diff --git a/_docs/48-rust-toolbox.md b/_docs/48-rust-toolbox.md new file mode 100644 index 0000000..78995ef --- /dev/null +++ b/_docs/48-rust-toolbox.md @@ -0,0 +1,1050 @@ +--- +title: "The Rust toolbox: rust-toolchain.toml pins, rustfmt and clippy as toolchain components, and the cargo-test-to-nextest workflow" +order: 48 +part: "Appendices: Tooling" +description: "rust-toolbox is one zero-dependency crate and the toolchain wrapped around it -- rust-toolchain.toml pinning channel and components so rustup resolves the same rustc, rustfmt, and clippy for everyone, an isolated misformatted fixture and a feature-gated clippy bait that make the format and lint gates assert real findings, and cargo test asserting the digest literal -- with committed deny.toml and clippy.toml for the cargo-nextest/cargo-deny/cargo-llvm-cov/cargo-audit tier shown as reference but absent on the host. Verified on the Fedora 44 host: verify.lua PASS 20/FAIL 0 fully offline, toolbox report digest=0x481984990deee5ff (byte-identical to ch46's C++ and ch47's Go digest), cargo fmt --check clean while rustfmt flags the fixture, cargo clippy -D warnings clean by default and naming needless_return under --features lintbait, and cargo test passing the digest unit test." +duration: "50 minutes" +--- + +Chapter 46 pointed every C++ tool it could find at one small binary; Chapter +47 did the same for Go and found the depth had moved — out of the build +system and into `go.mod`'s own toolchain directives. Rust closes the arc, and +it moves the line one step further in the same direction. Go pins its +compiler in the module file; Rust pins its compiler *and its formatter and +its linter*, in a file `rustup` reads before `cargo` has done anything at +all. That single fact reorganizes this whole chapter. In Chapter 47, +`gofumpt`, `golangci-lint`, and `staticcheck` had to be gated-if-present, +because they are separate downloads that a given host may simply not have. In +Rust, `rustfmt` and `clippy` are *components of the pinned channel* — if the +pin resolves, they are there, at exactly the version the pin names. So the +formatter and the linter graduate out of the "shown as reference" tier and +into the hard, offline, always-runs core. `toolbox` (the Rust one) is a +single zero-dependency crate engineered the same way its C++ and Go siblings +were: every tool pointed at it has something concrete to catch or confirm, +never just a clean exit. + +{% include excalidraw.html + file="48-rust-toolchain-pipeline" + alt="A rust-toolchain.toml box listing channel 1.97.1, edition 2024, and the rustfmt and clippy components feeds into a rustup box that resolves the pinned toolchain and installs it if missing, which in turn drives a cargo/rustc 1.97.1 box. From cargo/rustc two arms fan out: a deterministic build arm running cargo run -- report, producing the zero-dependency toolbox binary and an FNV-1a digest over a fixed payload, landing in an amber digest gate asserting 0x481984990deee5ff and noting the same value appears in the C++ and Go chapters; and a cargo test arm running the #[cfg(test)] suite in digest.rs, landing in an amber cargo-test gate that asserts the same literal so any drift fails. Both gates are labeled rust-native and verified offline on this host." + caption="Figure 48.1 — the Rust toolchain and pinning flow: rust-toolchain.toml's channel and components resolve through rustup into cargo/rustc, which drives the deterministic build (report digest) and the cargo test gate" %} + +> **Tools used** — `rustup` (host; resolves `rust-toolchain.toml` before +> every `cargo` invocation, gated as a hard requirement by +> `scripts/check-host.sh`'s "rustc via rustup" check, which fails outright +> if `rustup` is missing and warns if the resolved version is not 1.97.1), +> `cargo` and `rustc` (host; `scripts/check-host.sh` gates both), `rustfmt` +> and `cargo fmt` (host; a component of the pinned channel, not separately +> gated by `check-host.sh` because pinning the channel pins it), `cargo +> clippy` (host; likewise a pinned component), `cargo test` (host; ships +> inside `cargo`). `cargo-nextest`, `cargo-deny`, `cargo-llvm-cov`, and +> `sccache` are absent on this reference host and are not installed; +> `cargo-audit`, `cargo-watch`, and `cargo-flamegraph` are present but not +> exercised as gates (no advisory database offline / interactive / needs +> `perf` privileges), so all seven of those sections below are shown as +> reference, not verified. No VM, no root, no LGTM stack — +> `examples/48-rust-toolbox` is `mode: local` in `examples/manifest.yaml`. + +Because the Rust toolchain is itself the subject, `examples/48-rust-toolbox/` +ships `langs: [rust]` only, the same way Chapter 43's macro chapter, Chapter +46's C++ chapter, and Chapter 47's Go chapter each stayed inside one +language — a C++ or Go build has nothing to say about a +`rust-toolchain.toml` component list or a `clippy.toml` MSRV. Every code +block below is a plain fenced `rust`/`toml`/`console` block; there is no +`codetabs` include to reach for when only one language is in the room. + +## The pin: `rust-toolchain.toml` + +The file is nineteen lines, and only the last three do anything: + +```toml +[toolchain] +channel = "1.97.1" +components = ["rustfmt", "clippy"] +``` + +`channel` is the part everybody knows: it names an exact release, so +`cargo build` in this directory compiles with 1.97.1 whatever the developer's +`rustup default` happens to be. What makes the file more than a version +string is `components`. `rustfmt` and `clippy` are not separate projects that +happen to work with Rust — they are artifacts `rustup` downloads *for a +specific toolchain*, versioned in lockstep with it. Listing them here says +"this repository does not merely need Rust 1.97.1, it needs 1.97.1's +formatter and 1.97.1's linter," and `rustup` will install them the first time +anything in this directory invokes `cargo`. + +The resolution is not a convention this chapter is asserting; `rustup` will +tell you about it directly. Run inside `examples/48-rust-toolbox/rust`, on a +host whose global default is `stable` and which also has `nightly` and +`1.96.0` sitting around: + +```console +$ rustup show +Default host: x86_64-unknown-linux-gnu +rustup home: /home/rsedor/.rustup + +installed toolchains +-------------------- +stable-x86_64-unknown-linux-gnu (default) +nightly-x86_64-unknown-linux-gnu +1.96.0-x86_64-unknown-linux-gnu +1.97.1-x86_64-unknown-linux-gnu (active) + +active toolchain +---------------- +name: 1.97.1-x86_64-unknown-linux-gnu +active because: overridden by '/home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust/rust-toolchain.toml' +installed targets: + x86_64-unknown-linux-gnu +``` + +`active because: overridden by '…/rust-toolchain.toml'` is the entire +mechanism, stated by the tool. Step one directory outside the crate and the +override evaporates: + +```console +$ cd /tmp && rustup show active-toolchain +stable-x86_64-unknown-linux-gnu (default) +``` + +That is the property Chapter 47 got from `GOTOOLCHAIN` and Chapter 46 had to +build by hand out of seven `CMakePresets.json` configurations: the version +decision lives with the source, not with whoever checked it out. What Rust +adds on top is that the *tools* travel with it too. Every binary in the chain +reports the same release: + +```console +$ cargo --version +cargo 1.97.1 (c980f4866 2026-06-30) +$ rustc --version +rustc 1.97.1 (8bab26f4f 2026-07-14) +$ cargo clippy --version +clippy 0.1.97 (8bab26f4f6 2026-07-14) +$ cargo fmt --version +rustfmt 1.9.0-stable (8bab26f4f6 2026-07-14) +``` + +Note the commit hashes: `rustc`, `clippy`, and `rustfmt` all report +`8bab26f4f6` — one build of one source tree. A clippy lint's exact wording, +a rustfmt rule's exact output, and the compiler that accepts the result are +all the same snapshot. That is why the gates below can assert on specific +diagnostic text without being fragile: the pin holds the diagnostic still. + +### What is deliberately *not* pinned + +`components` lists exactly two entries, and the omissions are as deliberate +as the inclusions. `llvm-tools` (needed by `cargo-llvm-cov`) and `rust-src` +(needed by miri and rust-analyzer) are left out, because `rustup` fetches any +missing component **over the network, on the first `cargo` invocation in this +directory**. Pinning a component a reader does not have turns `cargo build +--offline` into a download — which is exactly the failure this example exists +to avoid. The chapter's own draft hit it: an earlier `components` list +included `llvm-tools`, and the first build in a fresh checkout printed +`info: downloading component llvm-tools` before compiling anything. The file +documents the opt-in instead: + +```toml +# llvm-tools (needed by cargo-llvm-cov) and rust-src (needed by miri and +# rust-analyzer) are deliberately NOT pinned here: rustup fetches any missing +# component over the network on the first cargo invocation in this directory, +# which would break the offline build on a fresh host. Add them explicitly +# when you opt into those tools: +# +# rustup component add llvm-tools rust-src +``` + +That is the general rule for this file: pin what every build needs, and make +everything else a documented command a reader runs on purpose. + +## Deterministic build and digest + +`Cargo.toml` is short by design, and its most important section is the one +that is not there: + +```toml +[package] +name = "toolbox" +version = "0.1.0" +edition = "2024" + +[[bin]] +name = "toolbox" +path = "src/main.rs" + +[features] +# Feature-gated clippy bait (src/lintbait.rs). Off by default so the +# default build and `cargo clippy --all-targets -- -D warnings` are clean; +# `cargo clippy --features lintbait -- -D warnings` compiles it and fires +# the stable `needless_return` lint on purpose (ch48's clippy gate). +lintbait = [] +``` + +There is no `[dependencies]`. The crate is zero-dependency on purpose, and +`cargo tree` is the proof: + +```console +$ cargo tree --offline +toolbox v0.1.0 (/home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust) +``` + +One node. `Cargo.lock` holds exactly one package — itself. That is not +minimalism for its own sake: it is what makes `--offline` a meaningful flag +rather than a hopeful one. `rust/demo.sh` passes it on every build: + +```bash +# --offline on purpose: toolbox is a zero-dependency crate, so a correct +# build never needs the network. Passing --offline turns "cargo quietly +# reached crates.io" from an invisible event into a hard build failure. +build() { + cargo build --offline --release +} +``` + +`edition = "2024"` is the other line worth stopping on. Editions are Rust's +mechanism for changing language semantics without breaking old code: a 2024 +crate and a 2015 crate can link together in one binary, each compiled under +its own rules. Editions are per-crate, the channel is per-repository, and +they are set in different files — `Cargo.toml` and `rust-toolchain.toml` +respectively. Both of ch48's gates check both, because getting one right and +the other wrong is the common failure: a 2024 crate compiled by a toolchain +too old to know that edition fails with a confusing error about an unknown +edition, not an obviously-wrong one. + +The payload and the hash are lifted byte-for-byte from Chapter 46's C++ and +Chapter 47's Go toolbox, which is the whole point: + +```rust +/// ch46/ch47's exact 16-byte payload (`"The quick brown."`), reused +/// byte-for-byte so the C++, Go, and Rust toolbox chapters land on the +/// identical FNV-1a digest (`0x481984990deee5ff`) -- a cross-appendix +/// easter egg, not a coincidence. FNV-1a is language-independent: any +/// conforming implementation over the same bytes produces the same 64-bit +/// value. +pub const PAYLOAD: [u8; 16] = [ + 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x2e, +]; + +/// FNV-1a over `data`. Integer-only, no floats, addresses, timing, or +/// hash-map iteration -- the same input bytes produce the same digest +/// bit-for-bit on every conforming Rust toolchain, every architecture, +/// every run. +pub fn fnv1a(data: &[u8]) -> Digest { + let mut h = FNV_OFFSET_BASIS; + for &b in data { + h ^= b as u64; + h = h.wrapping_mul(FNV_PRIME); + } + Digest { fnv: h } +} +``` + +`wrapping_mul` is the one Rust-specific detail and it is load-bearing. Plain +`*` on `u64` panics on overflow in a debug build and wraps in a release +build — so the same source would compute the digest in release and abort in +`cargo test`, which builds with debug assertions on. `wrapping_mul` states +the intent the algorithm actually requires (FNV-1a is defined modulo 2⁶⁴) and +makes the two profiles agree. C++ got this behavior by using `uint64_t`, +where wrapping is simply what the language does; Go got it the same way. Rust +is the only one of the three where you must ask for it, and the only one +where forgetting is caught rather than silent. + +```console +$ ./demo.sh rust build + Finished `release` profile [optimized] target(s) in 0.00s +$ ./demo.sh rust run report +toolbox report: payload_len=16 digest=0x481984990deee5ff +``` + +## `rustfmt`: a clean tree and one isolated dirty file + +A format gate that only ever asserts "the tree is clean" is half a gate: it +passes just as happily when the formatter is broken, misconfigured, or +looking at nothing at all. The gate needs both directions — clean where it +should be clean, and *loud* where it should be loud — which means the example +has to carry a deliberately misformatted file without that file ever +affecting the build. + +Rust makes the isolation easy in a way Go's `testdata/` convention and C++'s +`.clang-format` exclusions do not quite match: **a `.rs` file that no `mod` +declaration names is not part of the crate at all.** `cargo build`, `cargo +test`, `cargo clippy`, and `cargo fmt` all walk the module tree from the +crate roots, so `fixtures/misformatted.rs` — declared by nothing — is +invisible to every one of them: + +```rust +// This file lives OUTSIDE the crate's module tree on purpose: nothing +// `mod`-declares it, so `cargo build`, `cargo test`, and `cargo clippy` +// never see it, and `cargo fmt --check` (which walks the module tree from +// the crate roots) leaves it alone. Only an explicit, per-file +// `rustfmt --edition 2024 --check fixtures/misformatted.rs` reads it -- and +// must exit nonzero, printing a diff. +// +// Do not "fix" the formatting below. The wrong spacing, the 4-into-2 indent, +// the missing trailing comma, and the crammed `if` are the assertion. + +pub struct Sample{ pub id:u32, pub label:&'static str } + +pub fn classify( n : i64 )->&'static str{ + if n<0 {"negative"} else if n==0 {"zero"}else{"positive"} +} +``` + +`rustfmt.toml` sits beside it and applies to both halves of the gate: + +```toml +edition = "2024" +max_width = 100 +newline_style = "Unix" +use_small_heuristics = "Default" +``` + +`edition = "2024"` appears here as well as in `Cargo.toml` because `rustfmt` +invoked directly — as the fixture half of the gate does — has no `Cargo.toml` +to read. `cargo fmt` passes the edition through from the manifest; bare +`rustfmt` does not, which is why the fixture command below spells +`--edition 2024` out explicitly. Two paths into the same formatter, two +different ways it learns which language version it is formatting. + +The clean half is unglamorous and that is correct: + +```console +$ cargo fmt --check ; echo $? +0 +``` + +No output, exit 0. The loud half, run on the same host in the same session: + +```console +$ rustfmt --edition 2024 --check fixtures/misformatted.rs +Diff in /home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust/fixtures/misformatted.rs:10: + // Do not "fix" the formatting below. The wrong spacing, the 4-into-2 indent, + // the missing trailing comma, and the crammed `if` are the assertion. + +-pub struct Sample{ pub id:u32, pub label:&'static str } ++pub struct Sample { ++ pub id: u32, ++ pub label: &'static str, ++} + +-pub fn classify( n : i64 )->&'static str{ +- if n<0 {"negative"} else if n==0 {"zero"}else{"positive"} ++pub fn classify(n: i64) -> &'static str { ++ if n < 0 { ++ "negative" ++ } else if n == 0 { ++ "zero" ++ } else { ++ "positive" ++ } + } +``` + +Exit status 1, with a diff. `verify.lua` asserts three separate things about +that output — nonzero exit, a `Diff in …fixtures/misformatted.rs` line, and +the specific reformatted signature `pub fn classify(n: i64) -> &'static str +{` — because any one of them alone could pass for the wrong reason. A nonzero +exit could be a missing file; a `Diff in` line could name some other file; +only the reformatted signature proves `rustfmt` actually parsed this source +and produced this rewrite. + +## `clippy`: clean by default, loud behind a feature + +The linter gate has the same two-directional shape as the formatter's, but +the isolation problem is harder. A clippy bait *is* real code — it has to +compile — so it cannot simply be excluded the way an unreferenced file can. +Three approaches are available and two of them are wrong: + +- `#[allow(clippy::needless_return)]` on the function. This defeats the + entire gate: the lint no longer fires, so there is nothing to assert. +- Leave the bait in the default build, un-allowed. Then `cargo clippy + --all-targets -- -D warnings` fails *always*, and the clean half of the + gate is gone. +- Put the bait behind a Cargo feature, off by default. The default build and + the default clippy run never compile it; `--features