Repository navigation
Dnix - #37
Merged
Merged
Dnix#37
Conversation
added 10 commits
October 21, 2026 23:55
…Nix otherwise The build hook is dnix's. By default it downloads the library of the release dnix.lock names and verifies its hash; in source mode it builds the same library with Nix and verifies the same hash; in dev mode it builds with Nix for work on the Rust code. dnix.json names the library, the asset, the Rust workspace and crate, the Rust and Xcode versions, the deployment floors, and the eleven targets; dnix.lock records what the source builds to and names release native-a58277144bcb. The flake hands dnix the configuration. OpenSSL, which native-tls uses on Linux and Android, is compiled inside that build from the vendored crate. The prebuilt manifest, the source fingerprint, and their tests and tools go; two-line tools update the lock and verify one platform against the release.
…lock dnix's reusable workflow builds the library on Linux x86_64, Linux aarch64, macOS with Xcode 27.0, and Linux inside WSL2 on Windows, rebuilds each sandboxed target, compares every host with every other and with the committed lock, and on main publishes the release the lock names if it does not exist yet. Runs on main are never cancelled, since one may be publishing. The test workflow runs the Flutter tests on every OS, against the prebuilt library once its release exists and from source before that, plus the example's widget tests, the crate's tests, lints and audit on Linux, and the Windows time, IPv6 and file release tests on pull requests, as before. The per-OS build matrix, its smoke tests and the packaged example builds went with the prebuilt pipeline they served.
How the hook obtains the library and the three modes, how a change to the Rust code becomes a lock entry and a release, and how anyone rebuilds a platform and compares.
dnix 7b9ef2d adds the Windows GNU and arm64 targets and stops zig adding its debug-mode sanitizer to C compiled without an optimisation level. Neither changes what this package builds to: every library hashes as before, so dnix.lock and the release it names stay as they are.
The arm64 Linux test job could never start: subosito/flutter-action finds no arm64 Flutter release for Linux and exits, and main never ran Flutter there either. Analysis covers lib and example again, as flutter analyze did on main; the package root stays out because pub flags the git dependency on dnix there. Actions are pinned by commit, as they were on main. The README gives the arm64 simulator's minimum, iOS 14, again, and the CHANGELOG records the move to dnix.
dart analyze reports infos without failing; main's flutter analyze failed on them. The package already has none.
slopbot9k/dnix 57efe93, the stable-sort branch, not yet on cypherstack: build-time dependencies are resolved alike on every build host, rustc sorts the same everywhere, bindgen gets fixed headers, and a target keeps only its dynamic library. Every library changes with the first of these; the new lock matches what Linux x64, Linux arm64, and macOS each build.
The audit fails on advisories published between October 13 and 23 against dependencies this package had not changed: tokio 1.50.0 (RUSTSEC-2026-0386), zstd-safe 7.1.0 (RUSTSEC-2026-0403 and eight unsound warnings), zstd-sys 2.0.11 (RUSTSEC-2026-0410), ctutils 0.4.2 (RUSTSEC-2026-0385) and crypto-bigint 0.5.5 (RUSTSEC-2026-0387). tokio moves to 1.54.1 and ctutils to 0.4.7 within their series. The fixed zstd-safe 8.2.0 comes with zstd 0.14, which async-compression takes from 0.4.45, so it moves to 0.4.51; every async-compression since 0.4.20 reads xz through liblzma rather than xz2, and liblzma-sys claims the same native library as lzma-sys, so the plugin's static xz dependency becomes liblzma-sys. flate2 and miniz_oxide follow, and adler gives way to adler2. crypto-bigint 0.5 stays: only the optional ECDSA support of ssh-key-fork-arti reaches it, no feature arti enables compiles it (cargo tree finds no path on any target), and the elliptic-curve 0.13 series cannot take the fixed 0.7. The audit ignores that advisory until arti moves to elliptic-curve 0.14. The lock is rebuilt: release native-bdccea9785ab, every library changing with its dependencies. Under Rust 1.99.1 the format check, the tests and clippy pass, and the audit is clean apart from the three allowed unmaintained warnings it already reported.
Bump tokio, async-compression and ctutils past their advisories
sneurlax
approved these changes
Oct 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.