Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,5 @@ target
# These are backup files generated by rustfmt
**/*.rs.bk
/clippy_reports
build-release.sh
tor_audit_report.md
300 changes: 168 additions & 132 deletions CHANGELOG.md

Large diffs are not rendered by default.

23 changes: 20 additions & 3 deletions Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

11 changes: 9 additions & 2 deletions Cargo.toml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[package]
name = "rustchan"
version = "1.1.0"
version = "1.1.0-alpha.2"
edition = "2021"
# axum 0.8 requires Rust 1.75; that is the effective floor for this project.
rust-version = "1.90"
Expand Down Expand Up @@ -85,6 +85,9 @@ zip = { version = "8", default-features = false, features = ["deflate"] }
# Step 1.1: reqwest for federation push (chan_refresh) and pull (chan_poll).
# rustls-tls avoids a native OpenSSL dependency — single static binary stays intact.
reqwest = { version = "0.12", default-features = false, features = ["multipart", "json", "rustls-tls"] }
# Pin to patched version — fixes RUSTSEC-2026-0049 (CRL distribution point
# matching bug). Transitive dep via reqwest/arti-client.
rustls-webpki = "0.103.10"

tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
Expand All @@ -94,7 +97,11 @@ thiserror = "2"
tempfile = "3"
libc = "0.2"

arti-client = { version = "0.40", features = ["tokio", "native-tls", "onion-service-service"] }
# F-09: Use rustls instead of native-tls to keep the binary self-contained.
# native-tls pulls in OpenSSL as a transitive dep, causing a dynamic link
# against libssl/libcrypto — contradicting the rustls-tls choice on reqwest.
# Verify post-change: cargo tree --edges features | grep openssl (expect nothing)
arti-client = { version = "0.40", features = ["tokio", "rustls", "onion-service-service"] }
tor-hsservice = { version = "0.40" }
tor-cell = { version = "0.40" }
futures = "0.3"
Expand Down
Loading
Loading