[package]
name = "artifactx"
version = "0.1.2"
edition.workspace = true
authors.workspace = true
description = "ArtifactX (arx) — cross-platform package repository manager. One-binary apt + yum repo generator with PGP signing and built-in HTTP serving."
license = "GPL-2.0-or-later"
repository = "https://github.com/artifactx-rs/artifactx"

[[bin]]
name = "arx"
path = "src/main.rs"

[dependencies]
# apt repo generation + packaging (in-house, permissively licensed sibling crates)
arx-debrepo = { version = "0.1.2", path = "../arx-debrepo" }
arx-pack = { version = "0.1.2", path = "../arx-pack" }

# yum: reuse our own createrepo_rs library
createrepo_rs = "0.1.9"

# Tested version comparators for retention/GC ordering (data-loss-sensitive —
# dpkg/rpm semantics, not hand-rolled; see ADR-0011). License-compatible.
debversion = "0.5"
rpm-version = "0.5"

# async runtime + HTTP service
tokio = { version = "1", features = ["rt-multi-thread", "macros", "signal", "fs"] }
axum = "0.7"
tower-http = { version = "0.6", features = ["fs", "trace"] }

# HTTP client for `arx push`
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "blocking"] }

# OIDC JWT validation + GitHub JWKS
jsonwebtoken = "9"
serde_json = "1"

# observability
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
metrics = "0.23"
metrics-exporter-prometheus = { version = "0.15", default-features = false }

# CLI / general
clap = { version = "4", features = ["derive"] }
anyhow.workspace = true
thiserror = "1"
serde = { version = "1", features = ["derive"] }
toml = "0.8"
walkdir.workspace = true
sha2.workspace = true
hex.workspace = true
chrono.workspace = true

# PGP signing (rpgp, pure Rust)
pgp = "0.14"
rand = "0.8"

[dev-dependencies]
tempfile = "3"
ar = "0.9"
tar = "0.4"
flate2 = "1"

[build-dependencies]
# Build-time version stamping (git sha, build time, rustc) via pure-Rust gix.
# Pin vergen to 9.0.x: vergen-gix 1.0.x expects vergen-lib 0.1.6, but vergen
# 9.1.0 switched to an incompatible vergen-lib, breaking add_instructions().
vergen = ">=9.0.5, <9.1.0"
vergen-gix = { version = "1", features = ["build", "cargo", "rustc"] }

# Cargo.toml-driven packaging (ADR-0010 / ADR-0012 §3 dogfood). [[bin]].name
# = "arx" overrides the package name, and target-dir walks up to the workspace
# root — so `arx pack` from this directory just works after `cargo build`.
# The release workflow still uses packaging/arx.toml for its custom build/ dir.
[package.metadata.arx]
section = "utils"
depends = ["libc6"]
maintainer = "jamesarch <han.shan@live.cn>"