lintbait` does. + +The third is what `src/lintbait.rs` does, and `main.rs` gates both the module +declaration and the subcommand that reaches it on the same feature: + +```rust +mod digest; + +#[cfg(feature = "lintbait")] +mod lintbait; +``` + +The bait itself is four lines of ordinary, compiling, deliberately +un-idiomatic Rust: + +```rust +pub fn trip_needless_return(x: i64) -> i64 { + let y = x * 2; + return y; +} +``` + +`return y;` as the last statement of a function, where the bare expression +`y` would do. `rustc` accepts it without a murmur — it is valid Rust with +identical semantics either way. `clippy::needless_return` is a *style* lint, +and style lints are exactly the class of thing a compiler must not enforce +and a linter should. That division is the point of having clippy at all. + +Clean first: + +```console +$ cargo clippy --offline --all-targets -- -D warnings + Checking toolbox v0.1.0 (/home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust) + Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.05s +``` + +`--all-targets` matters: without it, clippy checks the binary but skips the +`#[cfg(test)]` module, so lint problems in test code slip through silently. +`-D warnings` after the `--` promotes every clippy warning to an error, which +is what turns a linter into a gate — a tool that prints warnings nobody reads +is documentation, not enforcement. + +Now the same command with the feature on: + +```console +$ cargo clippy --offline --features lintbait --all-targets -- -D warnings + Checking toolbox v0.1.0 (/home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust) +error: unneeded `return` statement + --> src/lintbait.rs:13:5 + | +13 | return y; + | ^^^^^^^^ + | + = help: for further information visit https://rust-lang.github.io/rust-clippy/rust-1.97.0/index.html#needless_return + = note: `-D clippy::needless-return` implied by `-D warnings` + = help: to override `-D warnings` add `#[allow(clippy::needless_return)]` +help: remove `return` + | +13 - return y; +13 + y + | + +error: could not compile `toolbox` (bin "toolbox") due to 1 previous error +``` + +Read the word `error` there: the same finding is a warning by default and an +error only because of `-D warnings`. The note says so outright — ``-D +clippy::needless-return` implied by `-D warnings``. The gate asserts the lint +*name* (`needless_return`), the diagnostic text (``unneeded `return` +statement``), and the file (`src/lintbait.rs`), never a count of findings. +Counts move whenever a clippy release adds a lint; a specific stable lint's +name and message do not, especially with the channel pinned. + +`clippy.toml` sits beside `rustfmt.toml` and pins the thresholds that decide +what "clean" means: + +```toml +msrv = "1.97.1" +too-many-arguments-threshold = 8 +type-complexity-threshold = 250 +``` + +`msrv` is the interesting one. It tells clippy the minimum Rust version this +crate supports, and clippy *suppresses* lints whose suggested fix would not +compile on that version — the linter refusing to recommend a language feature +you cannot use. With the channel pinned to the same value, MSRV and toolchain +agree by construction here, which is the easy case; in a real crate that +supports a range of versions, this line is what keeps clippy's advice +actionable. + +## `cargo test`: the gate that catches drift first + +The digest test lives in `src/digest.rs`, inside the file it tests, which is +Rust's default and a genuine difference from both siblings — C++ needed a +separate translation unit and Go a separate `_test.go` file: + +```rust +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn fnv1a_matches_cross_language_digest() { + let d = fnv1a(&PAYLOAD); + assert_eq!( + d, + Digest { + fnv: 0x481984990deee5ff + }, + "digest must match the C++/Go toolbox chapters' literal" + ); + } +} +``` + +`#[cfg(test)]` means the module and everything in it are compiled out of the +release binary entirely — the test costs nothing at run time, and `use +super::*` reaches the private items of its parent without any of them being +made `pub` for testing's sake. + +```console +$ cargo test --offline + Compiling toolbox v0.1.0 (/home/rsedor/Dev/linux-systems-programming/examples/48-rust-toolbox/rust) + Finished `test` profile [unoptimized + debuginfo] target(s) in 0.10s + Running unittests src/main.rs (target/debug/deps/toolbox-6b13b413a4fa8296) + +running 1 test +test digest::tests::fnv1a_matches_cross_language_digest ... ok + +test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s +``` + +The gate asserts the named test line and the `test result: ok. 1 passed; 0 +failed` summary, not the process exit code — a `cargo test` run that compiled +zero tests also exits 0, and would sail past a weaker check. + +It is worth seeing the gate fail on purpose, because a gate nobody has +watched fail is a gate nobody knows works. Flipping the payload's last byte +from `0x2e` (`.`) to `0x21` (`!`) in a scratch copy of the crate: + +```console +$ cargo test --offline +running 1 test +test digest::tests::fnv1a_matches_cross_language_digest ... FAILED + +failures: + +---- digest::tests::fnv1a_matches_cross_language_digest stdout ---- + +thread 'digest::tests::fnv1a_matches_cross_language_digest' (480627) panicked at src/digest.rs:43:9: +assertion `left == right` failed: digest must match the C++/Go toolbox chapters' literal + left: Digest { fnv: 5195334935605341822 } + right: Digest { fnv: 5195329438047200767 } +note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace + + +failures: + digest::tests::fnv1a_matches_cross_language_digest + +test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s +``` + +One byte, and `assert_eq!` prints both sides in decimal because that is how +`Digest`'s derived `Debug` formats a `u64`. `5195329438047200767` is +`0x481984990deee5ff` — the identical decimal Chapter 47's `delve` gate +printed when it read the Go struct's field out of a live process. Two +languages, two entirely different tools, one number. + +This is also why the test gate is separate from the report gate rather than +redundant with it. Both assert the same literal, but they fail at different +times and say different things: `cargo test` fails at check time with both +values in front of you, while `toolbox report` fails only once someone runs +the binary and compares output. Drift gets caught in the cheaper place first. + +## How the code works + +`main.rs`'s dispatch is a `match` on the first argument, and the `lintbait` +arm is compiled in only when the feature is: + +```rust +fn main() { + let mut args = std::env::args().skip(1); + match args.next().as_deref() { + Some("report") => cmd_report(), + #[cfg(feature = "lintbait")] + Some("lintbait") => { + let doubled = lintbait::trip_needless_return(21); + println!("toolbox lintbait: doubled={doubled}"); + } + _ => { + print_usage(); + std::process::exit(2); + } + } +} +``` + +`args.next().as_deref()` is the idiom worth naming: `std::env::args()` yields +owned `String`s, and matching a `String` against the literal `"report"` +requires a `&str`. `as_deref()` turns the `Option` into an +`Option<&str>` without cloning, so the match arms can be plain string +literals. Attribute-on-a-match-arm is legal Rust and does exactly what it +looks like — with the feature off, that arm does not exist, and the +`lintbait` argument falls through to `print_usage()` and exit 2. + +`cmd_report` is the deterministic half: + +```rust +fn cmd_report() { + let d = fnv1a(&PAYLOAD); + println!( + "toolbox report: payload_len={} digest=0x{:016x}", + PAYLOAD.len(), + d.fnv + ); +} +``` + +`{:016x}` — zero-padded to sixteen hex digits — is the formatting detail that +makes the output a stable string to assert on. Without the `016`, a digest +whose top nibble happened to be zero would print fifteen characters and the +literal comparison would fail for a reason that has nothing to do with the +hash being wrong. + +The rest of the crate is the gate scaffolding, and each piece is isolated +from the digest by a *different* mechanism, on purpose: `src/lintbait.rs` by +a Cargo feature (not compiled unless asked), `fixtures/misformatted.rs` by +module-tree exclusion (not part of the crate at all), and `digest.rs`'s test +module by `#[cfg(test)]` (not in the release binary). Nothing about running +`toolbox report` can depend on whether any designed-for finding has or has +not been "fixed." + +{% include excalidraw.html + file="48-rust-tool-gates" + alt="One Rust crate box splits into two gate lanes. The amber hard lane lists the rustup pin at channel 1.97.1 and edition 2024, the FNV-1a digest gate at 0x481984990deee5ff, cargo fmt --check clean on tracked sources and nonzero on the fixture, cargo clippy -D warnings with --features lintbait naming needless_return, and cargo test asserting the digest literal -- all running offline from the pinned toolchain alone because rustfmt and clippy ship as toolchain components. A dashed ghost lane beside it lists cargo-nextest, cargo-deny with its deny.toml, cargo-llvm-cov asserting a filename, and cargo-audit marked advisory-db slash network, plus cargo-watch, cargo-flamegraph, and sccache marked not gated, all shown as reference and not verified on this host." + caption="Figure 48.2 — one crate, two gate lanes: the pinned-toolchain hard gates (rustup pin, digest, cargo fmt, cargo clippy, cargo test) that need no cargo install, beside the gated-if-present tools (cargo-nextest, cargo-deny, cargo-llvm-cov, cargo-audit) and the shown-not-gated accelerators (cargo-watch, cargo-flamegraph, sccache)" %} + +## Errors, three ways + +With one language and no second compiler to disagree with itself, "three +ways" here means three surfaces reading the same source, each willing to +read a different amount of context before it says anything — and, in Rust's +case, each one *promoting a different severity* into a failure. + +The first surface is `rustfmt`, and it notices only shape. `misformatted.rs` +is not wrong in any semantic sense; `classify` returns the correct string for +every input. `rustfmt` still exits 1, because shape is the entire question it +answers, and it answers it by rewriting rather than by judging. There is no +severity to promote: a formatter's finding is binary. + +The second surface is `clippy`, which reads idiom — patterns the compiler +accepts and a Rust programmer would not write. `return y;` is the whole +example, and the interesting part is that clippy's default verdict is +*warning*, not error. The severity is a policy decision the invoker makes, and +`-D warnings` is where that decision gets made: + +```console + = note: `-D clippy::needless-return` implied by `-D warnings` +``` + +This is a genuinely different model from the other two chapters. `go vet`'s +printf finding is reported at one fixed severity; a C++ compiler warning +becomes an error only via `-Werror` at build-configuration time. Rust splits +the linter from the compiler and then lets the *caller* set the threshold per +invocation — so a developer's inner loop can run clippy at warning level and +CI can run the identical command with `-D warnings` and get a hard failure, +with no second configuration to keep in sync. + +The third surface is `cargo test`, and it is the only one that runs the code. +`assert_eq!` does not read shape or idiom; it reads *behavior*, and the +failure it produces is a panic with both values printed. Nothing static could +have caught a wrong payload byte — the code is well-formatted, idiomatic, and +type-correct with `0x21` in it. Only executing `fnv1a` and comparing the +result finds it. + +Rust also draws a line the other two chapters do not have to: `Result` versus +panic. `toolbox` has no `Result` in it, which is itself the design decision — +the report path has nothing that can fail (a fixed array, an infallible hash, +a `println!`), so introducing a `Result` would be inventing an error case to +have one. The panics that do appear are all in test code, where a panic *is* +the reporting mechanism. Chapter 5 — the book's own "Errors, three ways" — +and Chapter 43 cover `Result` propagation and `?` at length for code that has +real fallible I/O; a tooling chapter's +contribution is the opposite observation — that a deterministic gate should +have no error paths to test, because every branch it does not have is a +branch that cannot drift. + +## Concurrency lens + +The concurrency in this chapter belongs to the *tools*, not to `toolbox`, +which is strictly single-threaded. Three layers of it are worth naming, and +Rust's tooling makes a choice at each one that differs from Go's. + +The first is the build graph. `cargo` parallelizes across crates by default — +`-j` defaults to the CPU count, 16 on this host — which is why a +zero-dependency crate builds in well under a second and a crate with a deep +dependency tree does not. That default is also why a lockfile matters for +reproducibility but not for speed: the graph's *shape* is fixed by +`Cargo.lock`, and cargo walks it as wide as the machine allows. Inside a +single crate, `rustc` parallelizes differently again, by splitting the crate +into codegen units (16 in the release profile by default, 1 under +`lto = "fat"`), which trades compile time against optimization quality — the +same trade `mold` and `ccache` addressed from the outside in Chapter 46, made +from the inside here. + +The second is the test harness. `cargo test` builds one test binary and +libtest runs the `#[test]` functions **in threads, inside that one process**, +as wide as the CPU count unless told otherwise: + +```console +$ cargo test --offline -- --test-threads=1 +running 1 test +test digest::tests::fnv1a_matches_cross_language_digest ... ok + +test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s +``` + +`--test-threads=1` exists because that thread-per-test model has real +consequences for systems code specifically. Tests sharing a process share +`errno`-adjacent global state, the signal-disposition table, the file +descriptor table, the current working directory, and the process's own +`rlimit`s — so a test that installs a signal handler, `chdir`s, or exhausts +FDs can change the result of a test running concurrently beside it. Every one +of those is something the earlier parts of this book taught you to reach for. +`cargo test -- --test-threads=1` is the blunt fix, at the cost of all +parallelism. + +`cargo-nextest` is the third layer, and it is the reason it appears in this +chapter's tool list at all: it runs **each test in its own process**. That +turns process-global state from a shared hazard into per-test isolation for +free, and it means a test that segfaults or `abort()`s takes down only itself +rather than the whole run — which for a book full of `mmap`, signal, and +`rlimit` examples is not a marginal benefit. The cost is process-spawn +overhead per test, which matters for thousands of microsecond-scale unit +tests and does not matter here. Go made the opposite structural choice — +one process per *package*, tests within a package sharing it — and Chapter +47's `b.RunParallel` benchmark lived entirely inside that shared process. Same +problem, two different places to put the isolation boundary. + +## The gated-if-present tier: `cargo-nextest`, `cargo-deny`, `cargo-llvm-cov`, `cargo-audit` + +None of these four ships with the toolchain; each is a `cargo install`. On +this reference host, `cargo-nextest`, `cargo-deny`, and `cargo-llvm-cov` are +absent and `cargo-audit` is present but has no advisory database, and this +iteration's decision was to install nothing and fetch nothing. So all four +are **shown as reference, not verified** — `verify.lua` prints an +informational `SKIP:` for each rather than failing. What *is* committed is +the configuration, because that is the durable artifact: a reader who runs +`cargo install cargo-deny` gets a working gate with no further authoring. + +`cargo nextest run` would name the test and print its own summary +(`1 test run: 1 passed`); the gate asserts those tokens, not an exit code. + +`deny.toml` is the substantial one. Its offline-answerable checks — `bans`, +`licenses`, `sources` — are answerable from `Cargo.lock` alone, which is why +those three are the subsets the gate would run: + +```toml +[licenses] +# toolbox is zero-dependency, so this list constrains exactly one crate: +# toolbox itself. That is the point -- the policy is in place before the +# first dependency arrives, not bolted on after. +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Unicode-3.0", +] +confidence-threshold = 0.93 + +[bans] +multiple-versions = "deny" +wildcards = "deny" +highlight = "all-duplicates" +``` + +`multiple-versions = "deny"` is the line that earns its place in a systems +crate: Cargo will happily link two semver-incompatible versions of the same +crate into one binary, which for a crate wrapping a C library or holding a +global registry means two independent copies of state that both think they +are the only one. `wildcards = "deny"` forbids `version = "*"` dependencies, +which is how a lockfile-clean build turns into a different build next week. +`cargo deny check advisories` is deliberately *not* in the gated subset: +it needs the RustSec database cloned into `~/.cargo/advisory-db`, a network +fetch this example refuses to make. + +`cargo llvm-cov --summary-only` is the coverage tool, and the gate that would +run it asserts a **filename** — that `digest.rs` appears in the summary — +never a percentage. A percentage