Cargo.toml

[workspace]
default-members = ["tng"]
exclude = ["deps/"]
# tng-wasm is deliberately not a member: it is its own workspace so that it can keep the
# `[patch.crates-io]` hyper-util shim and reqwest fork that the native build cannot tolerate.
# deps/hyper-util-shim is referenced only by that workspace, so it is not a member of either.
members = [
  "tng",
  "cohere/python/cohere-tng",
  "tng-testsuite",
  "rats-cert",
]
resolver = "2"

# Forked from https://github.com/inclavare-containers/tng (v2.6.0)
[workspace.package]
authors = ["Kun Lai <laikun@linux.alibaba.com>", "Cohere"]
edition = "2021"
license = "Apache-2.0"
homepage = "https://github.com/inclavare-containers/tng"
repository = "https://github.com/cohere-ai/tng"
version = "0.7.0"

[workspace.dependencies]
again = "0.1.2"
anyhow = "1.0.98"
as-any = "0.3.2"
async-http-proxy = {version = "1.2.5", features = ["runtime-tokio"]}
async-stream = "0.3.6"
async-trait = "0.1.88"
# `default-features` false to avoid pulling gRPC server's dependencies (clap, tonic-health...).
attestation-service = {git = "https://github.com/confidential-containers/trustee.git", rev = "50b94a5f0bbadef7d04a8e597234eb46de3782c5", default-features = false}
atty = "0.2.14"
auto_enums = {version = "0.8", features = ["std", "tokio1"]}
axum = {version = "0.8.4", default-features = false}
axum-extra = "0.10.1"
base64 = "0.22.1"
bitflags = "2.8.0"
bytes = "1.10.1"
# Same RFC 8785 implementation the upstream attestation service uses, so the runtime-data
# digest TNG computes is byte-identical to the one the AS checks it against. The previous
# choice, `canon-json`, cannot compile alongside serde_json's `arbitrary_precision` feature,
# which the AS pulls in transitively through corim-rs.
serde_json_canonicalizer = "0.3"
cfg_aliases = "0.2.1"
chromedriver-manager = "0.4.0"
chrono = "0.4.42"
ciborium = "0.2.2"
cidr = {version = "0.2.3", features = ["serde"]}
clap = {version = "4.5.39", features = ["derive"]}
console-subscriber = "0.5.0"
console_error_panic_hook = "0.1.7"
const-oid = "0.9.6"
const_format = "0.2.34"
ctor = "=0.4.1"
derivative = "2.2.0"
either = "1.15.0"
fast-socks5 = "1.0.0"
flatten-json-object = "0.6.1"
futures = "0.3.31"
getrandom = "0.3"
gloo = {version = "0.11.0"}
h2 = {version = "0.4.10", features = ["stream"]}
hex = "0.4.3"
hpke = "0.13.0"
http = "1.3.1"
http-body = "1.0.1"
http-body-util = "0.1.3"
httparse = "1.10.1"
hyper = {version = "1", default-features = false, features = ["http1", "http2"]}
hyper-util = {version = "0.1.20", features = ["service", "client-legacy", "http1", "http2"]}
indexmap = {version = "2.9.0", features = ["serde"]}
itertools = "0.14.0"
js-sys = "0.3.77"
# Same rev as `attestation-service`: the AS takes an `Arc<dyn StorageProvider>` it does not
# construct itself, and does not re-export this crate.
key-value-storage = {git = "https://github.com/confidential-containers/trustee.git", rev = "50b94a5f0bbadef7d04a8e597234eb46de3782c5", default-features = false}
jsonwebtoken = {version = "9", default-features = false}
# `std` is off deliberately: it pulls `ear`, which drags in openssl and jsonwebtoken/aws-lc-rs.
# Only `Tee` is used here, and it is available without it.
kbs-types = {version = "0.18", default-features = false, features = ["alloc"]}
netns-rs = "0.1.0"
nix = "0.30.1"
notify = "7.0.0"
once_cell = "1.21.3"
opentelemetry = "0.31.0"
opentelemetry-otlp = {version = "0.31.0", default-features = false}
opentelemetry-stdout = "0.31.0"
opentelemetry_sdk = "0.31.0"
p256 = "0.13.2"
peekable = {version = "0.5", features = ["future"]}
pin-project = "1"
pin-project-lite = "0.2.16"
pkcs8 = {version = "0.10.2", features = ["pem"]}
portpicker = "0.1.1"
prost = "^0.14"
prost-build = "0.14.1"
prost-types = "0.14"
protobuf = "~3.7.1"
rand = "0.9.1"
rand_chacha = "0.9.0"
rayon = "1.10.0"
regex = "1.11.1"
# Pinned to the same version and feature set the attestation service compiles regorus with, so a
# policy accepted by the validation below behaves identically when the service evaluates it.
regorus = {version = "0.11.0", default-features = false, features = ["base64", "regex", "std", "time"]}
reqwest = {version = "0.12", default-features = false, features = ["json", "http2", "rustls-tls-webpki-roots", "brotli", "gzip", "zstd"]}
ring = "0.17.8"
rsa = {version = "0.9.7", features = ["sha2"]}
rstest = "0.25.0"
rtnetlink = "0.17.0"
rustls = {version = "0.23.27", default-features = false, features = ["logging", "std", "tls12", "ring"]}
rustls-pemfile = "2.2.0"
rustls-pki-types = "1.10.1"
rustls-webpki = {package = "rustls-webpki", version = "0.103.3", default-features = false, features = ["alloc", "ring"]}
scopeguard = "1.2.0"
serde = {version = "1.0", features = ["derive"]}
serde-wasm-bindgen = "0.6.5"
serde_bytes = "0.11.15"
serde_json = "1.0.140"
serde_variant = "0.1.3"
serde_with = {version = "3.12.0", features = ["json"]}
serf = {version = "0.5.2", features = ["default", "tokio", "tcp", "serde"]}
serial_test = "3.2.0"
sha2 = "0.10.8"
shadow-rs = {version = "=1.0.0", default-features = false}
signature = "2.2.0"
socket2 = {version = "0.5.10", features = ["all"]}# `all` gates set_mark() and original_dst(), used by the netfilter transport
spin = {version = "0.10.0", default-features = false, features = ["mutex", "spin_mutex"]}
strum = "0.27.1"
strum_macros = "0.27.1"
sync_wrapper = "1.0.2"
tempfile = "3.20.0"
thirtyfour = "0.35.0"
thiserror = "2.0.17"
time = "0.3.41"
tokio = {version = "1.47.1", default-features = false, features = ["sync"]}
tokio-graceful = {version = "0.2.2", default-features = false}
tokio-rustls = {version = "0.26.2", default-features = false, features = ["logging", "tls12", "ring"]}
tokio-util = "0.7.15"
tokio_with_wasm = {version = "=0.8.6", features = ["rt", "macros", "time"]}
tokio_with_wasm_proc = "=0.8.6"
tonic = {version = "0.14", default-features = false}
tonic-prost = {version = "0.14", default-features = false}
tonic-prost-build = {version = "0.14", default-features = false}
tonic-web-wasm-client = "0.8.0"
tower = {version = "0.5"}
tower-http = "0.6.6"
tracing = "0.1"
tracing-futures = {version = "0.2.5"}
tracing-log = "0.2.0"
tracing-opentelemetry = "0.32.1"
tracing-subscriber = {version = "0.3", features = ["env-filter"]}
tracing-wasm = "0.2.1"
ttrpc = "0.8.4"
ttrpc-codegen = "0.5.0"
url = "2.5"
uuid = {version = "1.18.1"}
wasm-bindgen = "0.2.84"
wasm-bindgen-futures = "0.4.50"
wasm-streams = "0.4.2"
web-sys = {version = "0.3.77"}
web-time = "1.1.0"
which = "7.0.3"
ws_stream_tungstenite = "0.13.0"
ws_stream_wasm = "=0.7.5"
x509-cert = {version = "0.2.5", features = ["builder", "pem"]}
zeroize = "1.8.1"

