feat: v0.16.0 — cargo-vendor export + Corrosion (real build); rules_rust scoped honestly - #40
Merged
Conversation
…ust scoped honestly
Extends verified crate distribution to more build systems.
REQ-VENDOR-001 — `varve export-crates-vendor` emits a `cargo vendor`-shaped
directory (unpacked crate trees + `.cargo-checksum.json` whose `package` is the
sha256 varve signs) + a `[source.vendored-sources]` config. Proven offline-
consumable by bare Cargo AND Corrosion.
REQ-CORROSION-001 — a REAL CMake+Corrosion build compiles varve's own
export_vendor_dir output offline (FROZEN) and produces libapp.a. Encoded as a
gated integration test (VARVE_CORROSION_TEST=1 + cmake) with a dedicated CI job.
REQ-BRIDGE-001 — the vendored tree preserves the upstream integrity anchor: the
`.cargo-checksum.json` `package` == the .crate sha256 (both the crates.io cksum
and varve's signed digest), so nothing is laundered in translation.
rules_rust, HONESTLY SCOPED OUT: a Bazel spike proved rules_rust's
`crate.from_cargo` splice needs a registry index and FAILS on a bare vendored
directory ("Failed to get crate index config"). So REQ-VENDOR-001 is scoped to
Cargo + Corrosion, and full rules_rust support (varve emitting crates_vendor
BUILD files) is deferred to REQ-VENDOR-002 (v0.17.0). The spike prevented an
overclaim.
Independently reviewed twice (VER-REVIEW-v0.16.0): the first review found the
engineering sound but DISSENTED that two user-facing CLI strings still claimed
rules_rust consumes the vendor tree; resolved by rewording both, adding a
real-.crate CLI test for export-crates-vendor, and narrowing REQ-BRIDGE-001. A
second review confirmed the dissent closed — zero residual rules_rust overclaim.
185 tests pass (incl. the gated Corrosion build); clippy/fmt clean; --locked
synced; rivet validate + verification-evidence (112 steps) + claim-check +
review-check (4 verdicts) all green. Version bumped to 0.16.0.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.16.0 — verified crates reach Corrosion; rules_rust honestly scoped
Extends the distribution arc from bare Cargo (v0.15.0) to more build systems.
REQ-VENDOR-001 —
varve export-crates-vendorEmits a
cargo vendor-shaped directory (unpacked crate trees +.cargo-checksum.jsonwhosepackageis the sha256 varve signs) +[source.vendored-sources]. Proven offline-consumable by bare Cargo AND Corrosion.REQ-CORROSION-001 — proven by a REAL build
A real CMake+Corrosion build compiles varve's own
export_vendor_diroutput offline (FROZEN) and produceslibapp.a. Gated integration test (VARVE_CORROSION_TEST=1+ cmake) + a dedicated CI job.REQ-BRIDGE-001 — provenance preserved, not clobbered
The
.cargo-checksum.jsonpackage== the.cratesha256 — both the crates.io cksum and varve's signed digest — so a consumer verifies both chains against one value.rules_rust — honestly scoped OUT (the spike did its job)
I ran Bazel + rules_rust here.
crate.from_cargofails on a bare vendored dir: "Failed to get crate index config" — it wants a registry index. So REQ-VENDOR-001 is scoped to Cargo + Corrosion, and full rules_rust (varve emittingcrates_vendorBUILD files) is REQ-VENDOR-002 (v0.17.0). The spike prevented an overclaim.Independent review — twice (VER-REVIEW-v0.16.0)
First review: engineering sound, but dissented that two user-facing CLI strings still claimed rules_rust consumes the vendor tree "hermetically." Resolved (reworded both + added a real-
.crateCLI test + narrowed REQ-BRIDGE-001); a second review confirmed the dissent closed — zero residual rules_rust overclaim anywhere.Gate
185 tests (incl. the gated Corrosion build); clippy/fmt clean;
--lockedsynced; rivet validate + verification-evidence (112 steps) + claim-check + review-check (4 verdicts) all green.🤖 Generated with Claude Code
https://claude.ai/code/session_019TNtfRjLNhEz82G2ggeeNu