moves every time a line is added to the +crate, so gating on one produces failures that have nothing to do with the +toolchain. It also needs `rustup component add llvm-tools`, per the pin +discussion above. + +`cargo audit` is the network-shaped one, and it gets a *double* guard in +`verify.lua` — on the binary and on the database: + +```lua +if not tool_present("cargo-audit") then + print("SKIP: cargo-audit not found on PATH -- gate H not asserted") +elseif checks.run("test -d \"$HOME/.cargo/advisory-db\"").exit ~= 0 then +``` + +Without the second check this host would *pass* the tool test and then have +`cargo audit` clone the RustSec database mid-verification — turning a +network outage into a test failure, and an offline example into an online +one. What a real finding looks like, shown here as clearly-labeled +**illustrative** output rather than a captured run, since this crate has no +vulnerable dependency by design and none will be committed: + +``` +Crate: some-crate +Version: 0.4.1 +Title: Use-after-free in some-crate +Date: 2026-03-11 +ID: RUSTSEC-2026-0031 +URL: https://rustsec.org/advisories/RUSTSEC-2026-0031 +Severity: 7.5 (high) +Solution: Upgrade to >=0.4.3 +``` + +The durable token there is the `RUSTSEC-YYYY-NNNN` identifier — stable, +citable, and the thing a policy actually references. Chapter 47 made the same +call for `govulncheck` and for the same two reasons: network, and no +committed vulnerability. + +## Shown, not gated: `cargo-watch`, `cargo-flamegraph`, `sccache` + +Three tools round out a working Rust setup and none of them is asserted, +each for a different reason worth stating rather than hiding. + +`cargo watch -x 'clippy --all-targets -- -D warnings'` re-runs the lint gate +on every save. It is the inner-loop counterpart to the CI gate — the same +command, run continuously — and it is not gated because it never terminates. +A check that never returns is not a check. + +`cargo flamegraph --bin toolbox -- report` produces an SVG of where CPU time +went. It needs `perf`, which needs `kernel.perf_event_paranoid` lowered or +root, and it produces output that differs run to run by construction. Chapter +31 already ran `cargo-flamegraph` for real against a Rust binary and taught +how to read the result, and Chapter 26 hit the `perf_event_paranoid=2` +privilege wall head-on; the reason it is not gated *here* is the same reason +Chapter 46 did not gate `ccache` — sampling output is not a deterministic +assertion. + +`sccache` caches compilation artifacts across builds +(`RUSTC_WRAPPER=sccache`). It is a pure accelerator: a correct build and a +correct cached build produce identical output, so there is nothing about +correctness to assert. Its own metric — cache hit rate — depends on what you +compiled five minutes ago, which is exactly the kind of number this book +refuses to gate on. `ccache` and `mold` got the same treatment in Chapter 46. + +**miri** deserves a pointer rather than a section: it interprets Rust at the +MIR level and catches undefined behavior in `unsafe` code that no amount of +formatting, linting, or testing will. It is not re-taught here because +Chapters 29 and 43 already own it, and `toolbox` has no `unsafe` block for it +to find anything in — which is the correct reason to omit a tool, as opposed +to omitting it because it is inconvenient. + +## Build, run, observe + +Everything below runs on the host, offline, with no `cargo install` and no +VM: + +```bash +[host]$ cd examples/48-rust-toolbox +[host]$ ./demo.sh rust build # zero-dep, --offline, no network +[host]$ ./demo.sh rust run report # digest=0x481984990deee5ff + +[host]$ cd rust +[host]$ rustup show # "active because: overridden by ...rust-toolchain.toml" +[host]$ cargo tree --offline # exactly one node +[host]$ cargo fmt --check # silent, exit 0 +[host]$ rustfmt --edition 2024 --check fixtures/misformatted.rs # diff, exit 1 +[host]$ cargo clippy --offline --all-targets -- -D warnings # clean +[host]$ cargo clippy --offline --features lintbait --all-targets -- -D warnings +[host]$ cargo test --offline # the named digest test +``` + +And the gate itself: + +```console +$ cd examples/48-rust-toolbox +$ LSP_LANG=rust REPO_ROOT=$(cd ../.. && pwd) lua verify.lua +ok: rust: cargo build --offline succeeds (zero-dep, no network) +ok: rust-toolchain.toml: pins channel 1.97.1 +ok: rust-toolchain.toml: pins the rustfmt + clippy components +ok: Cargo.toml: sets edition 2024 +ok: rust: rustc --version runs through the pin +ok: rust: the pin really resolves -- rustc reports 1.97.1 +ok: rust: toolbox report runs +ok: rust: toolbox report equals the expected literal (matches ch46's C++ and ch47's Go digest) +ok: rust: cargo fmt --check exits 0 on the crate's module tree +ok: rust: cargo fmt --check prints no diff for tracked sources +ok: rust: rustfmt --check exits nonzero on the misformatted fixture +ok: rust: rustfmt --check prints a diff naming the fixture +ok: rust: the diff shows the reformatted signature rustfmt would write +ok: rust: cargo clippy --all-targets -- -D warnings is clean on the default build +ok: rust: the clean clippy run really checked the crate (cargo reports Finished) +ok: rust: clippy --features lintbait fails under -D warnings +ok: rust: clippy names the stable needless_return lint +ok: rust: clippy emits the needless_return diagnostic text +ok: rust: the finding is located in src/lintbait.rs +ok: rust: cargo test succeeds +ok: rust: the named digest test runs and passes +ok: rust: cargo test reports the summary line, not just exit 0 +SKIP: cargo-nextest not found on PATH -- gate E not asserted +SKIP: cargo-deny not found on PATH -- gate F not asserted +SKIP: cargo-llvm-cov not found on PATH -- gate G not asserted +SKIP: ~/.cargo/advisory-db absent (offline; cargo-audit would fetch it) -- gate H not asserted +info: cargo-watch, cargo-flamegraph and sccache are shown in the chapter but not gated (interactive / needs perf privileges / cache-hit-rate is not a correctness property) +info: miri is not re-taught here -- ch29 and ch43 own it +PASS 20 / FAIL 0 +``` + +Four `SKIP:` lines, no failures. That is the shape a gated-if-present tier is +supposed to have: the absent tools are named, in the output, where nobody can +mistake "not run" for "passed." + +## Cross-check: the same digest, three languages apart + +Three chapters, three languages, three completely unrelated toolchains, one +16-byte payload: + +```console +$ examples/46-cpp-toolbox/cpp/build/release/toolbox report +toolbox report: label=[toolbox] report payload_len=16 digest=0x481984990deee5ff +$ examples/47-go-toolbox/go/bin/toolbox report +toolbox report: payload_len=16 digest=0x481984990deee5ff +$ examples/48-rust-toolbox/rust/target/release/toolbox report +toolbox report: payload_len=16 digest=0x481984990deee5ff +``` + +(The C++ line carries an extra `label=[toolbox]` field from Chapter 46's +argument-echo demo; the `payload_len` and `digest` fields are identical +across all three.) + +FNV-1a is language-independent — a shift, an xor, and a multiply modulo +2⁶⁴ — so nothing about that agreement is surprising *in principle*. What +makes it worth printing is that agreeing in practice required each chapter to +have gotten a different language-specific detail right: C++ needed +`uint64_t`'s defined wrapping and a `-fsanitize=undefined` build that did not +trip on it, Go needed the untyped-constant rules not to promote the FNV prime +into something wider, and Rust needed `wrapping_mul` so a debug build would +not panic where release wraps. Three different ways to get modular arithmetic +wrong, three different tools that would have caught it, one number that says +none of them did. + +## Where this sits next to the book's other tooling chapters + +Part 13 covers tooling in four chapters and this is the last of them, so the +arc is worth naming explicitly. Chapter 45 handled the *analysis suites* — +tools that observe a running system from outside it. Chapters 46, 47, and 48 +each took one language and pointed its whole toolchain at one small binary, +and the interesting result is how differently the three languages distribute +the same responsibilities: + +- **C++ (ch46)** puts almost nothing in the language distribution. CMake, + Conan, clang-tidy, clang-format, the sanitizers, gdb, ccache, and mold are + eight separate projects with eight separate versions, and `CMakePresets.json` + exists to make "which of these, configured how" an explicit, committed + choice. The chapter's parity gate — GCC and clang producing byte-identical + output — is a check the other two languages have no reason to run. +- **Go (ch47)** puts the compiler, the formatter, the vetter, the test + runner, the profiler, and the generator inside one `go` binary, and pins + that binary's version in `go.mod`. What it leaves outside — gofumpt, + golangci-lint, staticcheck, delve, benchstat — is precisely what Chapter 47 + had to gate as if-present. +- **Rust (ch48)** pins a *toolchain* rather than a binary, and that toolchain + includes the formatter and the linter as components. The consequence is + this chapter's structure: the hard, offline core covers formatting and + linting, which Chapter 47's could not, while the if-present tier is a + different set of tools entirely (nextest, deny, llvm-cov, audit) — every + one of them a `cargo install` rather than a component. + +Chapter 31 sits underneath all three: it ran each language's *profiling* +toolbelt — `perf` for C++, the `pprof` ecosystem for Go, `cargo-flamegraph` +and clippy for Rust — against one shared workload, which is why these three +chapters could concentrate on the build-and-check side instead of re-teaching +how to read a flamegraph. + +The dependency and supply-chain story splits the same way. C++ needed Conan +lockfiles to have a dependency graph worth checking at all; Go's module +system makes the graph free and `govulncheck` the tool that reads it; Rust +gets the graph free too and splits the reading in two — `cargo-deny` for +policy answerable from the lockfile, `cargo-audit` for the RustSec advisory +database over the network. Chapters 47 and 48 made the identical call about +that network half: show it, name the durable identifier, never gate it. + +## What you learned + +- **`rust-toolchain.toml` pins more than a compiler.** `channel` fixes the + release; `components` fixes which of that release's artifacts get + installed. Because `rustfmt` and `clippy` are components, pinning the + channel pins the formatter and the linter at the same commit as `rustc` — + which is why this chapter's format and lint gates are hard and offline + where Chapter 47's equivalents could not be. +- **`rustup show` states the override.** `active because: overridden by + '…/rust-toolchain.toml'` is the mechanism reported by the tool, and it + disappears one directory outside the crate. +- **Do not pin components you do not need.** `rustup` fetches missing + components over the network on the first `cargo` invocation, so an + aspirational `llvm-tools` in `components` silently breaks + `cargo build --offline`. Document `rustup component add` instead. +- **A format gate needs both directions.** Clean on the tree *and* loud on a + known-dirty file. In Rust the dirty file isolates for free: a `.rs` file no + `mod` declares is not part of the crate, so nothing but an explicit + per-file `rustfmt` invocation ever reads it. +- **A lint gate needs both directions too, and a Cargo feature is the clean + way to get them.** `#[allow]` on the bait destroys the gate; leaving the + bait in the default build destroys the clean half. `#[cfg(feature = + "lintbait")]` keeps both. +- **`-D warnings` is where severity is decided, per invocation.** Clippy's + findings are warnings by default; the caller promotes them. The inner loop + and CI can run the identical command at different thresholds with no second + config to keep in sync. +- **Assert the lint name and the diagnostic text, never a finding count.** + Counts move with every clippy release; a stable lint's name does not, + especially with the channel pinned. +- **`wrapping_mul`, not `*`.** Rust panics on overflow in debug and wraps in + release, so an algorithm defined modulo 2⁶⁴ has to say so — otherwise + `cargo test` and the release binary disagree. +- **Gate on the summary line, not the exit code.** `cargo test` with zero + tests compiled also exits 0. `test result: ok. 1 passed; 0 failed` does not. +- **`cargo test` runs tests in threads inside one process; `cargo-nextest` + runs each in its own.** For systems code that touches signal dispositions, + the FD table, the CWD, or `rlimit`s, that difference is the whole reason to + reach for nextest — or for `--test-threads=1`. +- **Guard a network-shaped gate on the data, not just the binary.** + `cargo-audit` present with no `~/.cargo/advisory-db` would silently clone + the RustSec database mid-verification. Two guards, one skip. +- **Say which tools did not run, in the output.** Four `SKIP:` lines beside + `PASS 20 / FAIL 0` is the shape that keeps "absent" from reading as + "passed." + +--- + +

verified — on the Fedora 44 +reference host this session (kernel 7.1.5-201.fc44, rustc/cargo 1.97.1 via +rustup, clippy 0.1.97, rustfmt 1.9.0-stable, offline, no network access +used): LSP_LANG=rust REPO_ROOT=$(cd ../.. && pwd) lua verify.lua +reported PASS 20 / FAIL 0, and +python3 scripts/test-all-examples.py --only 48-rust-toolbox +reported 1 passed, 0 failed, 0 skipped. Confirmed live and +folded into that PASS count, the pinned-toolchain hard gates A-D: +rustup show reported active because: overridden by +'…/examples/48-rust-toolbox/rust/rust-toolchain.toml' while +rustup show active-toolchain outside the crate reported +stable-x86_64-unknown-linux-gnu (default); +rust-toolchain.toml pins channel = "1.97.1" with +components = ["rustfmt", "clippy"] and Cargo.toml +sets edition = "2024"; rustc --version resolved +through the pin to rustc 1.97.1 (8bab26f4f 2026-07-14); +cargo tree --offline printed exactly one node; +./demo.sh rust run report printed toolbox report: +payload_len=16 digest=0x481984990deee5ff, byte-identical to Chapter +46's C++ and Chapter 47's Go digest; cargo fmt --check exited 0 +with no output while rustfmt --edition 2024 --check +fixtures/misformatted.rs exited 1 with the diff quoted above; +cargo clippy --offline --all-targets -- -D warnings exited 0 +clean and --features lintbait failed with unneeded +`return` statement at src/lintbait.rs:13:5 naming +needless_return; and cargo test --offline reported +test result: ok. 1 passed; 0 failed. The drift transcript in the +cargo test section is also a real run, taken on a scratch copy +of the crate with the payload's last byte changed from 0x2e to +0x21. Not exercised: unverified — cargo-nextest, +cargo-deny, cargo-llvm-cov, and sccache +are absent from this reference host (confirmed by command -v for +each) and were not installed, and cargo-audit is present but +~/.cargo/advisory-db is absent, so gates E, F, G, and H each +printed an informational SKIP: rather than running; their +sections above show the committed configs (deny.toml, +clippy.toml) and the exact tokens (1 test run: 1 +passed, bans ok, a digest.rs coverage row, a +RUSTSEC-YYYY-NNNN identifier) a reader with those tools installed +would see, rather than a captured run. The cargo audit advisory +block is explicitly labeled illustrative: this crate is zero-dependency by +design and no vulnerable dependency will be committed to it. +cargo-watch and cargo-flamegraph are installed on +this host but deliberately not gated (never terminates / needs +perf privileges and produces non-deterministic output), and +sccache's cache-hit rate is not a correctness property; miri is +cross-referenced to Chapters 29 and 43 and has no unsafe block +here to examine. examples/manifest.yaml marks this example +mode: local — no VM or LGTM path applies.

