rob thijssen
bb39e76326
First consumer of the client side: buh_api::peer::probe_peer opens a PQ-mTLS connection (presenting this node's leaf, pinning the peer's CA from the trust registry), fetches /v1/health, and reports the peer's advertised CA fingerprint. A probe succeeds only when BOTH nodes trust each other's CA, so it is a true bidirectional trust check. Deliberately not node↔node envelope forwarding — that belongs to the deferred §10 mailbox-redundancy work and would be surface with no consumer today. buh-cli gains `peer ping <host:port>`; it links buh-api (the node's own admin tool). Documented caveat: Turso locks the datastore exclusively, so CLI commands cannot run while this host's daemon holds the DB (a daemon-side admin path is the fix — tracked for the next session). cargo check/fmt/clippy(--all-features) clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EB3LjarCdXxqrJ4tFLn8LB
92 lines
3.0 KiB
TOML
92 lines
3.0 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = ["crates/*"]
|
|
|
|
[workspace.package]
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
rust-version = "1.85"
|
|
license = "AGPL-3.0-only"
|
|
authors = ["Rob Thijssen <rob@example>"]
|
|
|
|
[workspace.dependencies]
|
|
# Internal crates
|
|
buh-entities = { path = "crates/buh-entities", version = "=0.1.0" }
|
|
buh-core = { path = "crates/buh-core", version = "=0.1.0" }
|
|
buh-data = { path = "crates/buh-data", version = "=0.1.0" }
|
|
buh-api = { path = "crates/buh-api", version = "=0.1.0" }
|
|
|
|
# Async runtime
|
|
tokio = { version = "1", features = ["full"] }
|
|
async-trait = "0.1"
|
|
futures = "0.3"
|
|
|
|
# Serialization
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Web
|
|
axum = { version = "0.8", features = ["macros"] }
|
|
tower = "0.5"
|
|
tower-http = { version = "0.6", features = ["trace", "limit", "cors"] }
|
|
|
|
# Per-node datastore: Turso Database (embedded, pure-Rust SQLite rewrite).
|
|
# Not sqlx — the turso crate is the native async API. All SQL is centralised in buh-data.
|
|
turso = "0.4"
|
|
|
|
# Object store for opaque media blobs (buh-data `s3` feature only; a node holds ciphertext it
|
|
# cannot read). Filesystem/ZFS is the default backend and needs none of these.
|
|
aws-config = { version = "1", default-features = false, features = ["behavior-version-latest", "rt-tokio"] }
|
|
aws-sdk-s3 = { version = "1", default-features = false, features = ["rt-tokio"] }
|
|
aws-credential-types = "1"
|
|
|
|
# Node transport: decentralised PQ-mTLS (X25519MLKEM768) under a per-node CA. The node links
|
|
# these; buh-crypto (the client crypto core) must NOT — they are unrelated trust domains.
|
|
rustls = "0.23"
|
|
rustls-post-quantum = "0.2"
|
|
tokio-rustls = "0.26"
|
|
rcgen = "0.13"
|
|
# `verify` enables X509Certificate::verify_signature — the per-CA chain check in the TLS verifiers.
|
|
x509-parser = { version = "0.16", features = ["verify"] }
|
|
# rcgen leaf validity windows are `time::OffsetDateTime`; we compute them from the wall clock.
|
|
time = "0.3"
|
|
|
|
# Config
|
|
figment = { version = "0.10", features = ["toml", "env"] }
|
|
|
|
# CLI
|
|
clap = { version = "4", features = ["derive", "env"] }
|
|
|
|
# Errors / logging
|
|
thiserror = "2"
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
tracing-subscriber = { version = "0.3", features = ["json", "env-filter"] }
|
|
|
|
# Client crypto core (buh-crypto only; the node never links these)
|
|
ml-dsa = "0.1.1"
|
|
# default-features off drops the old getrandom-0.2 RNG path (we supply nonces ourselves);
|
|
# `alloc` keeps the Vec-returning encrypt/decrypt.
|
|
chacha20poly1305 = { version = "0.10", default-features = false, features = ["alloc"] }
|
|
# 0.4 to match the version crypto-common (under ml-dsa) pulls, so the wasm_js backend is
|
|
# enabled once for a single getrandom in the tree.
|
|
getrandom = "0.4"
|
|
sha2 = "0.10"
|
|
hkdf = "0.12"
|
|
x25519-dalek = { version = "2", features = ["static_secrets"] }
|
|
ml-kem = "0.3.2"
|
|
|
|
# WASM FFI (buh-crypto `wasm` feature only)
|
|
wasm-bindgen = "0.2"
|
|
wasm-bindgen-test = "0.3"
|
|
|
|
# Misc
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
uuid = { version = "1", features = ["v4", "serde"] }
|
|
hex = "0.4"
|
|
base64 = "0.22"
|
|
bytes = "1"
|
|
tempfile = "3"
|
|
rand = "0.8"
|
|
proptest = "1"
|