[package]
name = "cosmian_kms_server"
version.workspace = true
authors.workspace = true
categories.workspace = true
edition.workspace = true
exclude = ["ui/", "ui_non_fips/", "cosmian-kms/", ".vscode/"]
homepage.workspace = true
keywords.workspace = true
license.workspace = true
repository.workspace = true
rust-version.workspace = true
description = "Cosmian Key Management Service - A high-performance, FIPS 140-3 compliant Key Management System"

# NOTE: OpenSSL FIPS Build Paths
# - Nix builds (production): OpenSSL is configured with --openssldir=/usr/local/cosmian/lib/ssl
#   This hardcoded path makes binaries portable - they look for FIPS config at runtime in
#   /usr/local/cosmian/lib/ssl regardless of where they were built.
# - Local cargo builds: build.rs compiles OpenSSL with --openssldir=target/openssl-fips-{version}-{os}-{arch}/ssl
#   This allows local development/testing without system-wide installation.
# - Local cargo builds now place artifacts under target/openssl-<mode>-3.6.0-<os>-<arch>
#   FIPS mode:   target/openssl-3.6.2-<os>-<arch> with fips provider/configs integrated
#   Non-FIPS:    target/openssl-non-fips-3.6.2-<os>-<arch> with legacy provider

[lints]
workspace = true

[[bin]]
name = "cosmian_kms"
path = "src/main.rs"
test = false

[lib]
# doc test linking as a separate binary is extremely slow
# and is not needed for internal lib
doctest = false

[features]
default = ["interop"]
# Do not verify auth0 token expiration date, and https ssl is auto-signed (to avoid to be banned by letsencrypt)
insecure = []
# The binary won't start after a date chosen at compile-time
timeout = []
# Enable extra cryptographic mechanisms which are non-FIPS compliant.
non-fips = [
  "cosmian_kms_client_utils/non-fips",
  "cosmian_kms_server_database/non-fips",
]
# Enable interop test operations (should only be used for testing)
interop = ["cosmian_kms_server_database/interop"]

[dependencies]
actix-cors = { workspace = true }
actix-files = { workspace = true }
actix-governor = { workspace = true }
actix-identity = { workspace = true }
actix-rt = { workspace = true }
actix-session = { workspace = true, features = ["cookie-session"] }
actix-tls = { workspace = true }
actix-web = { workspace = true, features = ["macros", "openssl"] }
async-recursion = { workspace = true }
base64 = { workspace = true }
chrono = { workspace = true }
clap = { workspace = true, features = [
  "help",
  "env",
  "std",
  "usage",
  "error-context",
  "derive",
  "cargo",
] }
cosmian_kms_access = { path = "../access", version = "5.22.0" }
cosmian_kms_base_hsm = { path = "../hsm/base_hsm", version = "5.22.0" }
cosmian_kms_server_database = { path = "../server_database", version = "5.22.0" }
cosmian_logger = { workspace = true, features = ["full"] }
crypt2pay_pkcs11_loader = { path = "../hsm/crypt2pay", version = "5.22.0" }
dialoguer = { workspace = true }
dotenvy = { workspace = true }
futures = { workspace = true }
hex = { workspace = true, features = ["serde"] }
http = { workspace = true }
jsonwebtoken = { workspace = true }
num-bigint-dig = { workspace = true, features = [
  "std",
  "rand",
  "serde",
  "zeroize",
] }
openssl = { workspace = true }
openssl-sys = "0.9"
opentelemetry = { workspace = true }
opentelemetry-otlp = { workspace = true }
opentelemetry_sdk = { workspace = true }
pem = { workspace = true }
proteccio_pkcs11_loader = { path = "../hsm/proteccio", version = "5.22.0" }
reqwest = { workspace = true, features = [ # Remove "default" which includes rustls
  "json",
  "native-tls",
  "socks",
] }
scratchstack-aws-signature = { workspace = true }
serde = { workspace = true }
serde_json = { workspace = true }
smartcardhsm_pkcs11_loader = { path = "../hsm/smartcardhsm", version = "5.22.0" }
softhsm2_pkcs11_loader = { path = "../hsm/softhsm2", version = "5.22.0" }
strum = { workspace = true, features = ["std", "derive", "strum_macros"] }
thiserror = { workspace = true }
time = { workspace = true, features = ["local-offset", "formatting"] }
tokio = { workspace = true, features = ["full"] }
toml = { workspace = true }
tracing = { workspace = true }
subtle = { workspace = true }
url = { workspace = true }
utimaco_pkcs11_loader = { path = "../hsm/utimaco", version = "5.22.0" }
uuid = { workspace = true, features = ["v4"] }
x509-parser = { workspace = true }
zeroize = { workspace = true }

