lib

commit 281f9b86804f23db66f1170c04bc06ce68a57a62
parent a46797977a0f1df550c0abfdeab15b931cf3a9e1
Author: triesap <tyson@radroots.org>
Date:   Tue,  4 Aug 2026 11:47:22 +0000

fix(package): apply bootstrap during verification

- move local patches into cargo configuration
- make package verification inherit staged sources
- keep archive manifests registry-only
- retain the exact lower package allowlist

Diffstat:
M
.cargo/config.toml
 | 
23
+++++++++++++++++++++++
M
Cargo.toml
 | 
23
-----------------------

2 files changed, 23 insertions(+), 23 deletions(-)
diff --git a/.cargo/config.toml b/.cargo/config.toml
@@ -1,2 +1,25 @@
 [alias]
 xtask = "run -q -p xtask --"
+
+# Release-staging bootstrap for unpublished members. Cargo removes package
+# dependency paths while verifying `.crate` archives, so repository-local
+# configuration supplies exact sources until the ephemeral registry gate.
+# This configuration is not included in published archives.
+[patch.crates-io]
+radroots_core = { path = "crates/core" }
+radroots_identity = { path = "crates/identity" }
+radroots_blossom = { path = "crates/blossom" }
+radroots_protocol = { path = "crates/protocol" }
+radroots_event = { path = "crates/event" }
+radroots_event_codec = { path = "crates/event_codec" }
+radroots_trade = { path = "crates/trade" }
+radroots_signing = { path = "crates/signing" }
+radroots_transport = { path = "crates/transport" }
+radroots_nostr = { path = "crates/nostr" }
+radroots_nostr_connect = { path = "crates/nostr_connect" }
+radroots_secrets = { path = "crates/secrets" }
+radroots_storage = { path = "crates/storage" }
+radroots_storage_sqlite = { path = "crates/storage_sqlite" }
+radroots_transport_nostr = { path = "crates/transport_nostr" }
+radroots_sync = { path = "crates/sync" }
+radroots_geonames = { path = "crates/geonames" }
diff --git a/Cargo.toml b/Cargo.toml
@@ -245,26 +245,3 @@ uuid = { version = "1.22.0", features = ["v4", "v7"] }
 x509-parser = { version = "0.17", default-features = false }
 zstd = { version = "0.13", default-features = false }
 zeroize = { version = "1" }
-
-# Release-staging bootstrap for unpublished members. Cargo removes package
-# dependency paths while verifying `.crate` archives, so the workspace root
-# supplies the exact local sources until Step 310 proves the same graph through
-# an ephemeral registry. This table is not included in published archives.
-[patch.crates-io]
-radroots_core = { path = "crates/core" }
-radroots_identity = { path = "crates/identity" }
-radroots_blossom = { path = "crates/blossom" }
-radroots_protocol = { path = "crates/protocol" }
-radroots_event = { path = "crates/event" }
-radroots_event_codec = { path = "crates/event_codec" }
-radroots_trade = { path = "crates/trade" }
-radroots_signing = { path = "crates/signing" }
-radroots_transport = { path = "crates/transport" }
-radroots_nostr = { path = "crates/nostr" }
-radroots_nostr_connect = { path = "crates/nostr_connect" }
-radroots_secrets = { path = "crates/secrets" }
-radroots_storage = { path = "crates/storage" }
-radroots_storage_sqlite = { path = "crates/storage_sqlite" }
-radroots_transport_nostr = { path = "crates/transport_nostr" }
-radroots_sync = { path = "crates/sync" }
-radroots_geonames = { path = "crates/geonames" }