Files
openhuman/scripts/check-linux-tls-dependencies.sh
T

61 lines
1.9 KiB
Bash
Executable File

#!/usr/bin/env bash
set -euo pipefail
target="${1:-x86_64-unknown-linux-gnu}"
forbidden='^(native-tls|openssl|openssl-sys) v'
check_world() {
local label="$1"
local manifest="$2"
local tree
tree="$(cargo tree --locked --manifest-path "$manifest" --target "$target" --prefix none)"
if [[ "$label" == core ]] &&
matches="$(printf '%s\n' "$tree" | grep -E "$forbidden")"; then
printf 'error: native TLS/OpenSSL dependencies found in %s for %s:\n%s\n' \
"$label" "$target" "$matches" >&2
exit 1
fi
# Tauri legitimately owns reqwest 0.13 for its dev proxy/updater. Sentry
# must never own that tree: OpenHuman supplies its reqwest 0.12 transport.
mapfile -t reqwest_013_versions < <(
printf '%s\n' "$tree" |
sed -nE 's/^reqwest v(0\.13\.[^ ]+).*/\1/p' |
sort -u
)
for version in "${reqwest_013_versions[@]}"; do
owners="$(
cargo tree --locked --manifest-path "$manifest" --target "$target" \
--invert "reqwest@$version" 2>/dev/null || true
)"
if printf '%s\n' "$owners" | grep -Eq '^sentry v'; then
printf 'error: Sentry owns reqwest %s in %s\n%s\n' \
"$version" "$label" "$owners" >&2
exit 1
fi
done
for package in native-tls openssl openssl-sys; do
owners="$(
cargo tree --locked --manifest-path "$manifest" --target "$target" \
--invert "$package" 2>/dev/null || true
)"
if printf '%s\n' "$owners" | grep -Eq '^sentry v'; then
printf 'error: Sentry owns %s in %s\n%s\n' \
"$package" "$label" "$owners" >&2
exit 1
fi
if [[ "$label" == tauri ]] &&
printf '%s\n' "$owners" | grep -Eq '^motosan-ai-oauth v'; then
printf 'error: motosan-ai-oauth owns %s in %s\n%s\n' \
"$package" "$label" "$owners" >&2
exit 1
fi
done
}
check_world core Cargo.toml
check_world tauri app/src-tauri/Cargo.toml
printf 'Linux TLS/Sentry dependency policy passed for both Cargo worlds (%s)\n' "$target"