enprot 0.5.21

[package]
name        = "enprot"
version     = "0.5.21"
authors     = ["Ribose Inc. <open.source@ribose.com>"]
license     = "BSD-2-Clause"
description = "Engyon Protected Text (EPT) — confidentiality processor and capability ledger"
repository  = "https://github.com/engyon/enprot"
homepage    = "https://github.com/engyon/enprot"
documentation = "https://docs.rs/enprot"
readme      = "README.md"
categories  = ["command-line-utilities", "cryptography"]
keywords    = ["encryption", "engyon", "ept", "botan", "blockchain"]
edition     = "2024"
rust-version = "1.88"
autotests   = false

[workspace]
members = [".", "enprot-ffi"]
default-members = [".", "enprot-ffi"]
resolver = "2"

[package.metadata.docs.rs]
# Build all features so docs.rs shows the full API surface.
all-features = true
# docs.rs runs `cargo doc` — pass --cfg docsrs so feature-gated
# items render with the standard "Available on feature=... only"
# badge once we add feature flags. Botan requires pkg-config at
# doc-build time; docs.rs installs it via the [package.metadata.docs.rs]
# `dependencies` field below (no-op until we need extra system libs).
rustdoc-args = ["--cfg", "docsrs"]

[features]
default = ["cli"]
cli = ["dep:clap", "dep:clap_complete"]
# Sigstore keyless signing (Fulcio + Rekor + OIDC). Gated because the
# sigstore-rs crate pulls in heavy deps (tokio, openidconnect,
# x509-parser, picky). Most users don't need this — it's only useful
# when signing CHAIN anchors from CI workflows that have an OIDC
# token. See TODO.complete/03-sigstore-keyless-signing for the
# full design; this stub is the foundation.
sigstore = []
# Build librnp + json-c + sexpp from source via rnp-src. Use this in
# CI and deploy for self-contained builds that don't need
# system-installed librnp. For local dev, the default (system
# librnp) is faster.
vendored-rnp = ["rnp-rs/vendored"]
# WASM build (TODO.complete/14). When enabled, Botan is replaced
# with RustCrypto-only crypto (aes-siv, aes-gcm, sha3). Currently
# a no-op stub — the Botan → RustCrypto migration is tracked in
# TODO.complete/14.
wasm = []

[lib]
crate-type = ["rlib"]

[[bin]]
name = "enprot"
path = "src/main.rs"
required-features = ["cli"]

[[test]]
name = "integration"
path = "tests/tests.rs"

[[test]]
name = "rsd-conformance"
path = "tests/rsd-conformance/conformance.rs"

[dependencies]
hex            = "0.4"
rpassword      = "7"
clap           = { version = "4.5", features = ["derive", "wrap_help"], optional = true }
clap_complete  = { version = "4", optional = true }
tracing        = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
phf            = { version = "0.14", features = ["macros"] }
thiserror      = "2"
serde          = { version = "1", features = ["derive"] }
serde_json     = "1"
toml           = "1.1"
# Sigstore scaffold deps (TODO.complete/03). Gated behind the
# `sigstore` feature; the actual sigstore-rs integration is pending.
# `url` and `regex` are lightweight enough to keep unconditionally;
# they're commonly already pulled in by other transitive deps.
url            = "2"
regex          = "1"
# Botan does not implement AES-GCM-SIV (RFC 8452). The RustCrypto crate
# remains the backend for `aes-256-gcm-siv`; the other ciphers route through
# Botan.
aes-gcm-siv    = "0.11"
zeroize        = { version = "1", features = ["alloc"] }
flate2         = "1"
# OpenPGP signature support via librnp (the OpenPGP C library from
# Ribose). rnp-rs 0.1.10 + the `vendored` feature uses rnp-src to
# build librnp + json-c + sexpp from source — eliminates the need
# for system-installed librnp/json-c/bzip2/zlib in CI and deploy.
# The `vendored-rnp` feature below exposes this as a build-time opt-in.
rnp-rs         = "0.1.10"

