[package]
name = "nono-cli"
version = "0.47.0"
edition.workspace = true
rust-version.workspace = true
authors.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
description = "CLI for nono capability-based sandbox"
readme = "README.md"
keywords = ["sandbox", "security", "cli", "landlock", "seatbelt"]
categories = ["command-line-utilities", "development-tools"]

[package.metadata.deb]
maintainer = "Luke Hinds"
copyright = "2026, Luke Hinds"
depends = "$auto, libc6 (>= 2.34)"
recommends = "1password-cli | gnome-keyring"
section = "utils"
priority = "optional"
assets = [
    ["target/release/nono", "usr/bin/", "755"],
    ["../../README.md", "usr/share/doc/nono/README", "644"],
    ["../../LICENSE", "usr/share/doc/nono/LICENSE", "644"],
]
conf-files = ["/etc/nono/profiles/"]

[[bin]]
name = "nono"
path = "src/main.rs"

[features]
default = ["system-keyring"]
# Enables OS system keyring access (macOS Keychain / Linux Secret Service).
# Disable this for headless/container environments without libdbus.
# Controls keyring for nono-cli, nono, and nono-proxy in one flag.
system-keyring = ["dep:keyring", "nono/system-keyring", "nono-proxy/system-keyring"]
# Enables test-only trust root overrides used by the integration harness.
test-trust-overrides = []

[dependencies]
nono = { version = "0.47.0", path = "../nono", default-features = false }
nono-proxy = { version = "0.47.0", path = "../nono-proxy", default-features = false }
clap = { version = "4", features = ["derive", "env"] }
colored = "3"
similar = "3"
rand = "0.10"
which = "8"
toml = "1.0"
xdg-home = "1.3.0"
dirs = "6"
walkdir = "2"
ignore.workspace = true
chrono = { version = "0.4", features = ["serde"] }

# Signing key PKCS#8 serialization (already transitive via sigstore-verify)
aws-lc-rs = "1"

# Keystore access for trust signing keys (optional: requires libdbus on Linux)
keyring = { version = "3", optional = true }

# Keyless (Sigstore/Fulcio/Rekor) signing for instruction file attestation
sigstore-sign = "0.6"
tokio = { version = "1", features = ["rt"] }

ureq = { version = "3", features = ["platform-verifier"] }
semver = "1"

zeroize.workspace = true
sha2.workspace = true
thiserror.workspace = true
serde.workspace = true
serde_json.workspace = true
tracing.workspace = true
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
url = "2.5.8"
tempfile = "3"
vt100 = "0.16.2"
shlex = "1"

[target.'cfg(target_os = "linux")'.dependencies]
nix = { version = "0.31", features = ["process", "signal", "fs", "user", "term"] }
landlock = "0.4"
dns-lookup = "2"
keyring = { version = "3", features = ["sync-secret-service"], optional = true }

[target.'cfg(target_os = "macos")'.dependencies]
nix = { version = "0.31", features = ["process", "signal", "fs", "user", "term"] }
dns-lookup = "2"
keyring = { version = "3", features = ["apple-native"], optional = true }

[build-dependencies]
toml = "1.0"
serde = { version = "1", features = ["derive"] }

[dev-dependencies]
jsonschema = "0.45"
proptest = "1"