[dev-dependencies]
actix-http = { workspace = true }
cosmian_kms_client_utils = { path = "../clients/client_utils", version = "5.22.0" }
cosmian_kms_interfaces = { path = "../interfaces", version = "5.22.0" }
native-tls = { workspace = true }
pem = { workspace = true }
tempfile = { workspace = true }

[build-dependencies]
actix-http = { workspace = true }
time = { workspace = true, features = ["local-offset", "formatting"] }
sha2 = { workspace = true }

[package.metadata.cargo-machete]
ignored = ["sha2"]

# ------------------------------------------------------------------------------
# START DEBIAN PACKAGING
[package.metadata.deb]
features = ["non-fips"]
maintainer = "Cosmian support team <tech@cosmian.com>"
maintainer-scripts = "../../pkg/deb/"
copyright = "2026, Cosmian Tech SAS <tech@cosmian.com>"
license-file = ["../../LICENSE", "0"]
changelog = "../../CHANGELOG.md"
section = "security"
priority = "optional"
depends = ""
conflicts = "cosmian-kms-server-non-fips-dynamic, cosmian-kms-server-fips-dynamic"
replaces = "cosmian-kms-server-non-fips-dynamic, cosmian-kms-server-fips-dynamic"
assets = [
  [
    "../../ui_non_fips/dist/**/*",
    "usr/local/cosmian/ui/dist/",
    "644",
  ],
  [
    "target/release/cosmian_kms",
    "usr/sbin/cosmian_kms",
    "500",
  ],
  [
    "../../README.md",
    "usr/share/doc/cosmian/README.md",
    "644",
  ],
  [
    "../../pkg/kms.toml",
    "etc/cosmian/",
    "400",
  ],
  [
    "target/openssl-non-fips-3.6.2-linux/lib/ossl-modules/legacy.so",
    "usr/local/cosmian/lib/ossl-modules/legacy.so",
    "500",
  ],
]
systemd-units = [
  { unit-name = "cosmian_kms", unit-scripts = "../../pkg", enable = true, start = false, restart-after-upgrade = false },
]

[package.metadata.deb.variants.fips]
features = []
assets = [
  [
    "../../ui/dist/**/*",
    "usr/local/cosmian/ui/dist/",
    "644",
  ],
  [
    "target/release/cosmian_kms",
    "usr/sbin/cosmian_kms",
    "500",
  ],
  [
    "../../README.md",
    "usr/share/doc/cosmian/README.md",
    "644",
  ],
  [
    "../../pkg/kms.toml",
    "etc/cosmian/",
    "400",
  ],
  [
    "target/openssl-3.6.2-linux/lib/ossl-modules/fips.so",
    "usr/local/cosmian/lib/ossl-modules/fips.so",
    "500",
  ],
  [
    "target/openssl-3.6.2-linux/ssl/openssl.cnf",
    "usr/local/cosmian/lib/ssl/openssl.cnf",
    "644",
  ],
  [
    "target/openssl-3.6.2-linux/ssl/fipsmodule.cnf",
    "usr/local/cosmian/lib/ssl/fipsmodule.cnf",
    "644",
  ],
]

# FIPS variant with dynamic OpenSSL linkage
# Depends on system OpenSSL 3.x and packages the required provider modules and config files
# Also embeds the OpenSSL shared libraries for self-contained deployment
[package.metadata.deb.variants.fips-dynamic]
features = []
depends = ""
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
assets = [
  [
    "../../ui/dist/**/*",
    "usr/local/cosmian/ui/dist/",
    "500",
  ],
  [
    "target/release/cosmian_kms",
    "usr/sbin/cosmian_kms",
    "500",
  ],
  [
    "../../README.md",
    "usr/share/doc/cosmian/README.md",
    "644",
  ],
  [
    "../../pkg/kms.toml",
    "etc/cosmian/",
    "400",
  ],
  [
    "target/openssl-3.6.2-linux/lib/libssl.so.3",
    "usr/local/cosmian/lib/libssl.so.3",
    "500",
  ],
  [
    "target/openssl-3.6.2-linux/lib/libcrypto.so.3",
    "usr/local/cosmian/lib/libcrypto.so.3",
    "500",
  ],
  [
    "target/openssl-3.6.2-linux/lib/ossl-modules/fips.so",
    "usr/local/cosmian/lib/ossl-modules/fips.so",
    "500",
  ],
  [
    "target/openssl-3.6.2-linux/ssl/openssl.cnf",
    "usr/local/cosmian/lib/ssl/openssl.cnf",
    "644",
  ],
  [
    "target/openssl-3.6.2-linux/ssl/fipsmodule.cnf",
    "usr/local/cosmian/lib/ssl/fipsmodule.cnf",
    "644",
  ],
]