# botan-sys unconditionally calls `pkg-config` when its `pkg-config`
# feature is on. Windows runners don't ship pkg-config. Split per
# target:
#   - Unix: keep `pkg-config` for fast system-Botan discovery.
#   - Windows: use `vendored` so botan-src builds Botan from source.
#     Combined with vendored-rnp, Windows CI needs ZERO system C deps.
[target.'cfg(not(windows))'.dependencies]
botan          = { version = "0.11", features = ["botan3", "pkg-config"] }

[target.'cfg(windows)'.dependencies]
botan          = { version = "0.11", default-features = false, features = ["botan3", "static"] }

[dev-dependencies]
tempfile    = "3"
assert_cmd  = "2"
predicates  = "3"
cpu-time    = "1.0"
proptest    = "1"
serde_json  = "1"
criterion   = { version = "0.8", features = ["html_reports"] }
clap_mangen = "0.3"

[[bench]]
name = "crypto"
harness = false

[[bench]]
name = "merkle"
harness = false

[[bench]]
name = "parser"
harness = false

[[bench]]
name = "comparison"
harness = false

[[test]]
name = "proptest_roundtrip"
path = "tests/proptest_roundtrip.rs"

[[test]]
name = "proptest_invariants"
path = "tests/proptest_invariants.rs"

[profile.release]
opt-level = 3
lto = true
codegen-units = 1
strip = true
# Reproducible builds (TODO.completion/12). Abort-on-panic keeps
# binaries free of unwind tables that vary by build env; debug
# symbols limited to line tables (no full paths embedded).
panic = "abort"
debug = "line-tables-only"

[profile.release.package."*"]
# Strip build-env-specific debug info from dependencies too.
debug = "line-tables-only"

# ----------------------------------------------------------------------------
# Native package metadata.
#
# These sections are consumed by `cargo-deb` and `cargo-generate-rpm` to
# build .deb and .rpm packages (TODO.complete/17). They have no effect on
# the crate's library/binary build.
# ----------------------------------------------------------------------------

[package.metadata.deb]
maintainer = "Engyon <open.source@ribose.com>"
copyright = "2018-2026 Ribose Inc."
license-file = ["LICENSE", "0"]
depends = "libbotan-3-3, librnp0"
section = "utils"
priority = "optional"
extended-description = """\
Engyon Protected Text (EPT) — confidentiality and provenance for text.
Enprot embeds classification levels, content-addressed storage, and
signed chain anchors inside any text-based file without breaking the
host language's syntax."""
assets = [
    ["target/release/enprot", "usr/bin/", "755"],
    ["target/release/enprot.1", "usr/share/man/man1/", "644"],
    ["target/release/completions/enprot.bash", "usr/share/bash-completion/completions/enprot", "644"],
    ["target/release/completions/_enprot", "usr/share/zsh/vendor-completions/", "644"],
    ["target/release/completions/enprot.fish", "usr/share/fish/vendor_completions.d/", "644"],
]

[package.metadata.generate-rpm]
summary = "Engyon Protected Text — confidentiality and provenance for text"
license = "BSD-2-Clause"
vendor = "Ribose Inc."
url = "https://github.com/engyon/enprot"
assets = [
    { source = "target/release/enprot", dest = "/usr/bin/enprot", mode = "755" },
    { source = "target/release/enprot.1", dest = "/usr/share/man/man1/enprot.1", mode = "644" },
    { source = "target/release/completions/enprot.bash", dest = "/usr/share/bash-completion/completions/enprot", mode = "644" },
    { source = "target/release/completions/_enprot", dest = "/usr/share/zsh/site-functions/_enprot", mode = "644" },
    { source = "target/release/completions/enprot.fish", dest = "/usr/share/fish/vendor_completions.d/enprot.fish", mode = "644" },
]

[package.metadata.generate-rpm.requires]
botan = "*"
librnp = "*"