吕柏青andClaude Opus 4.8
4e65ce15e1
C-01: 引入 keyring 持久化的 history.hmac_enrolled.v1 标志。首次写 sidecar 或 legacy 迁移时幂等置位；读路径遇 sidecar 缺失时——已置位则判定攻击者删除、 fail-safe 返回空（绝不接受/补签），未置位才走 legacy 接受+迁移。堵住「删 sidecar 伪装 legacy 绕过 HMAC」。 H-01: read_gemini_credentials 抽出 resolve_gemini_base_url，base_url 同样过 validate_llm_endpoint SSRF 校验。 H-02: hmac_hex_eq 改用 subtle::ConstantTimeEq（subtle 已在 Cargo.lock 传递依赖）。 M-01: history.json 与 sidecar 改 atomic_write_private，rename 前对 tmp 设 0o600， 消除 umask 世界可读窗口。 M-02: 补 SSRF 绕过变体测试（0x7f.0.0.1 / 2130706433 归一化为本地放行； user@192.168.1.1 拒绝；0.0.0.0 拒绝）。 M-03: keyring 不可用记一次 warn；文件密钥 fallback 文档留作后续。 rust 收口: encode_hex 用 write!；validate_llm_endpoint 统一剥 IPv6 方括号后判定 （修正「url 已去括号」的错误前提——host_str 对 IPv6 保留括号，原 fallback 实为 必需路径，已保留语义）；history 读取 TOCTOU 改直接 fs::read + NotFound 返空。 测试 460→467 passed，0 failed；cargo check 0 error；npm build 通过。 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
123 lines
3.8 KiB
TOML
123 lines
3.8 KiB
TOML
[package]
|
||
name = "openless"
|
||
version = "1.3.6-2"
|
||
description = "OpenLess — local voice input that types where your cursor is"
|
||
authors = ["OpenLess"]
|
||
edition = "2021"
|
||
rust-version = "1.77"
|
||
|
||
[lib]
|
||
name = "openless_lib"
|
||
crate-type = ["staticlib", "cdylib", "rlib"]
|
||
|
||
[build-dependencies]
|
||
tauri-build = { version = "2", features = [] }
|
||
# Compile vendored Open-Less/qwen-asr C sources for the local ASR engine on macOS.
|
||
cc = "1.1"
|
||
|
||
[dependencies]
|
||
# 锁 ~2.11 因为 npm @tauri-apps/api 与 plugin-dialog 都已升 2.11；
|
||
# tauri build 跨 minor 一致性检查会拒绝 npm 2.11 + Rust 2.10 的组合。
|
||
tauri = { version = "~2.11", features = ["macos-private-api", "tray-icon"] }
|
||
tauri-plugin-shell = "2"
|
||
tauri-plugin-updater = "2"
|
||
tauri-plugin-single-instance = "2"
|
||
tauri-plugin-autostart = "2"
|
||
tauri-plugin-dialog = "2"
|
||
serde = { version = "1", features = ["derive"] }
|
||
serde_json = "1"
|
||
# OpenRouter ASR 把音频以标准 base64（带 padding）放进 JSON body（issue #582）。
|
||
base64 = "0.22"
|
||
sha2 = "0.10"
|
||
# issue #609 F-03：history.json 完整性校验（HMAC-SHA256），密钥存系统凭据库。
|
||
hmac = "0.12"
|
||
# issue #609 H-02：HMAC 比较走常量时间，避免计时侧信道。已在依赖树（sha2/hmac 传递），
|
||
# 提升为直接依赖零额外编译成本。
|
||
subtle = "2"
|
||
# F-03 的 HMAC 密钥首次生成用 OS CSPRNG。0.3.x 已在依赖树里，提升为直接依赖零额外编译成本。
|
||
getrandom = "0.3"
|
||
bzip2 = "0.4"
|
||
tar = "0.4"
|
||
tokio = { version = "1", features = ["full"] }
|
||
tokio-tungstenite = { version = "0.24", features = ["rustls-tls-native-roots"] }
|
||
futures-util = "0.3"
|
||
reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls", "native-tls", "stream", "system-proxy"] }
|
||
zip = "2"
|
||
thiserror = "1"
|
||
anyhow = "1"
|
||
log = "0.4"
|
||
env_logger = "0.11"
|
||
simplelog = "0.12"
|
||
parking_lot = "0.12"
|
||
once_cell = "1"
|
||
uuid = { version = "1", features = ["v4", "serde"] }
|
||
chrono = { version = "0.4", features = ["serde"] }
|
||
bytes = "1"
|
||
url = "2"
|
||
raw-window-handle = "0.6"
|
||
ferrous-opencc = "0.4"
|
||
|
||
# Hotkey + audio + insertion
|
||
global-hotkey = "0.6"
|
||
cpal = "0.15"
|
||
enigo = "0.2"
|
||
arboard = { version = "3", features = ["wayland-data-control"] }
|
||
|
||
[target.'cfg(target_os = "macos")'.dependencies.keyring]
|
||
version = "3.6.3"
|
||
default-features = false
|
||
features = ["apple-native"]
|
||
|
||
[target.'cfg(target_os = "windows")'.dependencies.keyring]
|
||
version = "3.6.3"
|
||
default-features = false
|
||
features = ["windows-native"]
|
||
|
||
[target.'cfg(target_os = "linux")'.dependencies]
|
||
dbus = "0.9"
|
||
[target.'cfg(all(unix, not(target_os = "macos")))'.dependencies.keyring]
|
||
version = "3.6.3"
|
||
default-features = false
|
||
features = ["linux-native-sync-persistent", "crypto-rust"]
|
||
|
||
[target.'cfg(target_os = "macos")'.dependencies]
|
||
block2 = "0.5"
|
||
core-foundation = "0.10"
|
||
core-graphics = "0.24"
|
||
objc2 = "0.5"
|
||
objc2-foundation = "0.2"
|
||
objc2-app-kit = "0.2"
|
||
# qwen-asr 用 malloc 分配返回字符串，必须用 C `free()` 释放。
|
||
libc = "0.2"
|
||
|
||
[target.'cfg(target_os = "windows")'.dependencies]
|
||
foundry-local-sdk = { version = "1.1.0", features = ["winml"] }
|
||
raw-window-handle = "0.6"
|
||
sherpa-onnx = { version = "1.13.2", default-features = false, features = ["static"] }
|
||
windows = { version = "0.58", features = [
|
||
"Win32_Foundation",
|
||
"Win32_Globalization",
|
||
"Win32_Graphics_Dwm",
|
||
"Win32_Graphics_Gdi",
|
||
"Win32_Media_Audio",
|
||
"Win32_Media_Audio_Endpoints",
|
||
"Win32_System_Com",
|
||
"Win32_System_Ole",
|
||
"Win32_System_Registry",
|
||
"Win32_System_Threading",
|
||
"Win32_UI_HiDpi",
|
||
"Win32_UI_Input_KeyboardAndMouse",
|
||
"Win32_UI_Shell",
|
||
"Win32_UI_TextServices",
|
||
"Win32_UI_WindowsAndMessaging",
|
||
] }
|
||
winreg = "0.52"
|
||
|
||
# 跨平台磨砂层（macOS NSVisualEffectView / Windows Mica）。
|
||
[target.'cfg(any(target_os = "macos", target_os = "windows"))'.dependencies]
|
||
window-vibrancy = "0.7"
|
||
|
||
[features]
|
||
default = ["custom-protocol"]
|
||
custom-protocol = ["tauri/custom-protocol"]
|