Twenty-two direct third-party crates, listed below with the reason std is not
enough. Not used: byteorder (std to_le_bytes suffices), HTTP, QUIC,
Protobuf, an ORM, parser frameworks, telemetry
exporters, or in-house cryptographic implementations.
Regenerate the resolved graphs (they are not committed):
cargo tree -p scribe-server-cli -e normal,build --locked
cargo tree -p scribe-cli -e normal,build --locked
cargo tree --workspace -e features --locked
cargo tree --workspace --duplicates --locked156 packages resolve for the whole workspace including dev and build
dependencies (as of the pinned Cargo.lock). unsafe counts are greps of
unsafe in the crate's own sources (a size indicator, not an audit).
| crate | version | why std is insufficient | features | class | licence | unsafe | replacement / format impact |
|---|---|---|---|---|---|---|---|
| rpassword | 7.5.4 | hidden terminal password input and terminal-mode restoration on Unix/Windows; std cannot disable echo portably | defaults off; optional scribe-platform/password-prompt, enabled by client executable | normal (scribe-platform only) | Apache-2.0 | OS calls in upstream Unix/Windows terminal adapters; Scribe also wraps Carbon Secure Input in its macOS platform adapter; uses existing libc/windows-sys plus rtoolbox | replace behind scribe-platform::terminal; no stored/wire format changes |
| argon2 | 0.5.3 | salted and peppered, memory-hard password hashing and verification; std and fast content hashes cannot provide password storage | alloc, password-hash, defaults off; OS salt from existing getrandom | optional (scribe-auth/server) | MIT OR Apache-2.0 | 2 unsafe occurrences in own Rust sources for x86 AVX2 dispatch; transitive primitives have separate implementations | maintained Argon2id/PHC-compatible implementation; pins v19, m=19456, t=2, p=1, 16-byte salt, 32-byte result; adds password records, no repository/object format changes |
| lz4_flex | 0.14.0 (exact) | LZ4 compression/decompression for object storage and transfer; std has no compression codec | std, safe-encode, safe-decode; defaults off, no frame dependency | normal (scribe-format) | MIT | safe encoder and decoder selected; no application unsafe or native C; other disabled implementations contain unsafe | replace with a conforming LZ4 block implementation; block framing is specified by Scribe; identities hash original bytes, never compressor output |
| blake3 | 1.8.7 | optimized, tree-hashing content digest; std has no hash | std only (SIMD via build-time cc) | normal | CC0-1.0 OR Apache-2.0 | 231 (SIMD) | any replacement changes every identity: never |
| redb | 4.2.0 | transactional embedded store with immediate durability | std | normal | MIT OR Apache-2.0 | 47 (mmap-free, file I/O) | logical export/import exists for engine replacement |
| fastcdc | 5.0.0 | maintained streaming FastCDC 2020 | none (no futures/tokio) | normal | MIT | 0 | profile 1 cut points are pinned; a new chunker is a new profile id |
| ignore | 0.4.33 | Git-style matcher with correct nesting/negation/escaping | none | normal (workspace/client) | Unlicense OR MIT | 0 | semantics documented; matcher replaceable behind IgnoreSet |
| getrandom | 0.4.3 | OS randomness for opaque ids | std | normal | MIT OR Apache-2.0 | 114 (OS calls) | any CSPRNG source; no format impact |
| libc (unix targets only) | 0.2.189 | declarations for sendfile, fallocate/F_PREALLOCATE, posix_fadvise/F_RDAHEAD, FICLONE/clonefile, none of which std exposes | std | normal (scribe-platform only) | MIT OR Apache-2.0 | 0 | every call is one audited unsafe FFI block in crates/scribe-platform/src/sys/ with a std fallback in the same crate; no format impact |
| unicode-normalization | 0.1.25 | NFC for cross-platform path collision keys | none | normal | MIT OR Apache-2.0 | 5 | tables frozen per version; collision keys are rebuildable (current_fold) |
| tracing | 0.1.44 | structured diagnostics | std, attributes | normal | MIT | 7 | none |
| tracing-subscriber | 0.3.23 | Targets filter, fmt and JSON layers | fmt, std, json, ansi (no env-filter/regex) | normal (executables + scribe-log) | MIT | 26 | none |
| anstream | 1.0.0 | std detects terminals but does not adapt ANSI output to Windows consoles or strip styling from redirected streams | auto, wincon | normal (scribe-log; also shared with Clap) | MIT OR Apache-2.0 | 3 occurrences in own Rust sources; transitive platform bindings are separate | replace terminal stream adapter; no stored/wire format impact |
| tracing-appender | 0.2.5 | bounded non-blocking sink, daily rotation with retention | none | normal (scribe-log) | MIT | 0 | small; could be replaced by an in-tree channel writer |
| clap | 4.6.6 | argument parsing with usable errors | std, derive, help, usage, error-context, suggestions, color | normal (executables) | MIT OR Apache-2.0 | 0 | proc-macro at build time only |
| serde / serde_json | 1.0.229 / 1.0.151 | configuration and JSON diagnostics/reports; not wire or archive format | std, derive / std | normal (executables, scribe-log json, perf) | MIT OR Apache-2.0 | 2 / 15 | none on formats |
| toml | 1.1.5 | server configuration | std, serde, parse, display | normal (server executable, perf) | MIT OR Apache-2.0 | (parser crates) | none |
| ctrlc | 3.5.2 | SIGINT/SIGTERM for graceful shutdown and client password-prompt cancellation; std has no signal API | termination | normal (executables and perf harness) | MIT/Apache-2.0 | 15 (signal handlers) | shutdown-request file and cooperative stop checks replace handlers; no format impact |
| rustls | 0.23.43 | std provides no TLS or certificate verification; authenticated storage and auth service need maintained TLS | std, ring; TLS 1.3 only | normal (scribe-tls) | Apache-2.0 / ISC / MIT | 5 unsafe occurrences in rustls Rust sources; 230 in transitive ring Rust sources plus C/assembly (grep counts, not a security audit) | replace transport/provider behind scribe-tls; TLS3/SAU1 transport only, existing content identities and persisted v1 formats unchanged |
| tokio | 1.53.1 | scalable readiness-driven sockets, TLS waits, timers, tasks and bounded admission; std has no cross-platform async reactor | rt-multi-thread, net, io-util, sync, time, macros; no full/filesystem/process features | optional, server adapters only | MIT | 1068 unsafe occurrences in own src/**/*.rs (including comments/cfg modules); transitive mio/socket2/bytes have separate unsafe implementations | replace scheduler/transport behind adapters; synchronous RemoteOps, canonical frames and stored formats unchanged |
| tokio-rustls | 0.26.5 | maintained async rustls transport; std and blocking rustls streams cannot yield while waiting for TLS bytes | ring, defaults off (no AWS-LC/TLS 1.2) | optional, scribe-tls/server only | MIT OR Apache-2.0 | 0 unsafe occurrences in own src/**/*.rs; shares the existing rustls/ring provider | replace behind scribe-tls; same TLS 1.3 configuration and SAU1/TCP bytes, no identity or format impact |
Per executable (cargo tree -p ... -e normal,build): scribe links no
scribe-server, scribe-metadata, or redb-based server code, because the
TCP crate's server adapter is behind the server feature, and no auth
database or service, which sit behind scribe-auth/server and
scribe-auth/admin. All five executables share tracing,
tracing-subscriber, clap, and serde_json through scribe-log.
