glm-5.3-flash
08a3694464
Adopt the alk*/fuzzing posture (alkcall 0.8.1 + alktunnels 0.2.1 precedent) before the v0.1 publish — the cheapest moment this crate will ever have for it: - alkcall 0.8.1 + alktunnels 0.2.1: the duplicate-adopt/open fix is directly relevant to this crate's consumer open/adopt paths - fuzz/ workspace (the sibling layout): nightly-pinned subtree, stable fuzz/shared library (corpus replay = the fuzz gate), detached runner, JSON dict, deterministic seed generator; 129 committed seeds - three wave-1 targets over already-pub APIs: datagram_codec (the ASSOCIATE frame codec — the alkcall-fuzz-doc-assigned downstream target), rfc1928_codec (the forked RFC 1928 core's handshake state machines, both protocol directions), params_parse (the wire-stable open-op surface) - one diagnostic: DatagramReader::retained_bytes() (the decoder-state bound's assertion target, the alktunnels retained_bytes() posture) - docs/research/fuzzing.md: the scoped plan + implementation log; AGENTS.md gains the corpus-replay verification line - campaigns: 3 × 10-min detached runs exited 0 (datagram ~1.9M execs, rfc1928 ~2.0M, params ~3.1M; oom/timeout/crash 0/0/0 on all 33 fork jobs per target; coverage saturated on both codec targets). No crate bugs; three harness-model defects found + fixed (2 pre-campaign by corpus replay, 2 campaign-found, crash inputs promoted as seeds 900/ 901): the len==0 well-framed decode partition, the fieldless-struct serde-seq form, the BadAtyp re-frame arm, the short-domain count-walk gate - wave 2 (session_pumps stateful target) deferred to post-0.1 — the byte-level targets carry the attacker-reachable load for the publish Verification: cargo test (15 suites ok, default + all-features), clippy (all-targets + wasm + fuzz/shared), fmt, cargo doc, publish --dry-run, corpus replay 129 seeds green, cargo fuzz build clean. Refs: alkcall docs/research/fuzzing.md (§7.9 posture), alktunnels docs/research/fuzzing.md; docs/research/fuzzing.md (this crate's copy)
60 lines
2.5 KiB
TOML
60 lines
2.5 KiB
TOML
[package]
|
|
name = "alksocks"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
rust-version = "1.88"
|
|
license = "MIT OR Apache-2.0"
|
|
description = "SOCKS5 (RFC 1928) proxy protocol over alkcall channels: targeted-forked fast-socks5 typestate core plus producer/consumer sessions. Producer/consumer protocol crate."
|
|
repository = "https://git.alk.dev/alkdev/alksocks"
|
|
readme = "README.md"
|
|
keywords = ["socks5", "proxy", "rfc1928", "channels", "alkcall"]
|
|
categories = ["network-programming", "asynchronous"]
|
|
exclude = [".opencode/", "AGENTS.md", "docs/reviews/", "docs/research/", "docs/plans/", "tasks/", "docs/sdd_process.md", "fuzz/"]
|
|
|
|
[workspace]
|
|
members = ["."]
|
|
exclude = ["fuzz"]
|
|
|
|
[lib]
|
|
name = "alksocks"
|
|
|
|
[features]
|
|
# Declared empty by design (ADR-009): `local` adds tokio/net when its
|
|
# modules land, `composed` adds the alktunnels dep. The default build
|
|
# is protocol-only and wasm-clean by construction.
|
|
default = []
|
|
local = ["tokio/net"]
|
|
composed = ["dep:alktunnels"]
|
|
|
|
[dependencies]
|
|
# The substrate (convention 11): pinned, bump deliberately, never
|
|
# transitively. 0.8.1: the duplicate-adopt/open fix (the alkcall 0.8.1
|
|
# fuzz finding — the consumer sessions' open/adopt paths are exposed to
|
|
# the replayed-open-op scenario its changelog names).
|
|
alkcall = "0.8.1"
|
|
tokio = { version = "1", default-features = false, features = ["rt", "sync", "io-util", "macros", "time"] }
|
|
# The fork's declared logging seam (rfc1928.md: upstream `log` calls
|
|
# were dropped or re-pointed here); no source file references it yet —
|
|
# the first consumer is expected to be the producer layer's
|
|
# diagnostics (review 001 N-2).
|
|
tracing = "0.1"
|
|
thiserror = "2"
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
bytes = "1"
|
|
futures = { version = "0.3", default-features = false, features = ["std"] }
|
|
# The sibling crate (the composed egress's direct-op vehicle — ADR-008/
|
|
# ADR-009): rides `composed` alone. Pinned; bump deliberately
|
|
# (convention 11's deliberate-bump rule applies to siblings too).
|
|
# 0.2.1: the fuzzing graduation (its wave-1/wave-2 targets + the
|
|
# alkcall 0.8.1 bump), bug-fix release, no API/wire change.
|
|
alktunnels = { version = "0.2.1", optional = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { version = "1", features = ["full", "test-util", "macros"] }
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
# The composed suite's topology (the alktunnels direct-op producer) —
|
|
# dev-only: the test binary gates itself on the `composed` feature
|
|
# (`#![cfg(feature = "composed")]`), the dev-dep keeps it compiling.
|
|
alktunnels = "0.2.1"
|