build(as): drop shadow_rs from runtime deps, use const_format for concatcp

Remove shadow_rs from the build artifact, using it only at build time, which avoids pulling libgit2-sys into the resulting binary. Replace shadow_rs::concatcp in the token module with const_format::concatcp, and manage the const_format dependency at the workspace level.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kun Lai <laikun@linux.alibaba.com>

Author: imlk0

Cargo.lock

@@ -57,6 +57,7 @@ serde_with = { version = "1.11.0", features = ["base64", "hex"] }
 serial_test = "0.9.0"
 sha2 = "0.10"
 shadow-rs = "0.19.0"
+const_format = "0.2"
 sqlx = { version = "0.7", default-features = false, features = ["runtime-tokio-rustls", "mysql", "sqlite", "any", "json", "chrono"] }
 strum = { version = "0.25", features = ["derive"] }
 thiserror = "2.0"

Cargo.toml

@@ -82,7 +82,7 @@ serde_json.workspace = true
 serde_variant = "0.1.2"
 sha2.workspace = true
 sm3 = "0.4.2"
-shadow-rs.workspace = true
+shadow-rs = { workspace = true, default-features = false }
 strum.workspace = true
 tempfile.workspace = true
 time = { version = "0.3.23", features = ["std"] }
@@ -92,6 +92,7 @@ toml.workspace = true
 tonic = { workspace = true, optional = true }
 uuid = { version = "1.1.2", features = ["v4"] }
 verifier = { path = "../deps/verifier", default-features = false }
+const_format.workspace = true
 
 [build-dependencies]
 shadow-rs.workspace = true

attestation-service/Cargo.toml

@@ -7,6 +7,7 @@ use anyhow::*;
 
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use base64::Engine;
+use const_format::concatcp;
 use ear::{
     Algorithm, Appraisal, Ear, ExtensionKind, ExtensionValue, Extensions, RawValue, TrustVector,
     VerifierID,
@@ -22,7 +23,6 @@ use openssl::x509::X509;
 use serde::Deserialize;
 use serde_json::{json, Value};
 use serde_variant::to_variant_name;
-use shadow_rs::concatcp;
 use std::collections::{BTreeMap, HashMap};
 use std::path::Path;
 use std::sync::Arc;

attestation-service/src/token/ear_broker.rs

@@ -5,8 +5,8 @@
 
 use crate::TeeClaims;
 use anyhow::*;
+use const_format::concatcp;
 use serde::Deserialize;
-use shadow_rs::concatcp;
 use std::collections::HashMap;
 use strum::Display;
 

attestation-service/src/token/mod.rs

@@ -10,6 +10,7 @@
 use anyhow::*;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use base64::Engine;
+use const_format::concatcp;
 use log::info;
 use openssl::rsa::Rsa;
 use openssl::sign::Signer;
@@ -23,7 +24,6 @@ use rand::{thread_rng, Rng};
 use serde::Deserialize;
 use serde_json::{json, Map, Value};
 use serde_variant::to_variant_name;
-use shadow_rs::concatcp;
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
 use std::sync::Arc;

attestation-service/src/token/oidc.rs

@@ -10,6 +10,7 @@
 use anyhow::*;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use base64::Engine;
+use const_format::concatcp;
 use log::info;
 use openssl::rsa::Rsa;
 use openssl::sign::Signer;
@@ -23,7 +24,6 @@ use rand::{thread_rng, Rng};
 use serde::Deserialize;
 use serde_json::{json, Map, Value};
 use serde_variant::to_variant_name;
-use shadow_rs::concatcp;
 use std::collections::HashMap;
 use std::path::Path;
 use std::sync::Arc;

attestation-service/src/token/simple.rs

@@ -10,7 +10,7 @@ anyhow.workspace = true
 async-trait.workspace = true
 base64.workspace = true
 chrono.workspace = true
-const_format = "0.2"
+const_format.workspace = true
 hex.workspace = true
 log.workspace = true
 prost.workspace = true

deps/kms/Cargo.toml

@@ -62,7 +62,7 @@ cfg-if.workspace = true
 clap = { workspace = true, features = ["derive", "env"] }
 config.workspace = true
 concat-kdf = "0.1.0"
-const_format = "0.2.36"
+const_format.workspace = true
 cryptoki = { version = "0.8.0", optional = true }
 env_logger.workspace = true
 jsonwebtoken = { workspace = true, default-features = false }