21", features = ["tokio", "server"] }

# Terminal UI
# crossterm provides cross-platform cursor, event, and raw-mode control.
crossterm = "0.29.0"
# Ratatui provides Unicode-aware, diff-rendered layout primitives while keeping
# Crossterm as the sole terminal backend.
ratatui = { version = "0.30.2", default-features = false, features = ["crossterm"] }

[target.'cfg(unix)'.dependencies]
# Safe in-process filesystem-capacity queries for upload disk-space preflights.
rustix = { version = "1.1.5", features = ["fs", "process", "thread", "net", "stdio"] }


[features]
default         = ["tls-self-signed"]
tls-self-signed = ["dep:rcgen", "dep:pem-rfc7468", "dep:x509-cert"]
tls-acme        = ["dep:hyper", "dep:rustls-acme"]

[lints]
workspace = true

[workspace.lints.rust]
warnings = { level = "deny", priority = -3 }
future_incompatible = { level = "deny", priority = -2 }
rust_2018_idioms = { level = "deny", priority = -2 }
rust_2024_compatibility = { level = "deny", priority = -2 }
nonstandard_style = { level = "deny", priority = -2 }
let_underscore = { level = "deny", priority = -2 }
unused = { level = "deny", priority = -2 }

unsafe_code = "forbid"
unsafe_op_in_unsafe_fn = "deny"
raw_borrows_via_references = "deny"
missing_docs = "deny"
missing_debug_implementations = "deny"
non_ascii_idents = "deny"
unreachable_pub = "deny"
unused_crate_dependencies = "deny"
unused_results = "deny"
macro_use_extern_crate = "deny"
redundant_imports = "deny"
redundant_lifetimes = "deny"
single_use_lifetimes = "deny"
trivial_casts = "deny"
trivial_numeric_casts = "deny"
unit_bindings = "deny"
unused_import_braces = "deny"
unused_lifetimes = "deny"
unused_qualifications = "deny"
let_underscore_drop = "deny"

[workspace.lints.clippy]
all = { level = "deny", priority = -3 }
pedantic = { level = "deny", priority = -2 }
nursery = { level = "deny", priority = -2 }
cargo = { level = "deny", priority = -2 }

# Panic-driven control flow.
unwrap_used = "deny"
expect_used = "deny"
panic = "deny"
panic_in_result_fn = "deny"
todo = "deny"
unimplemented = "deny"
unreachable = "deny"
exit = "deny"

# Debugging output must not enter production code accidentally.
dbg_macro = "deny"
print_stdout = "deny"
print_stderr = "deny"

# Unsafe-code safeguards remain documented even though unsafe Rust is
# forbidden globally.
undocumented_unsafe_blocks = "deny"
multiple_unsafe_ops_per_block = "deny"
missing_safety_doc = "deny"
unnecessary_safety_comment = "deny"
unnecessary_safety_doc = "deny"
default_union_representation = "deny"

# Suppressions must be narrow, intentional, and documented.
allow_attributes = "deny"
allow_attributes_without_reason = "deny"

# Numeric conversions must be explicit and reviewed.
as_conversions = "deny"
arithmetic_side_effects = "deny"
cast_lossless = "deny"
cast_possible_truncation = "deny"
cast_possible_wrap = "deny"
cast_precision_loss = "deny"
cast_ptr_alignment = "deny"
cast_sign_loss = "deny"
char_lit_as_u8 = "deny"
fn_to_numeric_cast_any = "deny"
lossy_float_literal = "deny"
default_numeric_fallback = "deny"
suspicious_xor_used_as_pow = "deny"
precedence_bits = "deny"

# Avoid unchecked indexing and UTF-8 string slicing.
indexing_slicing = "deny"
string_slice = "deny"

# Ignored values and error mappings must preserve their meaning.
let_underscore_must_use = "deny"
let_underscore_untyped = "deny"
map_err_ignore = "deny"

# Ownership and resource-management restrictions.
clone_on_ref_ptr = "deny"
mem_forget = "deny"
rc_buffer = "deny"
rc_mutex = "deny"
string_add = "deny"
str_to_string = "deny"

# Documentation, testing, and maintainability.
missing_docs_in_private_items = "deny"
missing_assert_message = "deny"
large_include_file = "deny"
verbose_file_reads = "deny"
wildcard_dependencies = "deny"
mixed_read_write_in_expression = "deny"
shadow_unrelated = "deny"
wildcard_enum_match_arm = "deny"
partial_pub_fields = "deny"
redundant_type_annotations = "deny"
rest_pattern_accessible_field = "deny"
unnecessary_rest_pattern = "deny"
doc_include_without_cfg = "deny"
doc_paragraphs_missing_punctuation = "deny"
tests_outside_test_module = "deny"
host_endian_bytes = "deny"

# Reject detected in-band SBR instead of publishing AAC-LC-only HE-AAC audio.
[patch.crates-io]
symphonia-codec-aac = { path = "vendor/symphonia-codec-aac" }