Cargo.toml

[workspace]
default-members = [
  "crate/server",
  "crate/clients/pkcs11/provider",
  "crate/clients/ckms",
]
members = [
  # Common crates
  "crate/kmip",
  # Client crates
  "crate/clients/client_utils",
  "crate/clients/client",
  "crate/clients/wasm",
  "crate/clients/clap",
  "crate/clients/ckms",
  "crate/clients/pkcs11/module",
  "crate/clients/pkcs11/provider",
  "crate/clients/cng",
  # Server crates
  "crate/access",
  "crate/crypto",
  "crate/hsm/proteccio",
  "crate/hsm/crypt2pay",
  "crate/hsm/softhsm2",
  "crate/hsm/smartcardhsm",
  "crate/hsm/utimaco",
  "crate/hsm/base_hsm",
  "crate/interfaces",
  "crate/server",
  "crate/server_database",
  # Test crates
  "crate/test_kms_server",
]
# Do that if you don't want to enable `dev` feature by default due to the `dev-dependencies` of the cli.
# For more details, read: https://doc.rust-lang.org/cargo/reference/resolver.html#feature-resolver-version-2
# note: resolver defaults to 2 in 2021 edition crate, but defaults to 1 in virtual workspace
resolver = "2"

[workspace.lints.rust]
nonstandard_style = "deny"
refining_impl_trait = "deny"
future_incompatible = "deny"
keyword_idents = "deny"
let_underscore = "deny"
unreachable_pub = "deny"
unused = "deny"
unsafe_code = "deny"

[workspace.lints.clippy]
# Main clippy categories
pedantic = { level = "deny", priority = 90 }
all = { level = "deny", priority = 80 }
suspicious = { level = "deny", priority = 70 }
complexity = { level = "deny", priority = 60 }
perf = { level = "deny", priority = 50 }
style = { level = "deny", priority = 40 }
cargo = { level = "deny", priority = 30 }
nursery = { level = "deny", priority = 20 }

# Common allows (to be selectively enabled by crates as needed)
similar_names = { level = "allow", priority = 91 }
too_many_lines = { level = "allow", priority = 91 }
ref_option = { level = "allow", priority = 91 }
missing_errors_doc = { level = "allow", priority = 91 }
multiple_crate_versions = { level = "allow", priority = 31 }
redundant_pub_crate = { level = "allow", priority = 21 }
future_not_send = { level = "allow", priority = 21 }
cognitive_complexity = { level = "allow", priority = 21 }
significant_drop_tightening = { level = "allow", priority = 21 }
iter_with_drain = { level = "allow", priority = 21 }
too_long_first_doc_paragraph = { level = "allow", priority = 21 }

# Restriction lints (from server and other crates)
module_name_repetitions = "allow"
unwrap_used = "deny"
get_unwrap = "deny"
expect_used = "deny"
indexing_slicing = "deny"
missing_asserts_for_indexing = "deny"
unwrap_in_result = "deny"
assertions_on_result_states = "deny"
panic = "deny"
panic_in_result_fn = "deny"
renamed_function_params = "deny"
verbose_file_reads = "deny"
str_to_string = "deny"
implicit_clone = "deny"
unreachable = "deny"
as_conversions = "deny"
print_stdout = "deny"
empty_structs_with_brackets = "deny"
unseparated_literal_suffix = "deny"
map_err_ignore = "deny"
redundant_clone = "deny"

[workspace.package]
version = "5.23.0"
edition = "2024"
rust-version = "1.87.0"
authors = [
  "Bruno Grieder <bruno.grieder@cosmian.com>",
  "Emmanuel Coste <emmanuel.coste@cosmian.com>",
]
license = "BUSL-1.1" # "Business Source License 1.1"
license-file = "LICENSE"
repository = "https://github.com/Cosmian/kms"
homepage = "https://github.com/Cosmian/kms"
keywords = ["kms", "cosmian"]
categories = ["security"]

