diff --git a/.cargo/config.toml b/.cargo/config.toml index cb1a2e6..822b495 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -1,5 +1,2 @@ -[registries.forgejo] -index = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" - [registry] global-credential-providers = ["cargo:token"] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e837af3..db6b218 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,18 +19,9 @@ jobs: if: github.event_name != 'pull_request' || github.event.pull_request.user.type != 'Bot' runs-on: [self-hosted, node-b, linux, x64, rust] env: - FORGEJO_CARGO_TOKEN: ${{ secrets.FORGEJO_CARGO_TOKEN }} CARGO_BUILD_JOBS: 1 steps: - uses: actions/checkout@v7 - - name: Configure Cargo credentials - run: | - export CARGO_HOME="$RUNNER_TEMP/cargo-home" - mkdir -p "$CARGO_HOME" - printf '[registries.forgejo]\ntoken = "Bearer %s"\n' "$FORGEJO_CARGO_TOKEN" > "$CARGO_HOME/credentials.toml" - chmod 600 "$CARGO_HOME/credentials.toml" - test -n "$FORGEJO_CARGO_TOKEN" - echo "CARGO_HOME=$CARGO_HOME" >> "$GITHUB_ENV" - uses: dtolnay/rust-toolchain@stable with: toolchain: 1.88 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3ea56c8..72c1533 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -63,8 +63,6 @@ jobs: build-args: | RUSTNZB_BUILD_REF=${{ github.ref_name }} RELEASE_OPTIMIZED=true - secrets: | - forgejo_token=${{ secrets.FORGEJO_CARGO_TOKEN }} cache-from: '' cache-to: '' - name: Smoke-test the exact amd64 release image diff --git a/.gitignore b/.gitignore index 24c6e31..d75171f 100644 --- a/.gitignore +++ b/.gitignore @@ -18,6 +18,7 @@ e2e/mock-auth-state.json /.ci-cache/ /.ci-output/ /.ci-artifacts/ +/tempmigration.md # Codesight .codesight/ diff --git a/Cargo.lock b/Cargo.lock index f13b509..e1b9820 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -102,7 +102,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -113,7 +113,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -783,7 +783,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -889,21 +889,6 @@ dependencies = [ "libc", ] -[[package]] -name = "futures" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8b147ee9d1f6d097cef9ce628cd2ee62288d963e16fb287bd9286455b241382d" -dependencies = [ - "futures-channel", - "futures-core", - "futures-executor", - "futures-io", - "futures-sink", - "futures-task", - "futures-util", -] - [[package]] name = "futures-channel" version = "0.3.32" @@ -911,7 +896,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d" dependencies = [ "futures-core", - "futures-sink", ] [[package]] @@ -931,12 +915,6 @@ dependencies = [ "futures-util", ] -[[package]] -name = "futures-io" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718" - [[package]] name = "futures-macro" version = "0.3.32" @@ -972,13 +950,10 @@ version = "0.3.32" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6" dependencies = [ - "futures-channel", "futures-core", - "futures-io", "futures-macro", "futures-sink", "futures-task", - "memchr", "pin-project-lite", "slab", ] @@ -1813,7 +1788,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -1990,9 +1965,9 @@ dependencies = [ [[package]] name = "nzbdav-core" -version = "0.4.1" -source = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" -checksum = "b78de0e6a22cc7d42030b234d55d8de82fae66355b6ad6eef30db435190a288f" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "4944d0fe6852b88c8ebf12e01da82040d0216a395a2493e5cf8a7b4c12056910" dependencies = [ "async-trait", "bincode", @@ -2013,9 +1988,9 @@ dependencies = [ [[package]] name = "nzbdav-dav" -version = "0.4.1" -source = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" -checksum = "73a1534d092ef82f455a5822c1d8676815bd65287226f90c1e9ee1fbafe58f05" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "af22d2a6a356f724327316f8d52df8f4380666ffe4d721c9700aef2651fa270a" dependencies = [ "axum 0.8.9", "bincode", @@ -2037,9 +2012,9 @@ dependencies = [ [[package]] name = "nzbdav-pipeline" -version = "0.4.1" -source = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" -checksum = "4bebc904b75cb6dfe0c08679f8884a585797066795f5572258c15e642c19b709" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "5bd37aa91fd1c87c7c58d076f562da09afd97b78e445343317388343e06c10a4" dependencies = [ "bincode", "chrono", @@ -2060,9 +2035,9 @@ dependencies = [ [[package]] name = "nzbdav-rar" -version = "0.4.1" -source = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" -checksum = "3ca35f912dc719c8570e164f35c0fb8c625f5497121bcbf4dee429896818e6a8" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "f352aa02829c45d32f2c7c96d1c1dfce86087f23f92f4cceda2af0c35778dcb4" dependencies = [ "aes 0.8.4", "cbc", @@ -2076,17 +2051,14 @@ dependencies = [ [[package]] name = "nzbdav-stream" -version = "0.4.1" -source = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" -checksum = "eebfb27f7dd8c48884399eb1ce56bb6893560f435fdec23a54633eb5718929a4" +version = "0.4.0" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "7d5fb58a1838a0513f3b3a5f6b32204b73114e6f4d662951bd7f954109340914" dependencies = [ "aes 0.8.4", "arc-swap", - "async-trait", "bytes", "cbc", - "crc32fast", - "futures", "nzb-decode", "nzb-nntp", "nzbdav-core", @@ -2480,7 +2452,7 @@ dependencies = [ "once_cell", "socket2 0.6.4", "tracing", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -2806,7 +2778,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3168,7 +3140,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3272,7 +3244,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -3992,7 +3964,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] diff --git a/Dockerfile b/Dockerfile index f0f943e..ef8f766 100644 --- a/Dockerfile +++ b/Dockerfile @@ -41,10 +41,8 @@ COPY Cargo.toml Cargo.lock ./ COPY apps apps COPY crates crates -# The Forgejo credential exists only in this BuildKit secret-mounted RUN. It -# is never a Docker ARG, image ENV value, Cargo file, or cache layer. -RUN --mount=type=secret,id=forgejo_token,required=true \ - --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \ +# The build uses only public crates.io dependencies for the rustnzb binary. +RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \ --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \ --mount=type=cache,target=/build/target,sharing=locked \ set -eu; \ @@ -53,22 +51,17 @@ RUN --mount=type=secret,id=forgejo_token,required=true \ linux/arm64) rust_target=aarch64-unknown-linux-musl ;; \ *) printf 'unsupported target platform: %s\n' "$TARGETPLATFORM" >&2; exit 1 ;; \ esac; \ - token=$(cat /run/secrets/forgejo_token); \ if [ "$RELEASE_OPTIMIZED" = true ]; then \ export CARGO_PROFILE_RELEASE_LTO=thin \ CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 \ CARGO_PROFILE_RELEASE_STRIP=symbols; \ fi; \ - CARGO_REGISTRIES_FORGEJO_INDEX='sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/' \ - CARGO_REGISTRIES_FORGEJO_CREDENTIAL_PROVIDER='cargo:token' \ - CARGO_REGISTRIES_FORGEJO_TOKEN="Bearer $token" \ CARGO_TARGET_DIR=/build/target \ RUSTNZB_BUILD_REF="$RUSTNZB_BUILD_REF" \ cargo zigbuild --release --locked -p rustnzb \ --features webdav,vendored-openssl --target "$rust_target"; \ mkdir -p /out; \ cp "/build/target/$rust_target/release/rustnzb" /out/rustnzb; \ - unset token CARGO_REGISTRIES_FORGEJO_TOKEN FROM lscr.io/linuxserver/baseimage-alpine:3.23@sha256:46d690858431e262d574274bb2863e1fbaf8de61c6f7677150dd79c2cc65cdcf AS runtime diff --git a/Dockerfile.local b/Dockerfile.local index b67f81d..db0a753 100644 --- a/Dockerfile.local +++ b/Dockerfile.local @@ -29,19 +29,12 @@ COPY apps/rustnzb/Cargo.toml apps/rustnzb/build.rs /build/apps/rustnzb/ COPY apps/rustnzb/src /build/apps/rustnzb/src COPY crates /build/crates -# Forgejo creds (still needed for private nzbdav-* crates — webdav feature) -ARG GIT_AUTH_TOKEN ARG RUSTNZB_BUILD_REF ARG CI_COMMIT_SHA ARG CI_COMMIT_TAG ENV RUSTNZB_BUILD_REF=${RUSTNZB_BUILD_REF} ENV CI_COMMIT_SHA=${CI_COMMIT_SHA} ENV CI_COMMIT_TAG=${CI_COMMIT_TAG} -RUN TOKEN="${GIT_AUTH_TOKEN}" && \ - git config --global