# Non-FIPS variant with dynamic OpenSSL linkage
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
[package.metadata.deb.variants.non-fips-dynamic]
features = ["non-fips"]
depends = ""
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
assets = [
  [
    "../../ui_non_fips/dist/**/*",
    "usr/local/cosmian/ui/dist/",
    "500",
  ],
  [
    "target/release/cosmian_kms",
    "usr/sbin/cosmian_kms",
    "500",
  ],
  [
    "../../README.md",
    "usr/share/doc/cosmian/README.md",
    "644",
  ],
  [
    "../../pkg/kms.toml",
    "etc/cosmian/",
    "400",
  ],
  [
    "target/openssl-non-fips-3.6.2-linux/lib/libssl.so.3",
    "usr/local/cosmian/lib/libssl.so.3",
    "500",
  ],
  [
    "target/openssl-non-fips-3.6.2-linux/lib/libcrypto.so.3",
    "usr/local/cosmian/lib/libcrypto.so.3",
    "500",
  ],
  [
    "target/openssl-non-fips-3.6.2-linux/lib/ossl-modules/legacy.so",
    "usr/local/cosmian/lib/ossl-modules/legacy.so",
    "500",
  ],
]

# END DEBIAN PACKAGING
# ------------------------------------------------------------------------------

# ------------------------------------------------------------------------------
# START RPM PACKAGING
[package.metadata.generate-rpm]
license = "BUSL-1.1"
assets = [
  { source = "../../ui_non_fips/dist/**/*", dest = "/usr/local/cosmian/ui/dist/", mode = "644" },
  { source = "target/release/cosmian_kms", dest = "/usr/sbin/cosmian_kms", mode = "500" },
  { source = "target/openssl-non-fips-3.6.2-linux/lib/ossl-modules/legacy.so", dest = "/usr/local/cosmian/lib/ossl-modules/legacy.so", mode = "500" },
  { source = "../../README.md", dest = "/usr/share/doc/cosmian/README.md", mode = "644", doc = true },
  { source = "../../pkg/kms.toml", dest = "/etc/cosmian/kms.toml", mode = "400" },
  { source = "../../pkg/cosmian_kms.service", dest = "/lib/systemd/system/cosmian_kms.service", mode = "644" },
]
auto-req = "no" # do not try to discover .so dependencies
features = ["non-fips"]
require-sh = true

[package.metadata.generate-rpm.variants.fips]
license = "BUSL-1.1"
assets = [
  # Use FIPS UI assets for the FIPS variant
  { source = "../../ui/dist/**/*", dest = "/usr/local/cosmian/ui/dist/", mode = "644" },
  { source = "target/release/cosmian_kms", dest = "/usr/sbin/cosmian_kms", mode = "500" },
  { source = "target/openssl-3.6.2-linux/lib/ossl-modules/fips.so", dest = "/usr/local/cosmian/lib/ossl-modules/fips.so", mode = "500" },
  { source = "target/openssl-3.6.2-linux/ssl/openssl.cnf", dest = "/usr/local/cosmian/lib/ssl/openssl.cnf", mode = "644" },
  { source = "target/openssl-3.6.2-linux/ssl/fipsmodule.cnf", dest = "/usr/local/cosmian/lib/ssl/fipsmodule.cnf", mode = "644" },
  { source = "../../README.md", dest = "/usr/share/doc/cosmian/README.md", mode = "644", doc = true },
  { source = "../../pkg/kms.toml", dest = "/etc/cosmian/kms.toml", mode = "400" },
  { source = "../../pkg/cosmian_kms.service", dest = "/lib/systemd/system/cosmian_kms.service", mode = "644" },
]
auto-req = "no" # do not try to discover .so dependencies
require-sh = true
features = []