diff --git a/_plans/r17-ch48-plan.md b/_plans/r17-ch48-plan.md new file mode 100644 index 0000000..e370669 --- /dev/null +++ b/_plans/r17-ch48-plan.md @@ -0,0 +1,133 @@ +--- +title: "r17 / ch48 — rust-toolbox — plan (internal)" +published: false +--- + +# r17 ch48 — example `48-rust-toolbox` + chapter + 2 diagrams (lgtm-relay Phase 1) + +Rust analog of ch46/ch47. Single-language `langs: [rust]`, `mode: local`. Part 13 "Appendices: Tooling" (FINAL ch of Part 13). +Same "every gate asserts a real effect, never exit-0" contract. + +## Host audit +PRESENT: rustup, cargo/rustc 1.97.1, clippy 0.1.97, rustfmt 1.9.0, cargo-audit 0.20.0, cargo-watch, cargo-flamegraph. +ABSENT: cargo-nextest, cargo-deny, cargo-llvm-cov, sccache, miri. `~/.cargo/advisory-db` ABSENT (audit/deny need network). +KEY ASYMMETRY vs ch47: **clippy + rustfmt are pinned rust-toolchain.toml components → HARD-gateable** (present, like gofmt ships with go). + +## Approach +One zero-dep binary crate `toolbox` (edition 2024, channel 1.97.1 via committed rust-toolchain.toml), offline default build. +`report` subcommand → FNV-1a digest over the SAME ch46/ch47 16-byte payload → `digest=0x481984990deee5ff` (cross-appendix +easter egg across all 3 languages). Also a #[cfg(test)] unit test asserting the literal. + +### Gate tiers +- **A HARD** rustup/pin + digest: `rustc --version` has 1.97.1; Cargo.toml edition="2024"; report == literal. +- **B HARD** rustfmt: `cargo fmt --check` 0 on tracked; `rustfmt --edition 2024 --check fixtures/misformatted.rs` nonzero. +- **C HARD** clippy: `cargo clippy --all-targets -- -D warnings` 0 clean; `cargo clippy --features lintbait -- -D warnings` + nonzero + names stable token `needless_return`. +- **D HARD** cargo test: named digest test → `fnv1a` test + `test result: ok` (test asserts digest literal → drift fails). +- **E gated-if-present** cargo-nextest: `cargo nextest run` names test + PASS (absent → SKIP). +- **F gated-if-present** cargo-deny: committed deny.toml; `cargo deny check bans licenses sources` (offline subsets) token. +- **G gated-if-present** cargo-llvm-cov: `--summary-only` → assert covered FILENAME (digest.rs), never a %. +- **H gated-if-present + network-guarded** cargo-audit: present but advisory-db absent → run only if db present/fetched; + assert `0 vulnerabilities`/`Loaded N advisories` token on clean crate; else SKIP + illustrative prose. +- cargo-watch / cargo-flamegraph / sccache: SHOWN-NOT-GATED (interactive / needs perf+root / non-deterministic). +- miri: CROSS-REF ONLY (ch43/ch29 own it; do not re-teach). + +verify.lua HARD-gates A-D only; E-H tool_present() skip-if-present informational SKIP (never checks.skip/abort/FAIL). + +### cargo-audit network decision (like ch47 govulncheck) +Main crate zero-dep (clean contrast). Real advisory hit = isolated non-member `rust/audit-vuln/` sub-crate pinning a +RUSTSEC-YYYY-NNNN dep, built ONLY on online opt-in (never default/CI). Offline: audit-vuln/ NOT committed, gate SKIPs, +chapter shows clearly-labeled ILLUSTRATIVE RUSTSEC- advisory (durable token = the RUSTSEC- id). + +### Fixture isolation (Rust) +- rustfmt fixture → `rust/fixtures/misformatted.rs` OUTSIDE module tree (rustfmt per-file, never compiled → can't break build). +- clippy bait → `#[cfg(feature="lintbait")]` module (default build/clippy clean; `--features lintbait` fires needless_return). + +Rejected: real dep (breaks offline); #[allow] the bait (loses clean -D warnings pass); hard-gate absent tools; commit vuln +dep in main crate (isolate); gate coverage % (assert filename); re-teach miri (cross-ref). + +## Steps +S1 scaffold+strip (new-example.sh, delete cpp/go, single-lang demo.sh). BLOCKING. +S2 sources+configs+fixtures under rust/: Cargo.toml(zero-dep, edition 2024, [features] lintbait), Cargo.lock, + rust-toolchain.toml(channel 1.97.1, components rustfmt/clippy/llvm-tools/rust-src), src/main.rs, src/digest.rs + (Digest+kPayload+fnv1a+#[cfg(test)] test), src/lintbait.rs, rustfmt.toml, clippy.toml, deny.toml, fixtures/misformatted.rs, + rust/demo.sh, README.md. (online-only: rust/audit-vuln/ non-member, NOT committed offline.) Depends S1. +S3 verify.lua (A-D hard; E-H skip-if-present; audit db-guarded) + demo contract, LSP_LANG=rust. Depends S2. +S4 build+capture: offline → A-D PASS, E-H SKIP, FAIL 0; pin digest/needless_return/fmt/test tokens. (install-the-4 path only + if user opts in: cargo install nextest/deny/llvm-cov/sccache + fetch advisory-db + build audit-vuln, re-pin tokens.) Depends S3. +S5 chapter _docs/48-rust-toolbox.md. Depends S4. Parallel S6. +S6 2 diagrams (48-rust-toolchain-pipeline Fig48.1, 48-rust-tool-gates Fig48.2) + README rows. Depends S2. Parallel S5. +S7 manifest (langs:[rust], mode:local, timeout 600). After S1. +Collisions: manifest.yaml (S7) + diagrams/README.md (S6) only. + +## Acceptance criteria +1. no cpp/go dir; manifest 48-rust-toolbox langs:[rust] mode:local no requires. +2. ./demo.sh rust build exits 0 NO network (zero-dep). +3. Cargo.toml edition="2024"; rust-toolchain.toml channel="1.97.1"; rustc --version has 1.97.1. +4. `toolbox report` == `...digest=0x481984990deee5ff` (== ch46/ch47); digest.rs unit test asserts same literal. +5. cargo fmt --check 0 on tracked; rustfmt --check fixtures/misformatted.rs nonzero. +6. cargo clippy --all-targets -- -D warnings 0 clean; --features lintbait nonzero + names needless_return. +7. verify.lua PASS N/FAIL 0; A-D real effects (no bare exit-0); E-H fire-with-token OR informational SKIP, never abort/FAIL. +8. cargo-audit gate runs only if tool+db present; audit-vuln/ (if exists) never in default build/CI. +9. front matter part=="Appendices: Tooling"; full spine (Tools-used, Errors-3-ways, Concurrency lens, cross-check, footer). +10. every chapter rust/toml/console block = verbatim substring of source or real transcript. +11. validate.py OK; two Figure 48.x includes; both diagrams catalogued. +12. banned-words clean; Tools-used box == tools exercised; test-all-examples --only 48-rust-toolbox PASS; footer status--verified + reflects A-D (+ any installed tool), explicit status--unverified for tools not run. + +## Risks +toolchain fetch on build if CI lacks 1.97.1 (same pin as ch43, established); audit/deny advisory-db network (db-guard, SKIP +offline); coverage%/flamegraph/sccache non-determinism (filename/prose only); host-missing tools (skip-if-present); clippy +lint/version drift (pin channel, assert lint NAME); fixture leakage (fmt outside tree, bait feature-gated); flamegraph root/perf +(shown-not-gated). + +## Verification outlook (depth gate — 2 scenarios) +Offline baseline STRONGER than ch47: clippy+rustfmt pinned components → present → hard core A-D = pin+digest, rustfmt clean/dirty, +clippy clean+lint-name, cargo test = 5 real gates, NO network. Install-decision affects only E-H + accelerators. +- Scenario 1 OFFLINE HARD-CORE (ch47's chosen path): committed configs + skip-if-present; PASS A-D, SKIP E-H, FAIL 0; + audit illustrative; no audit-vuln committed. Footer: A-D verified; nextest/deny/llvm-cov/audit/sccache/flamegraph/watch unverified. +- Scenario 2 INSTALL-THE-4 (opt-in, network): cargo install nextest/deny/llvm-cov/sccache + advisory-db + build audit-vuln; + E-H fire (nextest PASS, deny token, llvm-cov filename, RUSTSEC-id). Footer near ch46 fullness; only flamegraph/watch shown-not-gated. +Merge-safe either way; verify.lua identical; footer states which optional tools ran. + +## DECISION (user, gate): OFFLINE HARD-CORE + AUTONOMOUS merge. +- NO network, NO cargo install, NO audit-vuln/ sub-crate, NO vulnerable dep committed. +- VERIFIED = A-D hard gates (pin+digest, rustfmt clean/dirty, clippy clean + needless_return, cargo test). +- E-H (nextest/deny/llvm-cov/audit): ship committed configs (deny.toml/clippy.toml/rustfmt.toml) + skip-if-present + gates (absent/db-absent → informational SKIP). Sections shown-as-reference, status--unverified. +- cargo-audit: present on host but advisory-db absent → SKIP offline; chapter shows ILLUSTRATIVE RUSTSEC- advisory. +- verify.lua PASS A-D, SKIP E-H, FAIL 0. +## Status +- [x] S1 - [x] S2 - [x] S3 - [x] S4 - [x] S5 - [x] S6 - [x] S7 - [x] Phase3 - [ ] gate/PR +- PR #17 open (`docs/r17-rust-toolbox` → main), CI green (validate + build-and-deploy both success). + Merge held for one user look at the `llvm-tools` component deviation below, since that decision + post-dates the plan's AUTONOMOUS-merge approval. + +## Execution deltas from the plan +- **`rust-toolchain.toml` components trimmed to `["rustfmt", "clippy"]`.** The planned + `llvm-tools`/`rust-src` entries made rustup fetch a missing component over the network on the + first `cargo` invocation (observed: `info: downloading component llvm-tools`), which breaks the + OFFLINE HARD-CORE decision's `cargo build --offline` claim on a fresh host. Both are now + documented as an explicit `rustup component add` opt-in in the file's comment and in the chapter's + "What is deliberately *not* pinned" subsection. Diagram `48-rust-toolchain-pipeline` (SVG + + .excalidraw) relabelled `rustfmt · clippy components` to match. +- Gate A widened to also assert `rustc --version` == 1.97.1 through the pin (plan had it; recorded + here because it is what proves the pin *resolves*, not merely that the file says so). +- No `defect` subcommand (ch46 UBSan / ch47 divzero analog): "Errors, three ways" is three *static/ + behavioral* surfaces (rustfmt shape → clippy idiom + `-D warnings` severity promotion → `cargo + test` behavior), plus the deliberate no-`Result` design note. A seeded runtime panic would have + duplicated ch47 without adding a Rust-specific observation. +- Concurrency lens = tooling concurrency: cargo build-graph `-j` + release codegen-units, libtest's + thread-per-test model (`--test-threads=1`, captured), and nextest's process-per-test isolation. + +## Gate matrix (host run, 2026-08-04 → 08-07, Fedora 44, kernel 7.1.5-201.fc44, offline) +| gate | result | +| --- | --- | +| `lua verify.lua` (LSP_LANG=rust) | **PASS 20 / FAIL 0**, 4 informational SKIP (E-H) | +| `test-all-examples.py --only 48-rust-toolbox` | 1 passed, 0 failed, 0 skipped | +| `validate.py` | OK | +| chapter source blocks verbatim | 15/15 (16th is the `[host]$` command list) | +| banned words (honest/lie) | clean | +| cross-language digest | cpp/go/rust all `digest=0x481984990deee5ff` (all three binaries re-run) | +| A pin+digest / B rustfmt / C clippy / D cargo test | all fire real effects, both directions | +| E nextest / F deny / G llvm-cov / H audit | SKIP (absent / advisory-db absent) — never FAIL | diff --git a/assets/diagrams/48-rust-tool-gates.excalidraw b/assets/diagrams/48-rust-tool-gates.excalidraw new file mode 100644 index 0000000..db044b6 --- /dev/null +++ b/assets/diagrams/48-rust-tool-gates.excalidraw @@ -0,0 +1,2453 @@ +{ + "type": "excalidraw", + "version": 2, + "source": "https://excalidraw.com", + "elements": [ + { + "id": "r248751820", + "type": "rectangle", + "x": 220, + "y": 40, + "width": 1060, + "height": 230, + "angle": 0, + "strokeColor": "#dddddd", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 668107290, + "versionNonce": 1693626406, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1228691729", + "type": "text", + "x": 232, + "y": 46, + "width": 640.2, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1936076738, + "versionNonce": 1385532833, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "Hard lane \u2014 pinned-toolchain, VERIFIED on this host (rustfmt/clippy ship as toolchain components)", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "Hard lane \u2014 pinned-toolchain, VERIFIED on this host (rustfmt/clippy ship as toolchain components)", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "r840580695", + "type": "rectangle", + "x": 220, + "y": 310, + "width": 1060, + "height": 230, + "angle": 0, + "strokeColor": "#dddddd", + "backgroundColor": "#fafafa", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 729263736, + "versionNonce": 701475781, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t565549660", + "type": "text", + "x": 232, + "y": 316, + "width": 574.2, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 126964016, + "versionNonce": 1973611106, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "Gated-if-present lane \u2014 reader installs; NOT verified on this host (shown as reference)", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "Gated-if-present lane \u2014 reader installs; NOT verified on this host (shown as reference)", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "r1171048697", + "type": "rectangle", + "x": 20, + "y": 235, + "width": 170, + "height": 150, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#111111", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 915579352, + "versionNonce": 1694877907, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t586599199", + "type": "text", + "x": 30, + "y": 243, + "width": 77.0, + "height": 17.5, + "angle": 0, + "strokeColor": "#ffffff", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 369844404, + "versionNonce": 978352273, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rust crate", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rust crate", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t198695666", + "type": "text", + "x": 30, + "y": 263, + "width": 90.75000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 368093216, + "versionNonce": 536821169, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "one source tree", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "one source tree", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t85794651", + "type": "text", + "x": 30, + "y": 278, + "width": 133.10000000000002, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1932667108, + "versionNonce": 1060214434, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "two verification lanes", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "two verification lanes", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1642845861", + "type": "rectangle", + "x": 250, + "y": 110, + "width": 170, + "height": 90, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 582271826, + "versionNonce": 329441976, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t189996442", + "type": "text", + "x": 260, + "y": 118, + "width": 77.0, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 289441061, + "versionNonce": 668023614, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rustup pin", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rustup pin", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t189010747", + "type": "text", + "x": 260, + "y": 138, + "width": 84.7, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 221342461, + "versionNonce": 1798533593, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "channel 1.97.1", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "channel 1.97.1", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1706098482", + "type": "text", + "x": 260, + "y": 153, + "width": 72.60000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 509663168, + "versionNonce": 46818168, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "edition 2024", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "edition 2024", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1221031200", + "type": "rectangle", + "x": 435, + "y": 110, + "width": 190, + "height": 90, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 197531460, + "versionNonce": 602571199, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t269430700", + "type": "text", + "x": 445, + "y": 118, + "width": 84.7, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 946637758, + "versionNonce": 777120006, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "digest gate", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "digest gate", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1048601308", + "type": "text", + "x": 445, + "y": 138, + "width": 78.65, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 960200341, + "versionNonce": 1373124483, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "report FNV-1a", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "report FNV-1a", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1293194382", + "type": "text", + "x": 445, + "y": 153, + "width": 108.9, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1554028285, + "versionNonce": 713997265, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "0x481984990deee5ff", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "0x481984990deee5ff", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r196748463", + "type": "rectangle", + "x": 640, + "y": 110, + "width": 180, + "height": 90, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 613273836, + "versionNonce": 1452205060, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1213670127", + "type": "text", + "x": 650, + "y": 118, + "width": 130.9, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 14177323, + "versionNonce": 562644115, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo fmt --check", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo fmt --check", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t766300873", + "type": "text", + "x": 650, + "y": 138, + "width": 96.80000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1772691852, + "versionNonce": 1997179696, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "clean on tracked", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "clean on tracked", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1957779212", + "type": "text", + "x": 650, + "y": 153, + "width": 108.9, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1661399127, + "versionNonce": 1855234608, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "nonzero on fixture", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "nonzero on fixture", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1203153390", + "type": "rectangle", + "x": 835, + "y": 110, + "width": 225, + "height": 90, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1778373572, + "versionNonce": 1879303157, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1527475717", + "type": "text", + "x": 845, + "y": 118, + "width": 184.8, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1914591538, + "versionNonce": 375493929, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo clippy -D warnings", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo clippy -D warnings", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1692760565", + "type": "text", + "x": 845, + "y": 138, + "width": 114.95, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 825928190, + "versionNonce": 611590579, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "--features lintbait", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "--features lintbait", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1413210105", + "type": "text", + "x": 845, + "y": 153, + "width": 127.05000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1744112975, + "versionNonce": 1963328729, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "names needless_return", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "names needless_return", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1387836340", + "type": "rectangle", + "x": 1075, + "y": 110, + "width": 175, + "height": 90, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1142065233, + "versionNonce": 1902050111, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1635629470", + "type": "text", + "x": 1085, + "y": 118, + "width": 77.0, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 959975901, + "versionNonce": 1307464936, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo test", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo test", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t496037311", + "type": "text", + "x": 1085, + "y": 138, + "width": 151.25, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 242810185, + "versionNonce": 1937136904, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "digest.rs asserts literal", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "digest.rs asserts literal", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1642324665", + "type": "text", + "x": 1085, + "y": 153, + "width": 90.75000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1352763872, + "versionNonce": 933363542, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "test result: ok", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "test result: ok", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1492012589", + "type": "rectangle", + "x": 250, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1926129193, + "versionNonce": 187074913, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t198620195", + "type": "text", + "x": 260, + "y": 388, + "width": 100.10000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1353247702, + "versionNonce": 1559504707, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-nextest", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-nextest", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t295779533", + "type": "text", + "x": 260, + "y": 408, + "width": 66.55000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1066967915, + "versionNonce": 472994116, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "nextest run", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "nextest run", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1725524276", + "type": "text", + "x": 260, + "y": 423, + "width": 102.85000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 920500409, + "versionNonce": 1923375242, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "named test + PASS", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "named test + PASS", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1801311726", + "type": "rectangle", + "x": 391, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 738768968, + "versionNonce": 362673837, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t92336809", + "type": "text", + "x": 401, + "y": 388, + "width": 77.0, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1044237851, + "versionNonce": 1086440242, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-deny", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-deny", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t720345128", + "type": "text", + "x": 401, + "y": 408, + "width": 54.45, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 857662162, + "versionNonce": 1403044702, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "deny.toml", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "deny.toml", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t779378798", + "type": "text", + "x": 401, + "y": 423, + "width": 102.85000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1237926091, + "versionNonce": 765240795, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "bans/licenses/src", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "bans/licenses/src", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r273166689", + "type": "rectangle", + "x": 532, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 557204594, + "versionNonce": 1171847074, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1650810436", + "type": "text", + "x": 542, + "y": 388, + "width": 107.80000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 989151856, + "versionNonce": 403981203, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-llvm-cov", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-llvm-cov", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t209923366", + "type": "text", + "x": 542, + "y": 408, + "width": 84.7, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 627714830, + "versionNonce": 1286673038, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "--summary-only", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "--summary-only", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1805488980", + "type": "text", + "x": 542, + "y": 423, + "width": 96.80000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1532451276, + "versionNonce": 579340183, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "asserts filename", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "asserts filename", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1083812689", + "type": "rectangle", + "x": 673, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 971620032, + "versionNonce": 1637477783, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1494226830", + "type": "text", + "x": 683, + "y": 388, + "width": 84.7, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1492787867, + "versionNonce": 1259988229, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-audit", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-audit", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1468828448", + "type": "text", + "x": 683, + "y": 408, + "width": 114.95, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 393178386, + "versionNonce": 517489318, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "advisory-db/network", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "advisory-db/network", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1474349744", + "type": "text", + "x": 683, + "y": 423, + "width": 102.85000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1362929465, + "versionNonce": 1493835783, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "0 vulnerabilities", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "0 vulnerabilities", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1342892810", + "type": "rectangle", + "x": 814, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1343465166, + "versionNonce": 1436015857, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t649928179", + "type": "text", + "x": 824, + "y": 388, + "width": 84.7, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1965224840, + "versionNonce": 268780268, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-watch", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-watch", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t93748537", + "type": "text", + "x": 824, + "y": 408, + "width": 114.95, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1303445212, + "versionNonce": 1687211939, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "interactive rebuild", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "interactive rebuild", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1536629441", + "type": "text", + "x": 824, + "y": 423, + "width": 54.45, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 602081745, + "versionNonce": 356648560, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "not gated", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "not gated", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r972826516", + "type": "rectangle", + "x": 955, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 61194724, + "versionNonce": 156452798, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t364953438", + "type": "text", + "x": 965, + "y": 388, + "width": 123.20000000000002, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 738194421, + "versionNonce": 1645844878, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-flamegraph", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-flamegraph", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t118743651", + "type": "text", + "x": 965, + "y": 408, + "width": 90.75000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1672329404, + "versionNonce": 1131525658, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "needs perf/root", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "needs perf/root", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1293285887", + "type": "text", + "x": 965, + "y": 423, + "width": 54.45, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1394393302, + "versionNonce": 1756313471, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "not gated", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "not gated", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r659016583", + "type": "rectangle", + "x": 1096, + "y": 380, + "width": 130, + "height": 90, + "angle": 0, + "strokeColor": "#999999", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1373348360, + "versionNonce": 1548064926, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t289053635", + "type": "text", + "x": 1106, + "y": 388, + "width": 53.900000000000006, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 487302260, + "versionNonce": 1911736901, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "sccache", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "sccache", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t638540543", + "type": "text", + "x": 1106, + "y": 408, + "width": 84.7, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1723735991, + "versionNonce": 1904110964, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "compiler cache", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "compiler cache", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t536845031", + "type": "text", + "x": 1106, + "y": 423, + "width": 54.45, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 625645041, + "versionNonce": 387502979, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "not gated", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "not gated", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "a42151223", + "type": "arrow", + "x": 190, + "y": 270, + "width": 60, + "height": 115, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 462853832, + "versionNonce": 1615394840, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 60, + -115 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a1843874971", + "type": "arrow", + "x": 190, + "y": 350, + "width": 60, + "height": 75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1625153768, + "versionNonce": 491423872, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 60, + 75 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a126423575", + "type": "arrow", + "x": 420, + "y": 155, + "width": 15, + "height": 0, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1938477932, + "versionNonce": 1786981186, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 15, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a657667077", + "type": "arrow", + "x": 625, + "y": 155, + "width": 15, + "height": 0, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1801013393, + "versionNonce": 1847743665, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 15, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a174636731", + "type": "arrow", + "x": 820, + "y": 155, + "width": 15, + "height": 0, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1603057539, + "versionNonce": 1090523456, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 15, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a896540312", + "type": "arrow", + "x": 1060, + "y": 155, + "width": 15, + "height": 0, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1044730736, + "versionNonce": 1386537023, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 15, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a424483780", + "type": "arrow", + "x": 380, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1786725475, + "versionNonce": 800608484, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a47946677", + "type": "arrow", + "x": 521, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 278984298, + "versionNonce": 1300776162, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a712823900", + "type": "arrow", + "x": 662, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1854736814, + "versionNonce": 1778980826, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a1861100724", + "type": "arrow", + "x": 803, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 204481080, + "versionNonce": 504432301, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a288432111", + "type": "arrow", + "x": 944, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1320943736, + "versionNonce": 1633160410, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a1747580517", + "type": "arrow", + "x": 1085, + "y": 425, + "width": 11, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "dashed", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1800916086, + "versionNonce": 1078242632, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 11, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "t148984016", + "type": "text", + "x": 220, + "y": 555, + "width": 1023.0000000000001, + "height": 15.0, + "angle": 0, + "strokeColor": "#1d1d1d", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 626797880, + "versionNonce": 216463221, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "Hard lane needs only the pinned toolchain \u2014 rustfmt and clippy ship as rust-toolchain.toml components, so all five gates run offline with no cargo install.", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "Hard lane needs only the pinned toolchain \u2014 rustfmt and clippy ship as rust-toolchain.toml components, so all five gates run offline with no cargo install.", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "t1251017633", + "type": "text", + "x": 220, + "y": 571, + "width": 1168.2, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 849207329, + "versionNonce": 1115324760, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "Gated lane needs `cargo install ` (cargo-audit also needs the advisory-db over network) \u2014 not run on this host; watch/flamegraph/sccache are accelerators shown, not gated.", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "Gated lane needs `cargo install ` (cargo-audit also needs the advisory-db over network) \u2014 not run on this host; watch/flamegraph/sccache are accelerators shown, not gated.", + "lineHeight": 1.25, + "baseline": 12 + } + ], + "appState": { + "viewBackgroundColor": "#ffffff", + "gridSize": null + }, + "files": {} +} \ No newline at end of file diff --git a/assets/diagrams/48-rust-tool-gates.svg b/assets/diagrams/48-rust-tool-gates.svg new file mode 100644 index 0000000..d3d14d3 --- /dev/null +++ b/assets/diagrams/48-rust-tool-gates.svg @@ -0,0 +1,73 @@ + + + +Hard lane — pinned-toolchain, VERIFIED on this host (rustfmt/clippy ship as toolchain components) + +Gated-if-present lane — reader installs; NOT verified on this host (shown as reference) + +rust crate +one source tree +two verification lanes + +rustup pin +channel 1.97.1 +edition 2024 + +digest gate +report FNV-1a +0x481984990deee5ff + +cargo fmt --check +clean on tracked +nonzero on fixture + +cargo clippy -D warnings +--features lintbait +names needless_return + +cargo test +digest.rs asserts literal +test result: ok + +cargo-nextest +nextest run +named test + PASS + +cargo-deny +deny.toml +bans/licenses/src + +cargo-llvm-cov +--summary-only +asserts filename + +cargo-audit +advisory-db/network +0 vulnerabilities + +cargo-watch +interactive rebuild +not gated + +cargo-flamegraph +needs perf/root +not gated + +sccache +compiler cache +not gated + + + + + + + + + + + + +Hard lane needs only the pinned toolchain — rustfmt and clippy ship as rust-toolchain.toml components, so all five gates run offline with no cargo install. +Gated lane needs `cargo install <tool>` (cargo-audit also needs the advisory-db over network) — not run on this host; watch/flamegraph/sccache are accelerators shown, not gated. + \ No newline at end of file diff --git a/assets/diagrams/48-rust-toolchain-pipeline.excalidraw b/assets/diagrams/48-rust-toolchain-pipeline.excalidraw new file mode 100644 index 0000000..ef3827a --- /dev/null +++ b/assets/diagrams/48-rust-toolchain-pipeline.excalidraw @@ -0,0 +1,2059 @@ +{ + "type": "excalidraw", + "version": 2, + "source": "https://excalidraw.com", + "elements": [ + { + "id": "r480166576", + "type": "rectangle", + "x": 20, + "y": 20, + "width": 1160, + "height": 150, + "angle": 0, + "strokeColor": "#dddddd", + "backgroundColor": "#fafafa", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1300229837, + "versionNonce": 1071504895, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t96506229", + "type": "text", + "x": 32, + "y": 26, + "width": 415.8, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 87792688, + "versionNonce": 1940597172, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rust-toolchain.toml \u2192 rustup \u2192 cargo/rustc \u2014 version resolution", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rust-toolchain.toml \u2192 rustup \u2192 cargo/rustc \u2014 version