pkgwatch/Cargo.toml

[package]
name = "pkgwatch"
version = "0.1.0"
edition = "2024"

# Not part of a Cargo workspace — this crate is the whole repo. Declared
# explicitly (rather than just omitting it) so that checking this repo out
# as a nested git worktree can't accidentally pick up an ancestor
# directory's workspace manifest.
[workspace]

[dependencies]
anyhow = "1.0.104"
hex = "0.4.3"
regex = "1.13.1"
reqwest = { version = "0.13.5", default-features = false, features = ["blocking", "json", "rustls"] }
serde = { version = "1.0.229", features = ["derive"] }
sha2 = "0.11.0"
toml = "1.1.6"
First working iteration: check -> fetch -> verify for a real package Rust PoC (cargo, packages.d/*.toml config) that checks astral-sh/uv's GitHub Atom feed for a new release, fetches the matching asset via the GitHub API, and verifies it. Confirmed live against the real repo: uv actually ships GitHub build-provenance attestations (sigstore bundle) on every release, so it's a tier-2 package, not the tier-4 same-origin-sha256 guessed in the original spec draft. Verified via `gh attestation verify` rather than reimplementing sigstore in Rust. State persists across runs so a second run correctly reports "up to date." Also folds the finding back into SPEC.md: updates the uv example to tier 2, derives tier from verification method instead of storing both (avoids a tier/method mismatch that would mean nothing), marks the packages.d/ layout question resolved, and updates Architecture/Status to say what's actually implemented vs. still sketch (build/publish/review queue, same-origin-sha256 against a live repo, scheduling, non-GitHub sources, minisign are all still open). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A2FEut5tVMNjeVjqhgVZbr 2026-09-11 08:04:48 +00:00			`[package]`
			`name = "pkgwatch"`
			`version = "0.1.0"`
			`edition = "2024"`

Set up project tooling to match the rest of ~/dev's Rust fleet Surveyed sporah/doubleo7/feedsignal/uy-immigration-watcher/notif-picker for conventions and replicated the current dominant pattern rather than inventing a new one: - Forgejo CI (.forgejo/workflows/ci.yml): build/test/audit jobs on the rust-ci runner label, cargo+sccache caching, cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo audit. Matches sporah/doubleo7/feedsignal/uy-immigration-watcher; notif-picker's docker-label/manual-toolchain-install variant looks like an earlier iteration superseded by this one. - Makefile.toml with format/format-check/lint/test/audit/build tasks and a `ci` task chaining them — copied from notif-picker's clean version, the only project that had this pattern. `cargo make ci` now runs the same checks locally that CI runs. - Explicit empty [workspace] in Cargo.toml (doubleo7's pattern) so a nested git-worktree checkout can't accidentally inherit an ancestor directory's workspace manifest. - rustfmt: no rustfmt.toml, matching every sibling project — default style is the established convention here, not an oversight. New for this fleet, since nothing else in ~/dev has it: a git-native pre-commit hook (.githooks/pre-commit, activated via `cargo make install-hooks` / `git config core.hooksPath .githooks`) that runs `cargo fmt` and re-stages whatever it reformats. Chose git's native hooksPath over the pre-commit(.com) framework or cargo-husky — no extra runtime dependency, hook is tracked and shareable, and nothing else here needs Python. Kept to formatting only; clippy/audit stay in CI, which already covers them and can run heavier checks than a commit hook should. Fixed one clippy finding (useless format! in checker.rs) and reformatted the existing code to match the now-enforced default rustfmt style. `cargo make ci` passes clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A2FEut5tVMNjeVjqhgVZbr 2026-09-11 08:13:29 +00:00			`# Not part of a Cargo workspace — this crate is the whole repo. Declared`
			`# explicitly (rather than just omitting it) so that checking this repo out`
			`# as a nested git worktree can't accidentally pick up an ancestor`
			`# directory's workspace manifest.`
			`[workspace]`

First working iteration: check -> fetch -> verify for a real package Rust PoC (cargo, packages.d/*.toml config) that checks astral-sh/uv's GitHub Atom feed for a new release, fetches the matching asset via the GitHub API, and verifies it. Confirmed live against the real repo: uv actually ships GitHub build-provenance attestations (sigstore bundle) on every release, so it's a tier-2 package, not the tier-4 same-origin-sha256 guessed in the original spec draft. Verified via `gh attestation verify` rather than reimplementing sigstore in Rust. State persists across runs so a second run correctly reports "up to date." Also folds the finding back into SPEC.md: updates the uv example to tier 2, derives tier from verification method instead of storing both (avoids a tier/method mismatch that would mean nothing), marks the packages.d/ layout question resolved, and updates Architecture/Status to say what's actually implemented vs. still sketch (build/publish/review queue, same-origin-sha256 against a live repo, scheduling, non-GitHub sources, minisign are all still open). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A2FEut5tVMNjeVjqhgVZbr 2026-09-11 08:04:48 +00:00			`[dependencies]`
			`anyhow = "1.0.104"`
			`hex = "0.4.3"`
			`regex = "1.13.1"`
			`reqwest = { version = "0.13.5", default-features = false, features = ["blocking", "json", "rustls"] }`
			`serde = { version = "1.0.229", features = ["derive"] }`
			`sha2 = "0.11.0"`
			`toml = "1.1.6"`