url."http://x-access-token:${TOKEN}@100.92.54.45:3002/".insteadOf "http://100.92.54.45:3002/" && \ - printf '[registries.forgejo]\nindex = "sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/"\ncredential-provider = "cargo:token"\n\n[registry]\ndefault = "forgejo"\n' > $CARGO_HOME/config.toml && \ - printf '[registries.forgejo]\ntoken = "Bearer %s"\n' "$TOKEN" > $CARGO_HOME/credentials.toml - RUN cargo build --release -p rustnzb --features webdav diff --git a/apps/rustnzb/Cargo.toml b/apps/rustnzb/Cargo.toml index 6175f65..42b896f 100644 --- a/apps/rustnzb/Cargo.toml +++ b/apps/rustnzb/Cargo.toml @@ -54,10 +54,10 @@ tokio-util = { version = "0.7", features = ["rt"] } openssl-sys = { version = "0.9", features = ["vendored"], optional = true } # WebDAV feature (opt-in: cargo build --features webdav) -nzbdav-core = { version = "0.4.1", registry = "forgejo", optional = true } -nzbdav-stream = { version = "0.4.1", registry = "forgejo", optional = true } -nzbdav-dav = { version = "0.4.1", registry = "forgejo", optional = true } -nzbdav-pipeline = { version = "0.4.1", registry = "forgejo", optional = true, default-features = false } +nzbdav-core = { version = "0.4.0", optional = true } +nzbdav-stream = { version = "0.4.0", optional = true } +nzbdav-dav = { version = "0.4.0", optional = true } +nzbdav-pipeline = { version = "0.4.0", optional = true, default-features = false } [package.metadata.deb] maintainer = "AusAgentSmith " diff --git a/ci/run b/ci/run index a68bea0..ce9f941 100755 --- a/ci/run +++ b/ci/run @@ -35,12 +35,6 @@ case "$task" in *) usage ;; esac -needs_cargo_auth=false -case "$task" in - fmt|check|test|clippy|e2e|desktop-test|build-linux|build-linux-arm64|build-windows|build-image|build-ci-images) - needs_cargo_auth=true - ;; -esac needs_registry_auth=false if [ "$image_key" != host ] || [ "$task" = smoke-image ]; then needs_registry_auth=true @@ -48,7 +42,7 @@ fi # The authenticated wrapper fetches secrets into this process only. Docker is # given environment variable names, never token values in argv. -if { [ "$needs_cargo_auth" = true ] || [ "$needs_registry_auth" = true ]; } \ +if [ "$needs_registry_auth" = true ] \ && [ -z "${GIT_AUTH_TOKEN:-}" ] && [ -z "${FORGEJO_TOKEN_FILE:-}" ]; then if [ -z "${RUSTNZB_CI_AUTH_ACTIVE:-}" ] && command -v mydevenv2-agent-auth >/dev/null 2>&1; then export RUSTNZB_CI_AUTH_ACTIVE=1 @@ -141,17 +135,6 @@ else ) fi -if [ "$needs_cargo_auth" = true ]; then - if [ -n "${GIT_AUTH_TOKEN:-}" ]; then - docker_args+=(--env GIT_AUTH_TOKEN) - else - docker_args+=( - --mount "type=bind,src=$FORGEJO_TOKEN_FILE,dst=/run/secrets/forgejo_token,readonly" - --env FORGEJO_TOKEN_FILE=/run/secrets/forgejo_token - ) - fi -fi - for name in CI_COMMIT_SHA CI_COMMIT_TAG CI_PIPELINE_NUMBER RUSTNZB_BUILD_REF CI_ARTIFACT_DIR CI_PACKAGE_DIR; do [ -z "${!name:-}" ] || docker_args+=(--env "$name") done diff --git a/ci/tasks/build-image b/ci/tasks/build-image index 24e1d34..6af692d 100755 --- a/ci/tasks/build-image +++ b/ci/tasks/build-image @@ -3,7 +3,7 @@ set -eu . "$(dirname "$0")/lib.sh" task_start build-image docker -: "${GIT_AUTH_TOKEN:?GIT_AUTH_TOKEN is required for the private WebDAV crates}" +: "${GIT_AUTH_TOKEN:?GIT_AUTH_TOKEN is required for the Forgejo rollback image registry}" image=${1:-rustnzb:local} build_ref=${RUSTNZB_BUILD_REF:-$(git rev-parse --short=12 HEAD)} docker_config=$(mktemp -d) @@ -32,7 +32,6 @@ set -- \ --target runtime \ --platform "${RUSTNZB_PLATFORM:-linux/amd64}" \ --provenance=false \ - --secret id=forgejo_token,env=GIT_AUTH_TOKEN \ --build-arg "RUSTNZB_BUILD_REF=$build_ref" \ --tag "$image" if [ "${RUSTNZB_PUSH:-false}" = true ]; then diff --git a/ci/tasks/build-linux b/ci/tasks/build-linux index 8af970c..1625c6a 100755 --- a/ci/tasks/build-linux +++ b/ci/tasks/build-linux @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_task_frontend' EXIT +trap cleanup_task_frontend EXIT task_start build-linux cargo npm -setup_cargo_auth task_target_dir build-linux ensure_frontend if [ -n "${CI_COMMIT_TAG:-}" ]; then