connor
b0da3afafc
The audit's other "do it differently" (F76). v1's backend was an image built by CI; its frontend was `rsync -azX --delete` from a laptop, run by hand, with the API's absolute URL compiled into the WASM by an environment variable set in the same script. Two artefacts, one pipeline, and nothing keeping them in step. Here there is one image with the server binary at `/usr/local/bin` and the built frontend at `/srv/dist`, and the frontend asks for `/api/...` relative to wherever it is served -- so the artefact is the same in every environment and the two halves cannot be deployed apart. Caddy still serves the static files from a directory, because that is what the reverse proxy in front of everything already does; the updater lifts them out of the image rather than out of a build on somebody's machine. It stages them and moves the directory into place, since `index.html` names hashed files and a browser that fetches new HTML with old JavaScript gets a blank page. The image is 97 MB and holds no build tooling. Migrations are compiled into the binary and run at startup, and the database is created if it is missing, so there is no `sqlx-cli`, no entrypoint script, and nothing that can decide to carry on after a failed migration -- v1's start.sh ran migrations with `|| echo "Migration failed but continuing..."`. TLS is rustls with its roots compiled in, so there is no OpenSSL to keep patched. There is no dummy-source dance for dependency caching either; a BuildKit cache mount does what that trick was inventing, and the binary is copied out of the mount because a cache mount is not part of the layer. Deployment is a timer on the server rather than CI reaching into it. Nothing in the workflow holds a credential for the machine it deploys to, and a bad build cannot take the site down on its own; the cost is a few minutes between push and deploy, and `deploy/runway-update` for when that is too long. The rest of this is the CI that was promised at M1 and never written. "Rules that only live in a doc get forgotten, so these are lints and CI checks." The lints landed. The CI half did not exist, which meant for twenty-seven milestones the forgetting was still perfectly possible -- it was just mine rather than the repository's. `cargo fmt`, `clippy -D warnings` and the whole test suite now run on every push, alongside the three guardrails that were only ever configuration: `cargo machete` passes. `deny.toml`, written at M1, did not: three permissive licences its allow-list had not anticipated, and two `unmaintained` advisories arriving through Leptos's macros. Both are now allowed by name with a date and a reason rather than by widening a category. MPL-2.0 came out of the list, because nothing uses it and an allow-list should say what is actually there. That file had been quietly wrong since the day it was written, which is the argument for CI in one line. The bundle budget is 1.8 MB against today's 1.31 MB and v1's 2.5 MB, printed on every run. A bundle grows one convenient dependency at a time. The print rule is deliberately not in CI: it already exists as a test, it covers the CalDAV client too, and a shell grep cannot tell a call from a comment about a call -- the first draft of that step failed on the paragraph in `observability.rs` that explains the rule. Two things the image found that reading could not. `/db` is created in the image now. SQLite creates the database file if it is missing but not the directory holding it, so the container started only when something happened to be mounted there and otherwise died with "unable to open database file", which says nothing about what is wrong. And the graceful shutdown only listened for Ctrl-C. A container runtime stops a service with SIGTERM, waits ten seconds, and sends SIGKILL -- so `podman stop` took ten seconds and killed the process outright, and the handler written to stop a restart dropping a CalDAV write half-way through worked everywhere except deployment, which is the one place restarts happen. It listens for both now, and the container stops in two.
39 lines
1.4 KiB
TOML
39 lines
1.4 KiB
TOML
# This file was written at M1 and, until M28 wired it into CI, had never been
|
|
# run against the dependency tree it describes. It did not pass. Everything
|
|
# below with a date on it is what that first run turned up -- which is the
|
|
# argument for CI in one paragraph: a policy nobody executes is a document, and
|
|
# this one had been quietly wrong for twenty-seven milestones.
|
|
|
|
[advisories]
|
|
yanked = "deny"
|
|
ignore = [
|
|
# Both of these are `unmaintained`, not vulnerabilities, and both arrive
|
|
# through Leptos's macros rather than through anything this workspace asks
|
|
# for. They run at build time and none of their code ships. Reviewed
|
|
# 2026-08-28; the honest options are to ignore them or to stop using
|
|
# Leptos, so they are ignored, by id, with this note rather than by
|
|
# turning the whole `unmaintained` class off.
|
|
"RUSTSEC-2024-0436", # paste, via leptos_macro
|
|
"RUSTSEC-2026-0173", # proc-macro-error2, via leptos_macro
|
|
]
|
|
|
|
[licenses]
|
|
allow = [
|
|
"MIT",
|
|
"Apache-2.0",
|
|
"Apache-2.0 WITH LLVM-exception",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"ISC",
|
|
"Unicode-3.0",
|
|
"Zlib",
|
|
# Added 2026-08-28, when this was first run. All three are permissive and
|
|
# all three arrive transitively:
|
|
"CC0-1.0", # base16, via leptos
|
|
"CDLA-Permissive-2.0", # webpki-roots -- the TLS root store itself
|
|
"BSL-1.0", # xxhash-rust
|
|
]
|
|
|
|
[bans]
|
|
multiple-versions = "warn"
|