Tokio and tokio-rustls are enabled only through service features; a standalone
cargo tree -p scribe-cli -e normal,build --locked has neither. Workspace
builds may unify features with the server packages. This change adds six
resolved packages: tokio, tokio-macros, tokio-rustls, mio, socket2 and bytes.
The blocking pool has an explicit thread cap and a semaphore acquired before
spawn_blocking, with one queued request per admitted connection. Storage
transfers take an additional permit before the shared worker permit so bulk
traffic cannot occupy every mutation worker. A separate query semaphore
reserves read capacity when mutations wait for publication or the database
writer; both capacities are included in the blocking-thread cap. redb and its immediate durability are
unchanged; async networking does not remove filesystem flush latency.
Duplicates: syn 2 and 3 (proc-macro build dependencies of tracing-attributes
versus clap_derive/serde_derive); build-time only, no runtime duplication.
Feature graph inspection (cargo tree -e features): tracing-subscriber
resolves without env-filter or regex; its ansi feature is enabled because
with_ansi(true) requires it. Clap enables color, sharing the anstream
adapter used by command output and stderr logs. Color support adds nine
resolved packages: anstream, anstyle-parse, anstyle-query,
anstyle-wincon, colorchoice, is_terminal_polyfill, nu-ansi-term,
once_cell_polyfill, and utf8parse;
fastcdc resolves without futures/tokio; redb without logging.
Toolchain: pinned 1.96.0 in rust-toolchain.toml; MSRV declared 1.90
(File::try_lock, let-chains); Cargo.lock committed; CI builds --locked.
Updates to fastcdc, blake3, unicode-normalization, and redb need a
review against the pinned fixtures (cut points, digests, collision keys, and
the engine version recorded in descriptors).
Cryptography: rustls with the ring provider handles TLS, certificate
chains, hostnames, and handshake signatures; BLAKE3 produces token digests
and CA fingerprints plus keyed password-intent commitments; getrandom
produces tokens, peppers, salts and ids. RustCrypto
argon2 hashes passwords and verifies PHC strings on the auth server, using
Argon2::new_with_secret for the server-only pepper; Scribe implements no
cryptographic primitive. Argon2 adds twelve resolved packages (including PHC
encoding and maintained digest primitives) and is absent from the client
executable’s normal dependency graph. The transitive additions for TLS are rustls, ring,
and the webpki crates.
External tool
Certificate provisioning (scribe-cert, linked by scribe-server and
scribe-auth) runs an OpenSSL executable; it is not linked and not needed
at serving time.
| tool | purpose / why std is insufficient | features | licence | unsafe footprint | replacement / format impact |
|---|---|---|---|---|---|---|
| OpenSSL executable, 3+ | offline X.509 CA and server certificate generation/signing; std and rustls do not issue certificates | version, genpkey, req, x509, verify; ECDSA P-256 / SHA-256; no shell, no serving-time use | Apache-2.0 for OpenSSL 3+ | external native C/assembly process, not an audited Scribe dependency; operator supplies a trusted maintained installation | externally provisioned PEM or a maintained certificate generator; no repository, object, or wire encoding impact |
The OpenSSL command is required for the certificate provisioning tests; set
SCRIBE_TEST_OPENSSL to its executable path when it is not openssl on PATH.
The installed OpenSSL version is reported in CI before tests.
scribe-ctl reuses the listed TOML, Clap, serde/JSON, ctrlc, getrandom, and tracing
dependencies, plus the existing certificate, TLS, auth-admin, and platform crates.
It introduces no new external dependency. Process detachment is isolated in
scribe-platform using its existing libc dependency on Unix.
scribe-gateway reuses the existing TCP server adapter, TLS, platform, metadata,
format, redb, TOML, Clap, serde/JSON, ctrlc, and tracing dependencies. It adds no
third-party package. The gateway ledger uses redb immediate durability with a
separate canonical routing record. Live instance disk-space
queries add a direct scribe-platform dependency to scribe-server. The client
contract suite uses the gateway as a dev dependency; the shipped client does not
link gateway or server implementation code.