resolution", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "r1843299907", + "type": "rectangle", + "x": 20, + "y": 190, + "width": 580, + "height": 390, + "angle": 0, + "strokeColor": "#dddddd", + "backgroundColor": "#fafafa", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1997152946, + "versionNonce": 578689057, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1794084453", + "type": "text", + "x": 32, + "y": 196, + "width": 495.00000000000006, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 340783494, + "versionNonce": 1239921440, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo run -- report arm \u2014 deterministic digest gate (verified, rust-native)", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo run -- report arm \u2014 deterministic digest gate (verified, rust-native)", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "r456524156", + "type": "rectangle", + "x": 620, + "y": 190, + "width": 560, + "height": 390, + "angle": 0, + "strokeColor": "#dddddd", + "backgroundColor": "#fafafa", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1308272649, + "versionNonce": 835283873, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t41626411", + "type": "text", + "x": 632, + "y": 196, + "width": 396.00000000000006, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1363650586, + "versionNonce": 968561555, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo test arm \u2014 digest.rs unit test (verified, rust-native)", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo test arm \u2014 digest.rs unit test (verified, rust-native)", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "r1699347718", + "type": "rectangle", + "x": 60, + "y": 70, + "width": 190, + "height": 70, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#111111", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 909421185, + "versionNonce": 1801905466, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1633484183", + "type": "text", + "x": 70, + "y": 78, + "width": 146.3, + "height": 17.5, + "angle": 0, + "strokeColor": "#ffffff", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1545282797, + "versionNonce": 1488469697, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rust-toolchain.toml", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rust-toolchain.toml", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t399232598", + "type": "text", + "x": 70, + "y": 98, + "width": 175.45000000000002, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 170556407, + "versionNonce": 1986728579, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "channel 1.97.1 \u00b7 edition 2024", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "channel 1.97.1 \u00b7 edition 2024", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1972794904", + "type": "text", + "x": 70, + "y": 113, + "width": 175.45000000000002, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 121773562, + "versionNonce": 1050016316, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rustfmt \u00b7 clippy components", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rustfmt \u00b7 clippy components", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1161885244", + "type": "rectangle", + "x": 340, + "y": 70, + "width": 210, + "height": 70, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1372966428, + "versionNonce": 605956986, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1733434763", + "type": "text", + "x": 350, + "y": 78, + "width": 46.2, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1152241130, + "versionNonce": 574014921, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "rustup", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "rustup", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t516940840", + "type": "text", + "x": 350, + "y": 98, + "width": 151.25, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 623783669, + "versionNonce": 502486947, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "resolves pinned toolchain", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "resolves pinned toolchain", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1399017680", + "type": "text", + "x": 350, + "y": 113, + "width": 114.95, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 720386539, + "versionNonce": 56521206, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "installs if missing", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "installs if missing", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1611392673", + "type": "rectangle", + "x": 630, + "y": 70, + "width": 220, + "height": 70, + "angle": 0, + "strokeColor": "#2f6db5", + "backgroundColor": "#eef4fb", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1407420653, + "versionNonce": 1267155558, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t132170141", + "type": "text", + "x": 640, + "y": 78, + "width": 100.10000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 362032426, + "versionNonce": 707607157, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo / rustc", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo / rustc", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t797237731", + "type": "text", + "x": 640, + "y": 98, + "width": 40, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 971422176, + "versionNonce": 1322345267, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "1.97.1", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "1.97.1", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1133664779", + "type": "text", + "x": 640, + "y": 113, + "width": 169.4, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 598962301, + "versionNonce": 1676429983, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "drives build/test/fmt/clippy", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "drives build/test/fmt/clippy", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r509122234", + "type": "rectangle", + "x": 60, + "y": 235, + "width": 230, + "height": 60, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1424341394, + "versionNonce": 642630710, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1898417170", + "type": "text", + "x": 70, + "y": 243, + "width": 146.3, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1186643194, + "versionNonce": 842379079, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo run -- report", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo run -- report", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1969232101", + "type": "text", + "x": 70, + "y": 263, + "width": 114.95, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1348656005, + "versionNonce": 127046669, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "deterministic build", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "deterministic build", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r283993656", + "type": "rectangle", + "x": 60, + "y": 330, + "width": 230, + "height": 60, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 197950747, + "versionNonce": 865568860, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t323970192", + "type": "text", + "x": 70, + "y": 338, + "width": 107.80000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1305048693, + "versionNonce": 1111562044, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "toolbox binary", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "toolbox binary", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t650923636", + "type": "text", + "x": 70, + "y": 358, + "width": 121.00000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 717399395, + "versionNonce": 1212461683, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "zero-dep, no network", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "zero-dep, no network", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r844631237", + "type": "rectangle", + "x": 60, + "y": 425, + "width": 230, + "height": 80, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 406462378, + "versionNonce": 354095042, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1940007690", + "type": "text", + "x": 70, + "y": 433, + "width": 100.10000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 386938250, + "versionNonce": 195149255, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "report output", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "report output", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t924806275", + "type": "text", + "x": 70, + "y": 453, + "width": 151.25, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1345259965, + "versionNonce": 652828132, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "FNV-1a over fixed payload", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "FNV-1a over fixed payload", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t419878479", + "type": "text", + "x": 70, + "y": 468, + "width": 102.85000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1584513796, + "versionNonce": 1501773202, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "prints digest=0x\u2026", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "prints digest=0x\u2026", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r597294859", + "type": "rectangle", + "x": 340, + "y": 350, + "width": 210, + "height": 100, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1213010775, + "versionNonce": 1594932880, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t1340961093", + "type": "text", + "x": 350, + "y": 358, + "width": 84.7, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1665603227, + "versionNonce": 1176000257, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "digest gate", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "digest gate", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1339274316", + "type": "text", + "x": 350, + "y": 378, + "width": 108.9, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 706123708, + "versionNonce": 829942718, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "0x481984990deee5ff", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "0x481984990deee5ff", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1148799293", + "type": "text", + "x": 350, + "y": 393, + "width": 139.15, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1880363749, + "versionNonce": 723399648, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "same across C++/Go/Rust", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "same across C++/Go/Rust", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t898738737", + "type": "text", + "x": 350, + "y": 408, + "width": 108.9, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1709917709, + "versionNonce": 72379638, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "verified hard gate", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "verified hard gate", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r546087676", + "type": "rectangle", + "x": 650, + "y": 235, + "width": 230, + "height": 60, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 289514719, + "versionNonce": 420964781, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t253497963", + "type": "text", + "x": 660, + "y": 243, + "width": 77.0, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1363635535, + "versionNonce": 663388664, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo test", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo test", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1854260016", + "type": "text", + "x": 660, + "y": 263, + "width": 139.15, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 261175620, + "versionNonce": 867705033, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "runs #[cfg(test)] suite", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "runs #[cfg(test)] suite", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r884468579", + "type": "rectangle", + "x": 650, + "y": 330, + "width": 230, + "height": 60, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1793750518, + "versionNonce": 961476937, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t350961983", + "type": "text", + "x": 660, + "y": 338, + "width": 69.30000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1643137349, + "versionNonce": 649922581, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "digest.rs", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "digest.rs", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1945923514", + "type": "text", + "x": 660, + "y": 358, + "width": 102.85000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1945300496, + "versionNonce": 304584277, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "fnv1a() unit test", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "fnv1a() unit test", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1928750174", + "type": "rectangle", + "x": 650, + "y": 425, + "width": 230, + "height": 80, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "#ffffff", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 1211184001, + "versionNonce": 264108611, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t405432497", + "type": "text", + "x": 660, + "y": 433, + "width": 115.50000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1599275538, + "versionNonce": 1778819241, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "test result: ok", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "test result: ok", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t1571383311", + "type": "text", + "x": 660, + "y": 453, + "width": 133.10000000000002, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 591474911, + "versionNonce": 1549395949, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "asserts digest literal", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "asserts digest literal", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1064056069", + "type": "text", + "x": 660, + "y": 468, + "width": 121.00000000000001, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1522292941, + "versionNonce": 1995502203, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "drift fails the gate", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "drift fails the gate", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "r1064106947", + "type": "rectangle", + "x": 930, + "y": 350, + "width": 210, + "height": 100, + "angle": 0, + "strokeColor": "#e8870c", + "backgroundColor": "#fff8ef", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 3 + }, + "seed": 631499891, + "versionNonce": 1232866462, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false + }, + { + "id": "t589103043", + "type": "text", + "x": 940, + "y": 358, + "width": 115.50000000000001, + "height": 17.5, + "angle": 0, + "strokeColor": "#111111", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 287619381, + "versionNonce": 116996343, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "cargo-test gate", + "fontSize": 14, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "cargo-test gate", + "lineHeight": 1.25, + "baseline": 14 + }, + { + "id": "t669524965", + "type": "text", + "x": 940, + "y": 378, + "width": 157.3, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1638262543, + "versionNonce": 1426368147, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "asserts 0x481984990deee5ff", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "asserts 0x481984990deee5ff", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "t1247055020", + "type": "text", + "x": 940, + "y": 393, + "width": 108.9, + "height": 13.75, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1242117167, + "versionNonce": 229476238, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "verified hard gate", + "fontSize": 11, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "verified hard gate", + "lineHeight": 1.25, + "baseline": 11 + }, + { + "id": "a437247833", + "type": "arrow", + "x": 250, + "y": 105, + "width": 90, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 856868490, + "versionNonce": 119780666, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 90, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a576098004", + "type": "arrow", + "x": 550, + "y": 105, + "width": 80, + "height": 0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1912043054, + "versionNonce": 1926485127, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 80, + 0 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a1151343199", + "type": "arrow", + "x": 740, + "y": 140, + "width": 565, + "height": 95, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 303948796, + "versionNonce": 1521953804, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + -565, + 95 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a666579478", + "type": "arrow", + "x": 740, + "y": 140, + "width": 25, + "height": 95, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 83770047, + "versionNonce": 1708474176, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 25, + 95 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a330815024", + "type": "arrow", + "x": 175, + "y": 295, + "width": 0, + "height": 35, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1024935410, + "versionNonce": 475049572, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 0, + 35 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a5854346", + "type": "arrow", + "x": 175, + "y": 390, + "width": 0, + "height": 35, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1351262964, + "versionNonce": 1256044156, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 0, + 35 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a641491450", + "type": "arrow", + "x": 