# These two forks are each a single commit raising a size cap to the value TLS and X.509
# already permit (16MB). They are required because a DICE cert carrying CoCo evidence is
# larger than 64KB -- a TDX quote with event logs measures ~71KB -- while rustls contracts
# handshake messages and certificates to 64KB, and webpki caps nested DER lengths at 64KB.
# Neither cap comes from a protocol limit; both are self-imposed hardening, and rustls does
# not expose them for configuration (see rustls#698). TLS 1.3 certificate compression is
# already enabled via the `brotli` feature, but rustls checks the cap after decompression,
# so it does not help.
#
# Consequence to keep in mind: raising the caps to 16MB also removes the memory-exhaustion
# guard they provide, so a peer can make us buffer that much during a handshake.
# `[patch]` tables are not inherited from dependency workspaces, so upstream trustee's own
# pin has to be repeated here or the SNP verifiers fail to build: sev 7.1.0 does not compile
# with its `sev` and `serde` features both enabled.
[patch.crates-io.sev]
git = "https://github.com/virtee/sev"
rev = "d487809188c3c92e397bc92e2cb2a85eb982c980"

[patch.crates-io.rustls]
branch = "v/0.23.27-patched"
git = "https://github.com/inclavare-containers/rustls.git"

[patch.crates-io.rustls-webpki]
branch = "v/0.103.3-patched"
git = "https://github.com/inclavare-containers/webpki.git"

# The native build uses stock reqwest and hyper-util. The inclavare reqwest fork adds
# set_mark() (see the netfilter note in tng/src/config/ingress.rs) plus wasm stream
# support; only the latter is still needed, so the fork is patched in by the tng-wasm
# workspace alone. Keeping hyper-util unpinned here is what lets tonic float and what
# makes the upstream attestation-service resolvable.
# tokio-graceful's fork carries only wasm-gated changes, so the native build uses the
# released crate and the fork is patched in by the tng-wasm workspace alone.