[profile.release]
# Deterministic build configuration for reproducible binaries
# These settings ensure the same source produces identical binaries across builds
lto = "fat"             # Fat LTO: maximum cross-crate optimization for smallest binaries
strip = "symbols"       # Strip symbol tables for smaller binaries
opt-level = "z"         # Optimize for size while maintaining performance
codegen-units = 1       # Single codegen unit: best optimization and determinism
panic = "abort"         # Smaller binaries, no unwinding tables
incremental = false     # Disable incremental compilation for determinism
debug = 0               # No debug info (timestamps/paths)
overflow-checks = true  # Catch integer overflows in release builds (ANSSI LANG-ARITH)

[profile.dev]
strip = "debuginfo"
incremental = false
panic = "abort"     # prevent UB from unwinding panics across extern "C" boundary

# proc-macros and build-scripts
[profile.dev.build-override]
strip = "debuginfo"
incremental = false

# external dependencies
[profile.dev.package."*"]
opt-level = 0

[workspace.dependencies]
actix-cors = "0.6"
actix-files = "0.6"
actix-http = "3.12"
actix-identity = "0.6"
actix-rt = "2.10"
actix-session = { version = "0.8" }
actix-server = { version = "2.5", default-features = false }
actix-tls = "3.4"
actix-web = { version = "4.12", default-features = false }
async-recursion = "1.1"
async-trait = "0.1"
base64 = "0.22"
bitflags = "2.9"
chrono = "0.4"
clap = { version = "4.5", default-features = false }
criterion = { version = "0.6", default-features = false, features = [
  "html_reports",
  "async_tokio",
] }
cosmian_config_utils = "0.7"
cosmian_crypto_core = { version = "11.0", default-features = false, features = [
  "ser",
] }
cosmian_logger = "0.7"
der = { version = "0.7", default-features = false }
dialoguer = { version = "0.11", default-features = false, features = [
  "editor",
  "fuzzy-select",
  "history",
  "password",
  "completion",
] }
dotenvy = "0.15"
futures = "0.3"
hex = { version = "0.4", default-features = false }
http = "1.4"
jsonwebtoken = { version = "10.3", features = ["rust_crypto"] }
lazy_static = "1.5"
leb128 = "0.2"
libloading = "0.8"
log = { version = "0.4", default-features = false }
lru = "0.16"
native-tls = { version = "0.2", default-features = false }
num_cpus = "1.16"
num-format = "0.4"
itertools = "0.10"
num-bigint = { version = "0.4", default-features = false }
num-traits = "0.2"
num-bigint-dig = { version = "0.8", default-features = false }
openssl = { version = "0.10", default-features = false }
opentelemetry = "0.27"
opentelemetry-otlp = { version = "0.27", features = ["metrics", "grpc-tonic"] }
opentelemetry_sdk = { version = "0.27", features = ["metrics", "rt-tokio"] }
pem = "3.0"
pkcs11-sys = "0.2"
rand = "0.10"
regex = { version = "1.11", default-features = false }
reqwest = { version = "0.12", default-features = false }
scratchstack-aws-signature = "=0.10" # Must stay 0.10 for now (Feb 2026)
serde = "1.0"
serde_json = "1.0"
sha2 = { version = "0.10", default-features = false }
sha3 = { version = "0.10", default-features = false }
strum = { version = "0.27", default-features = false }
strum_macros = { version = "0.27", default-features = false }
thiserror = "2.0"
time = "0.3"
tiny-keccak = "2.0"
tempfile = "3.19"
tokio = { version = "1.44", default-features = false }
toml = "0.9"
tracing = "0.1"
tracing-subscriber = { version = "0.3", default-features = false }
subtle = "2.6"
url = "2.5"
uuid = "=1.11.1"
x509-cert = { version = "0.2", default-features = false }
x509-parser = "0.17"
zeroize = { version = "1.8", default-features = false }