diff --git a/ci/tasks/build-linux-arm64 b/ci/tasks/build-linux-arm64 index fa1aef0..2af3778 100755 --- a/ci/tasks/build-linux-arm64 +++ b/ci/tasks/build-linux-arm64 @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_task_frontend' EXIT +trap cleanup_task_frontend EXIT task_start build-linux-arm64 cargo zig -setup_cargo_auth task_target_dir build-linux-arm64 ensure_frontend if [ -n "${CI_COMMIT_TAG:-}" ]; then diff --git a/ci/tasks/build-windows b/ci/tasks/build-windows index 15a9d56..36a4255 100755 --- a/ci/tasks/build-windows +++ b/ci/tasks/build-windows @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_task_frontend' EXIT +trap cleanup_task_frontend EXIT task_start build-windows cargo clang lld -setup_cargo_auth task_target_dir build-windows ensure_frontend if [ -n "${CI_COMMIT_TAG:-}" ]; then diff --git a/ci/tasks/cargo-auth b/ci/tasks/cargo-auth deleted file mode 100755 index 4cd718c..0000000 --- a/ci/tasks/cargo-auth +++ /dev/null @@ -1,23 +0,0 @@ -#!/bin/sh - -# Source this file from Cargo tasks. The token remains in an environment -# variable and is never written to CARGO_HOME, the checkout, or a command line. -setup_cargo_auth() { - if [ -n "${GIT_AUTH_TOKEN:-}" ]; then - cargo_auth_token=$GIT_AUTH_TOKEN - elif [ -n "${FORGEJO_TOKEN_FILE:-}" ] && [ -r "$FORGEJO_TOKEN_FILE" ]; then - cargo_auth_token=$(cat "$FORGEJO_TOKEN_FILE") - else - printf 'Forgejo Cargo access requires GIT_AUTH_TOKEN or FORGEJO_TOKEN_FILE\n' >&2 - return 1 - fi - - export CARGO_REGISTRIES_FORGEJO_INDEX="sparse+https://repo.indexarr.net/api/packages/indexarr/cargo/" - export CARGO_REGISTRIES_FORGEJO_CREDENTIAL_PROVIDER="cargo:token" - export CARGO_REGISTRIES_FORGEJO_TOKEN="Bearer $cargo_auth_token" - unset cargo_auth_token -} - -cleanup_cargo_auth() { - unset CARGO_REGISTRIES_FORGEJO_TOKEN GIT_AUTH_TOKEN -} diff --git a/ci/tasks/check b/ci/tasks/check index 5e8e0f5..5d6a8d4 100755 --- a/ci/tasks/check +++ b/ci/tasks/check @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_frontend' EXIT +trap cleanup_frontend EXIT task_start check cargo -setup_cargo_auth task_target_dir check prepare_placeholder_frontend cargo check --workspace --locked diff --git a/ci/tasks/clippy b/ci/tasks/clippy index 2037762..2547dfd 100755 --- a/ci/tasks/clippy +++ b/ci/tasks/clippy @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_frontend' EXIT +trap cleanup_frontend EXIT task_start clippy cargo -setup_cargo_auth task_target_dir clippy prepare_placeholder_frontend cargo clippy --workspace --all-targets --all-features --locked -- -D warnings diff --git a/ci/tasks/desktop-test b/ci/tasks/desktop-test index c937764..7e598a9 100755 --- a/ci/tasks/desktop-test +++ b/ci/tasks/desktop-test @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_frontend' EXIT +trap cleanup_frontend EXIT task_start desktop-test cargo pkg-config patchelf -setup_cargo_auth task_target_dir desktop-test prepare_placeholder_frontend cargo test --manifest-path desktop/src-tauri/Cargo.toml --all-targets --locked diff --git a/ci/tasks/e2e b/ci/tasks/e2e index 02671fc..14fb91e 100755 --- a/ci/tasks/e2e +++ b/ci/tasks/e2e @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_task_frontend' EXIT +trap cleanup_task_frontend EXIT task_start e2e cargo node npm -setup_cargo_auth task_target_dir e2e ensure_frontend diff --git a/ci/tasks/fmt b/ci/tasks/fmt index 512fd95..53a631d 100755 --- a/ci/tasks/fmt +++ b/ci/tasks/fmt @@ -1,8 +1,5 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap cleanup_cargo_auth EXIT task_start fmt cargo rustfmt -setup_cargo_auth cargo fmt --all -- --check diff --git a/ci/tasks/test b/ci/tasks/test index b06879e..71a7872 100755 --- a/ci/tasks/test +++ b/ci/tasks/test @@ -1,10 +1,8 @@ #!/bin/sh set -eu . "$(dirname "$0")/lib.sh" -. "$(dirname "$0")/cargo-auth" -trap 'cleanup_cargo_auth; cleanup_frontend' EXIT +trap cleanup_frontend EXIT task_start test cargo -setup_cargo_auth task_target_dir test prepare_placeholder_frontend cargo test --workspace --all-targets --locked