290, + "y": 465, + "width": 50, + "height": 65, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 269159047, + "versionNonce": 999797903, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 50, + -65 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a68806073", + "type": "arrow", + "x": 765, + "y": 295, + "width": 0, + "height": 35, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 369348355, + "versionNonce": 168569100, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 0, + 35 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a245509852", + "type": "arrow", + "x": 765, + "y": 390, + "width": 0, + "height": 35, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 1498374479, + "versionNonce": 1722578811, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 0, + 35 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "a1665968505", + "type": "arrow", + "x": 880, + "y": 465, + "width": 50, + "height": 65, + "angle": 0, + "strokeColor": "#b8650a", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 2, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": { + "type": 2 + }, + "seed": 686902319, + "versionNonce": 284363743, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "points": [ + [ + 0, + 0 + ], + [ + 50, + -65 + ] + ], + "lastCommittedPoint": null, + "startBinding": null, + "endBinding": null, + "startArrowhead": null, + "endArrowhead": "arrow" + }, + { + "id": "t643285872", + "type": "text", + "x": 20, + "y": 590, + "width": 917.4000000000001, + "height": 15.0, + "angle": 0, + "strokeColor": "#1d1d1d", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1114902060, + "versionNonce": 118932838, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "Both gates are rust-native \u2014 cargo test and the deterministic report digest run inside the pinned toolchain, verified offline on this host.", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "Both gates are rust-native \u2014 cargo test and the deterministic report digest run inside the pinned toolchain, verified offline on this host.", + "lineHeight": 1.25, + "baseline": 12 + }, + { + "id": "t1190884673", + "type": "text", + "x": 20, + "y": 608, + "width": 785.4000000000001, + "height": 15.0, + "angle": 0, + "strokeColor": "#555555", + "backgroundColor": "transparent", + "fillStyle": "solid", + "strokeWidth": 1, + "strokeStyle": "solid", + "roughness": 1, + "opacity": 100, + "groupIds": [], + "frameId": null, + "roundness": null, + "seed": 1016501663, + "versionNonce": 176164623, + "isDeleted": false, + "boundElements": [], + "updated": 1, + "link": null, + "locked": false, + "text": "FNV-1a is language-independent: the same 0x481984990deee5ff digest appears in the ch46 C++ and ch47 Go toolbox reports.", + "fontSize": 12, + "fontFamily": 1, + "textAlign": "left", + "verticalAlign": "top", + "containerId": null, + "originalText": "FNV-1a is language-independent: the same 0x481984990deee5ff digest appears in the ch46 C++ and ch47 Go toolbox reports.", + "lineHeight": 1.25, + "baseline": 12 + } + ], + "appState": { + "viewBackgroundColor": "#ffffff", + "gridSize": null + }, + "files": {} +} \ No newline at end of file diff --git a/assets/diagrams/48-rust-toolchain-pipeline.svg b/assets/diagrams/48-rust-toolchain-pipeline.svg new file mode 100644 index 0000000..0572b46 --- /dev/null +++ b/assets/diagrams/48-rust-toolchain-pipeline.svg @@ -0,0 +1,62 @@ + + + +rust-toolchain.toml → rustup → cargo/rustc — version resolution + +cargo run -- report arm — deterministic digest gate (verified, rust-native) + +cargo test arm — digest.rs unit test (verified, rust-native) + +rust-toolchain.toml +channel 1.97.1 · edition 2024 +rustfmt · clippy components + +rustup +resolves pinned toolchain +installs if missing + +cargo / rustc +1.97.1 +drives build/test/fmt/clippy + +cargo run -- report +deterministic build + +toolbox binary +zero-dep, no network + +report output +FNV-1a over fixed payload +prints digest=0x… + +digest gate +0x481984990deee5ff +same across C++/Go/Rust +verified hard gate + +cargo test +runs #[cfg(test)] suite + +digest.rs +fnv1a() unit test + +test result: ok +asserts digest literal +drift fails the gate + +cargo-test gate +asserts 0x481984990deee5ff +verified hard gate + + + + + + + + + + +Both gates are rust-native — cargo test and the deterministic report digest run inside the pinned toolchain, verified offline on this host. +FNV-1a is language-independent: the same 0x481984990deee5ff digest appears in the ch46 C++ and ch47 Go toolbox reports. + \ No newline at end of file diff --git a/assets/diagrams/README.md b/assets/diagrams/README.md index ad82a6d..0b60283 100644 --- a/assets/diagrams/README.md +++ b/assets/diagrams/README.md @@ -93,3 +93,5 @@ here as you add them: | `46-toolbox-pipeline` | 46 | the toolbox pipeline -- one `toolbox.cpp` source built by GCC and clang into the amber byte-identical parity gate (`diff == empty`), beside the static arm (`clang-tidy`, `clang-format --dry-run --Werror`) and the runtime arm (`ubsan` build → signed-overflow abort, `debug` build → gdb + Python pretty-printer → `Digest(0x…)`), with `ccache`/`mold` as dashed, not-verified-on-host accelerators | | `47-go-toolchain-pipeline` | 47 | the Go toolchain and version-management flow -- `go.mod`'s `go 1.26`/`toolchain go1.26.5` directives resolving through `GOTOOLCHAIN` into the `go` binary, which fans into the amber `go generate` diff-clean gate (`go generate ./... && git diff --exit-code` regenerating the committed `tools_generated.go`) and the amber deterministic `toolbox report` digest gate (`0x481984990deee5ff`), both go-native and verified offline on this host | | `47-go-tool-gates` | 47 | one Go module fanning into two gate lanes by verification status -- the amber hard lane (`gofmt -l`, `go generate` diff-clean, `go vet -tags vetdemo` printf finding, `pprof -top` naming hot fn `hotLoop`, the FNV-1a digest) that ships inside the `go` binary and verifies offline, beside the dashed gated-if-present lane (gofumpt, golangci-lint, staticcheck, delve, govulncheck noted `network required`, benchstat) shown as reference, not verified on this host | +| `48-rust-toolchain-pipeline` | 48 | the Rust toolchain and pinning flow -- `rust-toolchain.toml`'s channel/edition/components resolve through `rustup` into `cargo`/`rustc`, which drives the deterministic build (report digest, identical across all three languages) and the `cargo test` gate | +| `48-rust-tool-gates` | 48 | one crate fanning into two gate lanes by verification status -- the amber hard lane (rustup pin, digest, `cargo fmt --check`, `cargo clippy -D warnings` naming `needless_return`, `cargo test`) that runs offline from the pinned toolchain alone, beside the dashed gated-if-present lane (cargo-nextest, cargo-deny, cargo-llvm-cov, cargo-audit noted `advisory-db/network`, cargo-watch/cargo-flamegraph/sccache shown-not-gated) not verified on this host | diff --git a/examples/48-rust-toolbox/README.md b/examples/48-rust-toolbox/README.md new file mode 100644 index 0000000..6758275 --- /dev/null +++ b/examples/48-rust-toolbox/README.md @@ -0,0 +1,82 @@ +# 48 — rust-toolbox + +A **single-language** example (Rust only): the Rust toolchain itself is the +subject, closing the three-chapter arc that ch46 (C++) and ch47 (Go) opened. +Every tool the chapter names asserts a real, tool-produced effect against +this crate — never a bare exit code. + +- **`toolbox report`** — a deterministic FNV-1a digest over a fixed embedded + 16-byte payload, integer/string output only (no floats, addresses, timing, + or hash-map iteration). The payload is byte-for-byte ch46's C++ and ch47's + Go payload, so all three chapters land on the identical digest + `0x481984990deee5ff` — a cross-appendix easter egg, not a coincidence. +- **`rust-toolchain.toml`** — pins `channel = "1.97.1"` plus the `rustfmt` + and `clippy` components. The pin travels with the repository: `cargo` in + this directory resolves to 1.97.1 whatever `rustup default` says globally. +- **`cargo fmt --check`** — clean across the crate's module tree; + `fixtures/misformatted.rs` lives *outside* that tree (nothing `mod`-declares + it) so only an explicit per-file `rustfmt --edition 2024 --check` reads it, + and that must exit nonzero with a diff. +- **`cargo clippy --all-targets -- -D warnings`** — clean on the default + build; `--features lintbait` compiles `src/lintbait.rs`'s deliberate + `return y;` and fires the stable `needless_return` lint. The bait is *not* + `#[allow]`-ed — allowing it would defeat the gate. +- **`cargo test`** — `src/digest.rs`'s `fnv1a_matches_cross_language_digest` + asserts the digest literal, so drift in the payload or the hash fails here + before it reaches the report gate. +- **`cargo-nextest`** / **`cargo-deny`** / **`cargo-llvm-cov`** / + **`cargo-audit`** — gated *if present* against the committed `deny.toml` + and `clippy.toml`. +- **`cargo-watch`**, **`cargo-flamegraph`**, **`sccache`** — shown in the + chapter, never gated (interactive / needs `perf` privileges / a cache-hit + rate is not a correctness property). **miri** is cross-referenced to ch29 + and ch43, which own it. + +## Host reality: a bigger hard core than ch47, offline + +This example was built and verified on a host with **only the pinned Rust +toolchain present** — `cargo-nextest`, `cargo-deny`, `cargo-llvm-cov` and +`sccache` are absent, `cargo-audit` is installed but its RustSec advisory +database is not fetched, and per this iteration's decision none of that is +installed or fetched (no network, no `cargo install`). The crate is +**zero-dependency**, so `cargo build --offline` really is offline. + +The interesting asymmetry with ch47: **rustfmt and clippy are rustup +components of the pinned channel**, so pinning the channel pins the formatter +and the linter too. Go's `gofumpt` and `golangci-lint` are separate downloads +and could only ever be gated-if-present. That is why ch48's hard core (A–D) +covers formatting *and* linting offline, where ch47's could not. + +Gates A–D always run. Gates E, F, G, H +(nextest/deny/llvm-cov/audit) degrade to an informational `SKIP: …` on this +host; a reader who has installed the tools exercises them for real. The +cargo-audit gate is guarded twice — on the binary *and* on +`~/.cargo/advisory-db` — so a missing database is a skip, not a failure. + +## Run it + +```bash +./demo.sh rust build # zero-dep, --offline, no network +./demo.sh rust run report # digest=0x481984990deee5ff + +cd rust +cargo fmt --check # clean, exits 0 +rustfmt --edition 2024 --check fixtures/misformatted.rs # diff, exits 1 +cargo clippy --offline --all-targets -- -D warnings # clean, exits 0 +cargo clippy --offline --features lintbait --all-targets -- -D warnings +cargo test --offline # the digest test +``` + +## Verify + +`verify.lua` (Rust only; skips other langs) asserts gates A–D for real and +prints an informational `SKIP:` for any of E, F, G, H whose tool — or, for +cargo-audit, whose advisory database — is absent. It never hard-fails or +aborts on a missing optional tool. + +```bash +LSP_LANG=rust REPO_ROOT=$(cd ../.. && pwd) lua verify.lua +``` + +Mode: `local`. Zero-dependency — the `Cargo.lock` contains exactly one +package, `toolbox` itself. diff --git a/examples/48-rust-toolbox/demo.sh b/examples/48-rust-toolbox/demo.sh new file mode 100755 index 0000000..1aa6e03 --- /dev/null +++ b/examples/48-rust-toolbox/demo.sh @@ -0,0 +1,26 @@ +#!/usr/bin/env bash +set -euo pipefail +cd "$(dirname "$0")" + +# Single-language example (Rust only): the Rust toolchain itself is the +# subject (rustup/rust-toolchain.toml pinning, rustfmt, clippy, cargo test, +# and the skip-if-present nextest/deny/llvm-cov/audit accelerators) -- a +# C++ or Go variant would have nothing to show. +langs=(rust) + +case "${1:-all}" in + rust) + shift + exec "./rust/demo.sh" "$@" + ;; + all) + for lang in "${langs[@]}"; do "./$lang/demo.sh"; done + ;; + build) + for lang in "${langs[@]}"; do "./$lang/demo.sh" build; done + ;; + *) + echo "usage: $0 [rust|all|build] [args...]" >&2 + exit 2 + ;; +esac diff --git a/examples/48-rust-toolbox/rust/Cargo.lock b/examples/48-rust-toolbox/rust/Cargo.lock new file mode 100644 index 0000000..086f873 --- /dev/null +++ b/examples/48-rust-toolbox/rust/Cargo.lock @@ -0,0 +1,7 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 4 + +[[package]] +name = "toolbox" +version = "0.1.0" diff --git a/examples/48-rust-toolbox/rust/Cargo.toml b/examples/48-rust-toolbox/rust/Cargo.toml new file mode 100644 index 0000000..b652661 --- /dev/null +++ b/examples/48-rust-toolbox/rust/Cargo.toml @@ -0,0 +1,20 @@ +[package] +name = "toolbox" +version = "0.1.0" +edition = "2024" + +[[bin]] +name = "toolbox" +path = "src/main.rs" + +[features] +# Feature-gated clippy bait (src/lintbait.rs). Off by default so the +# default build and `cargo clippy --all-targets -- -D warnings` are clean; +# `cargo clippy --features lintbait -- -D warnings` compiles it and fires +# the stable `needless_return` lint on purpose (ch48's clippy gate). +lintbait = [] + +# Zero-dependency crate on purpose: this example builds and verifies fully +# offline. No [dependencies] section, no [dev-dependencies] -- rustc's +# standard library and the pinned toolchain's own bundled tools (rustfmt, +# clippy, cargo test) are the whole story. diff --git a/examples/48-rust-toolbox/rust/clippy.toml b/examples/48-rust-toolbox/rust/clippy.toml new file mode 100644 index 0000000..8ed82e8 --- /dev/null +++ b/examples/48-rust-toolbox/rust/clippy.toml @@ -0,0 +1,8 @@ +# ch48's clippy gate: `cargo clippy --all-targets -- -D warnings` must be +# clean on the default (no-feature) build; `cargo clippy --features +# lintbait -- -D warnings` must fire on src/lintbait.rs's deliberate +# `needless_return`. This file pins the lint-relevant thresholds so a +# future clippy release doesn't silently change what "clean" means. +msrv = "1.97.1" +too-many-arguments-threshold = 8 +type-complexity-threshold = 250 diff --git a/examples/48-rust-toolbox/rust/demo.sh b/examples/48-rust-toolbox/rust/demo.sh new file mode 100755 index 0000000..02be881 --- /dev/null +++ b/examples/48-rust-toolbox/rust/demo.sh @@ -0,0 +1,27 @@ +#!/usr/bin/env bash +set -euo pipefail +cd "$(dirname "${BASH_SOURCE[0]}")" +REPO_ROOT="$(cd ../../.. && pwd)" + +BIN=target/release/toolbox + +# --offline on purpose: toolbox is a zero-dependency crate, so a correct +# build never needs the network. Passing --offline turns "cargo quietly +# reached crates.io" from an invisible event into a hard build failure. +build() { + cargo build --offline --release +} + +run() { + if [[ -n "${TARGET:-}" ]]; then + exec "$REPO_ROOT/scripts/lab/deploy-to-vm.sh" "$TARGET" "$BIN" -- "$@" + fi + exec "./$BIN" "$@" +} + +case "${1:-}" in + build) build ;; + run) shift; run "$@" ;; + "") build; run report ;; + *) echo "usage: $0 [build|run [report]]" >&2; exit 2 ;; +esac diff --git a/examples/48-rust-toolbox/rust/deny.toml b/examples/48-rust-toolbox/rust/deny.toml new file mode 100644 index 0000000..d52538b --- /dev/null +++ b/examples/48-rust-toolbox/rust/deny.toml @@ -0,0 +1,53 @@ +# cargo-deny configuration (ch48, shown-as-reference). +# +# cargo-deny is NOT installed on the host that verified this example, so +# verify.lua's gate F degrades to an informational SKIP. The config is +# committed anyway: it is the artifact a reader copies into their own +# workspace, and `cargo deny check bans licenses sources` runs against it +# unchanged the moment `cargo install cargo-deny` has happened. +# +# `advisories` is deliberately omitted from the gated subsets -- it needs +# the RustSec advisory database (a network fetch into ~/.cargo/advisory-db), +# which this example's offline constraint forbids. `bans`, `licenses`, and +# `sources` are all answerable from the lockfile alone. + +[graph] +targets = ["x86_64-unknown-linux-gnu"] +all-features = true + +[advisories] +# Only consulted by `cargo deny check advisories`, which this example never +# runs offline. Kept here so the file is complete for a reader who fetches +# the database. +db-path = "~/.cargo/advisory-db" +db-urls = ["https://github.com/rustsec/advisory-db"] +yanked = "deny" + +[licenses] +# toolbox is zero-dependency, so this list constrains exactly one crate: +# toolbox itself. That is the point -- the policy is in place before the +# first dependency arrives, not bolted on after. +allow = [ + "MIT", + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "ISC", + "Unicode-3.0", +] +confidence-threshold = 0.93 + +[bans] +multiple-versions = "deny" +wildcards = "deny" +highlight = "all-duplicates" +# Crates that must never enter the graph of a systems example: each one +# would silently pull in a runtime, a C toolchain, or an unvendorable +# network dependency. +deny = [] + +[sources] +unknown-registry = "deny" +unknown-git = "deny" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] diff --git a/examples/48-rust-toolbox/rust/fixtures/misformatted.rs b/examples/48-rust-toolbox/rust/fixtures/misformatted.rs new file mode 100644 index 0000000..544229a --- /dev/null +++ b/examples/48-rust-toolbox/rust/fixtures/misformatted.rs @@ -0,0 +1,23 @@ +// Deliberately misformatted fixture for ch48's rustfmt gate. +// +// This file lives OUTSIDE the crate's module tree on purpose: nothing +// `mod`-declares it, so `cargo build`, `cargo test`, and `cargo clippy` +// never see it, and `cargo fmt --check` (which walks the module tree from +// the crate roots) leaves it alone. Only an explicit, per-file +// `rustfmt --edition 