# FIPS variant with dynamic OpenSSL linkage
# Dynamic linking - OpenSSL libraries are provided by the system
[package.metadata.generate-rpm.variants.fips-dynamic]
license = "BUSL-1.1"
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
assets = [
  { source = "../../ui/dist/**/*", dest = "/usr/local/cosmian/ui/dist/", mode = "500" },
  { source = "target/release/cosmian_kms", dest = "/usr/sbin/cosmian_kms", mode = "500" },
  { source = "target/openssl-3.6.2-linux/lib/libssl.so.3", dest = "/usr/local/cosmian/lib/libssl.so.3", mode = "500" },
  { source = "target/openssl-3.6.2-linux/lib/libcrypto.so.3", dest = "/usr/local/cosmian/lib/libcrypto.so.3", mode = "500" },
  { source = "target/openssl-3.6.2-linux/lib/ossl-modules/fips.so", dest = "/usr/local/cosmian/lib/ossl-modules/fips.so", mode = "500" },
  { source = "target/openssl-3.6.2-linux/ssl/openssl.cnf", dest = "/usr/local/cosmian/lib/ssl/openssl.cnf", mode = "644" },
  { source = "target/openssl-3.6.2-linux/ssl/fipsmodule.cnf", dest = "/usr/local/cosmian/lib/ssl/fipsmodule.cnf", mode = "644" },
  { source = "../../README.md", dest = "/usr/share/doc/cosmian/README.md", mode = "644", doc = true },
  { source = "../../pkg/kms.toml", dest = "/etc/cosmian/kms.toml", mode = "400" },
  { source = "../../pkg/cosmian_kms.service", dest = "/lib/systemd/system/cosmian_kms.service", mode = "644" },
]
auto-req = "no"
require-sh = true
features = []

# Non-FIPS variant with dynamic OpenSSL linkage
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
[package.metadata.generate-rpm.variants.non-fips-dynamic]
license = "BUSL-1.1"
# Dynamic linking - ships with OpenSSL shared libraries for self-contained deployment
assets = [
  { source = "../../ui_non_fips/dist/**/*", dest = "/usr/local/cosmian/ui/dist/", mode = "500" },
  { source = "target/release/cosmian_kms", dest = "/usr/sbin/cosmian_kms", mode = "500" },
  { source = "target/openssl-non-fips-3.6.2-linux/lib/libssl.so.3", dest = "/usr/local/cosmian/lib/libssl.so.3", mode = "500" },
  { source = "target/openssl-non-fips-3.6.2-linux/lib/libcrypto.so.3", dest = "/usr/local/cosmian/lib/libcrypto.so.3", mode = "500" },
  { source = "target/openssl-non-fips-3.6.2-linux/lib/ossl-modules/legacy.so", dest = "/usr/local/cosmian/lib/ossl-modules/legacy.so", mode = "500" },
  { source = "../../README.md", dest = "/usr/share/doc/cosmian/README.md", mode = "644", doc = true },
  { source = "../../pkg/kms.toml", dest = "/etc/cosmian/kms.toml", mode = "400" },
  { source = "../../pkg/cosmian_kms.service", dest = "/lib/systemd/system/cosmian_kms.service", mode = "644" },
]
auto-req = "no"
require-sh = true
features = ["non-fips"]

# END RPM PACKAGING
# ------------------------------------------------------------------------------

# ------------------------------------------------------------------------------
# START WINDOWS INSTALLER PACKAGING (cargo-packager)
# cargo packager --verbose --formats nsis --release --features non-fips
# cargo packager --verbose --formats dmg --release --features non-fips
[package.metadata.packager]
# Build command to run before packaging
# Prerequisite: build the server in non-fips mode
# before-packaging-command = "cargo build --release --features non-fips -p cosmian_kms_server"

# Product information
product-name = "Cosmian KMS Server"
long-description = "Cosmian KMS is a high-performance, source available FIPS 140-3 compliant Key Management System written in Rust. It provides enterprise-grade key management capabilities with support for various cryptographic operations, database backends, and HSM integrations."
license-file = "../../LICENSE"

# Identifier for the package (Windows)
identifier = "com.cosmian.kms.server"

# Use platform installers
# - Windows: NSIS (.exe)
# - macOS:  DMG (.dmg)
formats = ["nsis", "dmg"]

# Files to include in the installer
[[package.metadata.packager.resources]]
src = "../../README.md"
target = "README.md"

[[package.metadata.packager.resources]]
src = "../../pkg/kms.toml"
target = "kms.toml"

[[package.metadata.packager.resources]]
src = "ui_non_fips/dist"
target = "ui/"

# NSIS-specific configuration
[package.metadata.packager.nsis]
# Installer configuration
display-language-selector = false
installer-mode = "currentUser"    # or "perMachine" for system-wide installation
languages = ["English"]

# END WINDOWS INSTALLER PACKAGING
# ------------------------------------------------------------------------------