2024 --check fixtures/misformatted.rs` reads it -- and +// must exit nonzero, printing a diff. +// +// Do not "fix" the formatting below. The wrong spacing, the 4-into-2 indent, +// the missing trailing comma, and the crammed `if` are the assertion. + +pub struct Sample{ pub id:u32, pub label:&'static str } + +pub fn classify( n : i64 )->&'static str{ + if n<0 {"negative"} else if n==0 {"zero"}else{"positive"} +} + +pub fn sum_all(xs:&[i64])->i64{ + let mut total=0; + for x in xs { total+=x; } + total +} diff --git a/examples/48-rust-toolbox/rust/rust-toolchain.toml b/examples/48-rust-toolbox/rust/rust-toolchain.toml new file mode 100644 index 0000000..2c84230 --- /dev/null +++ b/examples/48-rust-toolbox/rust/rust-toolchain.toml @@ -0,0 +1,20 @@ +# The pin. rustup reads this file before it runs anything, so `cargo build`, +# `cargo fmt`, and `cargo clippy` in this directory all resolve to 1.97.1 no +# matter what `rustup default` says globally -- the pin travels with the +# repository, not with the developer. +# +# `components` lists only what this example's hard gates need: rustfmt and +# clippy. Both are the *pinned* toolchain's own builds, which is why ch48's +# format and lint gates can be hard-gated offline while ch47's gofumpt and +# golangci-lint could not -- those are separate downloads. +# +# llvm-tools (needed by cargo-llvm-cov) and rust-src (needed by miri and +# rust-analyzer) are deliberately NOT pinned here: rustup fetches any missing +# component over the network on the first cargo invocation in this directory, +# which would break the offline build on a fresh host. Add them explicitly +# when you opt into those tools: +# +# rustup component add llvm-tools rust-src +[toolchain] +channel = "1.97.1" +components = ["rustfmt", "clippy"] diff --git a/examples/48-rust-toolbox/rust/rustfmt.toml b/examples/48-rust-toolbox/rust/rustfmt.toml new file mode 100644 index 0000000..9daf381 --- /dev/null +++ b/examples/48-rust-toolbox/rust/rustfmt.toml @@ -0,0 +1,8 @@ +# ch48's rustfmt gate: `cargo fmt --check` must be clean on every tracked +# source under src/, and `rustfmt --edition 2024 --check +# fixtures/misformatted.rs` must be nonzero on the deliberately misformatted +# fixture (kept outside the module tree so it never affects `cargo build`). +edition = "2024" +max_width = 100 +newline_style = "Unix" +use_small_heuristics = "Default" diff --git a/examples/48-rust-toolbox/rust/src/digest.rs b/examples/48-rust-toolbox/rust/src/digest.rs new file mode 100644 index 0000000..6fbad8b --- /dev/null +++ b/examples/48-rust-toolbox/rust/src/digest.rs @@ -0,0 +1,51 @@ +//! `Digest` wraps a single 64-bit FNV-1a hash value. Small on purpose: it +//! gives the chapter's `cargo test` gate a concrete, non-trivial type to +//! assert on instead of a bare integer. + +const FNV_OFFSET_BASIS: u64 = 0xcbf29ce484222325; +const FNV_PRIME: u64 = 0x0000_0100_0000_01b3; + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub struct Digest { + pub fnv: u64, +} + +/// ch46/ch47's exact 16-byte payload (`"The quick brown."`), reused +/// byte-for-byte so the C++, Go, and Rust toolbox chapters land on the +/// identical FNV-1a digest (`0x481984990deee5ff`) -- a cross-appendix +/// easter egg, not a coincidence. FNV-1a is language-independent: any +/// conforming implementation over the same bytes produces the same 64-bit +/// value. +pub const PAYLOAD: [u8; 16] = [ + 0x54, 0x68, 0x65, 0x20, 0x71, 0x75, 0x69, 0x63, 0x6b, 0x20, 0x62, 0x72, 0x6f, 0x77, 0x6e, 0x2e, +]; + +/// FNV-1a over `data`. Integer-only, no floats, addresses, timing, or +/// hash-map iteration -- the same input bytes produce the same digest +/// bit-for-bit on every conforming Rust toolchain, every architecture, +/// every run. +pub fn fnv1a(data: &[u8]) -> Digest { + let mut h = FNV_OFFSET_BASIS; + for &b in data { + h ^= b as u64; + h = h.wrapping_mul(FNV_PRIME); + } + Digest { fnv: h } +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn fnv1a_matches_cross_language_digest() { + let d = fnv1a(&PAYLOAD); + assert_eq!( + d, + Digest { + fnv: 0x481984990deee5ff + }, + "digest must match the C++/Go toolbox chapters' literal" + ); + } +} diff --git a/examples/48-rust-toolbox/rust/src/lintbait.rs b/examples/48-rust-toolbox/rust/src/lintbait.rs new file mode 100644 index 0000000..6944c0a --- /dev/null +++ b/examples/48-rust-toolbox/rust/src/lintbait.rs @@ -0,0 +1,14 @@ +//! Deliberate, feature-gated clippy bait (ch48's clippy gate). Only compiled +//! in with `--features lintbait`; the default build (and the default +//! `cargo clippy --all-targets -- -D warnings` gate) never sees this file, +//! so the crate stays lint-clean out of the box. +//! +//! `trip_needless_return` trips the stable `clippy::needless_return` lint: +//! an explicit `return x;` as a function's last statement, where a bare +//! trailing expression `x` would do. Left un-`#[allow]`-ed on purpose -- +//! allowing the lint would defeat the point of the gate. + +pub fn trip_needless_return(x: i64) -> i64 { + let y = x * 2; + return y; +} diff --git a/examples/48-rust-toolbox/rust/src/main.rs b/examples/48-rust-toolbox/rust/src/main.rs new file mode 100644 index 0000000..f59cd5c --- /dev/null +++ b/examples/48-rust-toolbox/rust/src/main.rs @@ -0,0 +1,46 @@ +//! toolbox -- the reference Rust program for ch48 (rustup/rust-toolchain.toml +//! pinning, rustfmt, clippy, cargo test, and the skip-if-present +//! nextest/deny/llvm-cov/audit accelerators). +//! +//! Subcommands: +//! toolbox report -- deterministic FNV-1a digest over a fixed embedded +//! payload, integer/string output only (no floats, +//! addresses, timing, or hash-map iteration), so the +//! output is bit-for-bit reproducible across runs. +#![warn(clippy::all)] + +mod digest; + +#[cfg(feature = "lintbait")] +mod lintbait; + +use digest::{PAYLOAD, fnv1a}; + +fn print_usage() { + eprintln!("usage: toolbox "); +} + +fn cmd_report() { + let d = fnv1a(&PAYLOAD); + println!( + "toolbox report: payload_len={} digest=0x{:016x}", + PAYLOAD.len(), + d.fnv + ); +} + +fn main() { + let mut args = std::env::args().skip(1); + match args.next().as_deref() { + Some("report") => cmd_report(), + #[cfg(feature = "lintbait")] + Some("lintbait") => { + let doubled = lintbait::trip_needless_return(21); + println!("toolbox lintbait: doubled={doubled}"); + } + _ => { + print_usage(); + std::process::exit(2); + } + } +} diff --git a/examples/48-rust-toolbox/verify.lua b/examples/48-rust-toolbox/verify.lua new file mode 100644 index 0000000..e05bfd3 --- /dev/null +++ b/examples/48-rust-toolbox/verify.lua @@ -0,0 +1,209 @@ +-- Verify 48-rust-toolbox (Rust only): the Rust toolchain itself is the +-- subject -- rustup/rust-toolchain.toml pinning, rustfmt, clippy, cargo +-- test, and the skip-if-present nextest/deny/llvm-cov/audit accelerators. +-- Rust's analog of ch46's C++ toolbox and ch47's Go toolbox. Every +-- assertion below checks a real, tool-produced effect, never merely a +-- process exit code. +-- +-- Hard-gated (A-D): shipped by the pinned toolchain itself, deterministic, +-- fully offline, so they run on any host where `rustup` has resolved +-- rust-toolchain.toml. This core is larger than ch47's Go equivalent for a +-- structural reason: rustfmt and clippy are rustup *components* of the +-- pinned channel, so pinning the channel pins the formatter and the linter +-- too. Go's gofumpt and golangci-lint are separate downloads and could +-- only ever be gated-if-present. +-- A. rust-toolchain.toml pins channel "1.97.1" and Cargo.toml sets +-- edition "2024"; the resolved `rustc --version` really is 1.97.1; +-- `toolbox report` (an integer/string-only FNV-1a digest) equals a +-- known literal (0x481984990deee5ff -- the same value as ch46's C++ +-- and ch47's Go toolbox, since all three reuse the identical 16-byte +-- payload). +-- B. `cargo fmt --check` is clean across the crate's module tree, and +-- `rustfmt --edition 2024 --check fixtures/misformatted.rs` exits +-- nonzero and prints a diff for the deliberately misformatted fixture +-- (kept outside the module tree so it can never affect the build). +-- C. `cargo clippy --all-targets -- -D warnings` is clean on the default +-- build, and `cargo clippy --features lintbait --all-targets -- +-- -D warnings` fails and names the stable `needless_return` lint from +-- src/lintbait.rs. The gate is the lint NAME, never a diagnostic count. +-- D. `cargo test` runs the named digest unit test and reports +-- "test result: ok". The test asserts the digest literal, so any drift +-- in the payload or the FNV-1a implementation fails here first. +-- +-- Gated-if-present (E, F, G, H): this host has none of cargo-nextest, +-- cargo-deny, or cargo-llvm-cov installed, and cargo-audit is installed but +-- its RustSec advisory database is not fetched -- all four are excluded by +-- this example's offline constraint (no `cargo install`, no network). Each +-- gate degrades to an informational "SKIP: ..." print, never a +-- checks.skip() (which would abort the whole script) and never a hard FAIL +-- -- A-D must still run regardless. A reader who has installed these tools +-- exercises the real gate against the committed deny.toml/clippy.toml. +-- +-- Not gated at all: cargo-watch (interactive/never terminates), cargo- +-- flamegraph (needs perf + elevated perf_event_paranoid), and sccache (a +-- cache-hit-rate accelerator, not a correctness property). The chapter +-- shows all three; none is asserted. miri is cross-referenced to ch43/ch29, +-- which own it. + +local script_dir = arg[0]:match("(.*/)") or "./" +local repo_root = os.getenv("REPO_ROOT") or (script_dir .. "../..") +package.path = package.path .. ";" .. repo_root .. "/scripts/lib/?.lua" +local checks = require("checks") + +local lang = os.getenv("LSP_LANG") +if lang ~= "rust" then + checks.skip("48-rust-toolbox is Rust-only (LSP_LANG=" .. tostring(lang) .. ")") +end + +-- Escape a literal string for use inside a Lua pattern (checks.expect_match +-- takes a pattern, not a plain substring). +local function lit(s) + return (s:gsub("([%(%)%.%%%+%-%*%?%[%]%^%$])", "%%%1")) +end + +local function tool_present(cmd) + return checks.run("command -v " .. cmd .. " >/dev/null 2>&1").exit == 0 +end + +-- ── A. toolchain pin + deterministic digest ────────────────────────────── + +local b = checks.run("./demo.sh rust build") +checks.expect_exit(b, 0, "rust: cargo build --offline succeeds (zero-dep, no network)") + +local pin = checks.run("cat rust/rust-toolchain.toml") +checks.expect_match(pin.out, 'channel = "1%.97%.1"', "rust-toolchain.toml: pins channel 1.97.1") +checks.expect_match(pin.out, 'components = %["rustfmt", "clippy"%]', + "rust-toolchain.toml: pins the rustfmt + clippy components") + +local manifest = checks.run("cat rust/Cargo.toml") +checks.expect_match(manifest.out, 'edition = "2024"', "Cargo.toml: sets edition 2024") + +local rustc = checks.run("cd rust && rustc --version") +checks.expect_exit(rustc, 0, "rust: rustc --version runs through the pin") +checks.expect_match(rustc.out, "rustc 1%.97%.1", + "rust: the pin really resolves -- rustc reports 1.97.1") + +local EXPECTED_REPORT = "toolbox report: payload_len=16 digest=0x481984990deee5ff" + +local report = checks.run("./demo.sh rust run report") +checks.expect_exit(report, 0, "rust: toolbox report runs") +checks.expect_match(report.out, lit(EXPECTED_REPORT), + "rust: toolbox report equals the expected literal (matches ch46's C++ and ch47's Go digest)") + +-- ── B. rustfmt (clean on the tree, dirty on the isolated fixture) ──────── + +local fmt_tracked = checks.run("cd rust && cargo fmt --check 2>&1") +checks.expect_exit(fmt_tracked, 0, "rust: cargo fmt --check exits 0 on the crate's module tree") +checks.expect_match(fmt_tracked.out, "^%s*$", + "rust: cargo fmt --check prints no diff for tracked sources") + +local fmt_fixture = checks.run( + "cd rust && rustfmt --edition 2024 --check fixtures/misformatted.rs 2>&1") +if fmt_fixture.exit == 0 then + checks.expect_exit(fmt_fixture, 1, + "rust: rustfmt --check exits nonzero on the misformatted fixture") +else + print("ok: rust: rustfmt --check exits nonzero on the misformatted fixture") +end +checks.expect_match(fmt_fixture.out, "Diff in .*fixtures/misformatted%.rs", + "rust: rustfmt --check prints a diff naming the fixture") +checks.expect_match(fmt_fixture.out, "pub fn classify%(n: i64%) %-> &'static str %{", + "rust: the diff shows the reformatted signature rustfmt would write") + +-- ── C. clippy (clean by default, fires the named lint on the bait) ─────── + +local clippy_clean = checks.run( + "cd rust && cargo clippy --offline --all-targets -- -D warnings 2>&1") +checks.expect_exit(clippy_clean, 0, + "rust: cargo clippy --all-targets -- -D warnings is clean on the default build") +checks.expect_match(clippy_clean.out, "Finished", + "rust: the clean clippy run really checked the crate (cargo reports Finished)") + +local clippy_bait = checks.run( + "cd rust && cargo clippy --offline --features lintbait --all-targets -- -D warnings 2>&1") +if clippy_bait.exit == 0 then + checks.expect_exit(clippy_bait, 101, + "rust: clippy --features lintbait fails under -D warnings") +else + print("ok: rust: clippy --features lintbait fails under -D warnings") +end +checks.expect_match(clippy_bait.out, "needless_return", + "rust: clippy names the stable needless_return lint") +checks.expect_match(clippy_bait.out, "unneeded `return` statement", + "rust: clippy emits the needless_return diagnostic text") +checks.expect_match(clippy_bait.out, "src/lintbait%.rs:%d+", + "rust: the finding is located in src/lintbait.rs") + +-- ── D. cargo test (the digest unit test) ───────────────────────────────── + +local test = checks.run("cd rust && cargo test --offline 2>&1") +checks.expect_exit(test, 0, "rust: cargo test succeeds") +checks.expect_match(test.out, "test digest::tests::fnv1a_matches_cross_language_digest %.%.%. ok", + "rust: the named digest test runs and passes") +checks.expect_match(test.out, "test result: ok%. 1 passed; 0 failed", + "rust: cargo test reports the summary line, not just exit 0") + +-- ── E. cargo-nextest (skip-if-absent) ──────────────────────────────────── + +if tool_present("cargo-nextest") then + local nt = checks.run("cd rust && cargo nextest run --offline 2>&1") + checks.expect_exit(nt, 0, "rust: cargo nextest run succeeds") + checks.expect_match(nt.out, "fnv1a_matches_cross_language_digest", + "rust: nextest names the digest test in its per-test output") + checks.expect_match(nt.out, "1 test run: 1 passed", + "rust: nextest reports its own summary line") +else + print("SKIP: cargo-nextest not found on PATH -- gate E not asserted") +end + +-- ── F. cargo-deny (skip-if-absent; offline-answerable subsets only) ────── + +if tool_present("cargo-deny") then + local dn = checks.run("cd rust && cargo deny check bans licenses sources 2>&1") + checks.expect_exit(dn, 0, + "rust: cargo deny check bans licenses sources passes against the committed deny.toml") + checks.expect_match(dn.out, "bans ok", "rust: cargo deny reports the bans check as ok") + checks.expect_match(dn.out, "licenses ok", "rust: cargo deny reports the licenses check as ok") +else + print("SKIP: cargo-deny not found on PATH -- gate F not asserted") +end + +-- ── G. cargo-llvm-cov (skip-if-absent; assert a FILENAME, never a %) ───── + +if tool_present("cargo-llvm-cov") then + local cov = checks.run("cd rust && cargo llvm-cov --offline --summary-only 2>&1") + checks.expect_exit(cov, 0, "rust: cargo llvm-cov --summary-only runs cleanly") + checks.expect_match(cov.out, "digest%.rs", + "rust: the coverage summary names digest.rs as a covered file") + -- Deliberately no percentage assertion: coverage numbers move with every + -- line added to the crate, and gating on one would make the example fail + -- for a reason that has nothing to do with the toolchain. +else + print("SKIP: cargo-llvm-cov not found on PATH -- gate G not asserted") +end + +-- ── H. cargo-audit (skip-if-absent AND skip-if-advisory-db-absent) ─────── + +if not tool_present("cargo-audit") then + print("SKIP: cargo-audit not found on PATH -- gate H not asserted") +elseif checks.run("test -d \"$HOME/.cargo/advisory-db\"").exit ~= 0 then + -- cargo-audit is installed here, but its first run would clone the + -- RustSec advisory database over the network. Offline, that is a fetch + -- this example refuses to make, so the gate stays unasserted rather than + -- turning a network outage into a test failure. + print("SKIP: ~/.cargo/advisory-db absent (offline; cargo-audit would fetch it)" .. + " -- gate H not asserted") +else + local audit = checks.run("cd rust && cargo audit --offline 2>&1") + checks.expect_exit(audit, 0, "rust: cargo audit reports no vulnerabilities for the zero-dep crate") + checks.expect_match(audit.out, "Loaded %d+ security advisories", + "rust: cargo audit really loaded the advisory database") +end + +-- ── shown-not-gated: cargo-watch, cargo-flamegraph, sccache, miri ──────── + +print("info: cargo-watch, cargo-flamegraph and sccache are shown in the chapter but not gated" .. + " (interactive / needs perf privileges / cache-hit-rate is not a correctness property)") +print("info: miri is not re-taught here -- ch29 and ch43 own it") + +checks.finish() diff --git a/examples/manifest.yaml b/examples/manifest.yaml index d87c846..acc6014 100644 --- a/examples/manifest.yaml +++ b/examples/manifest.yaml @@ -197,3 +197,7 @@ examples: langs: [go] mode: local timeout: 480 + - id: 48-rust-toolbox + langs: [rust] + mode: local + timeout: 600