Skip to content

Release 0.1.1: target fallback, SOCKS proxies, feature builds - #15

Merged
yfedoseev merged 2 commits into
mainfrom
release/0.1.1
Sep 30, 2026
Merged

Release 0.1.1: target fallback, SOCKS proxies, feature builds#15
yfedoseev merged 2 commits into
mainfrom
release/0.1.1

Conversation

@yfedoseev

@yfedoseev yfedoseev commented Sep 30, 2026

Copy link
Copy Markdown
Owner

Closes #13
Closes #14

Fixes

  • custom features #14: fall back to compatible targets. If a release has no binary for the exact host target, each source (binstall metadata, GitHub Releases, QuickInstall) also tries targets the system can run:

    • glibc Linux: -musl
    • musl build of crgx on glibc: -gnu, but not on Alpine, where the gcompat shim doesn't count as glibc
    • macOS: universal builds, plus x86_64 on Apple Silicon when Rosetta is installed
    • Windows MSVC: -gnu, and gnullvm on ARM64

    cargo-about 0.9.2, which publishes only musl Linux builds, now runs on glibc Linux.

  • proxy support #13: SOCKS proxies. socks4/socks4a/socks5/socks5h from ALL_PROXY/HTTPS_PROXY were silently ignored because ureq's socks-proxy feature was off. Also enabled the Windows system proxy, and -v shows the proxy in use (without credentials).

  • Download size limit. Archives over 10 MiB failed (ureq's default body limit). The limit is now 1 GiB.

  • Crate name validation. Names are checked before they're used as a cache path, so a specifier like ../../x@1.0.0 can no longer run a file outside the cache.

Added

  • custom features #14: -F/--features, --no-default-features and --all-features. They build from source and cache under a separate key (e.g. cargo-about+features=cli).
  • GITHUB_TOKEN/GH_TOKEN for GitHub API requests (sent only to api.github.com).
  • CRGX_CACHE_DIR and upstream URL overrides, used by the e2e tests.

Dependencies and security

  • Every dependency updated to its latest version. This fixes the advisories 0.1.0 shipped with:
    • rustls: RUSTSEC-2026-0285
    • rustls-webpki: RUSTSEC-2026-0049, -0098, -0099, -0104
    • tar: RUSTSEC-2026-0068
  • xz2 (unmaintained) replaced by liblzma; dirs upgraded to 7.
  • Removed the unused clap, anyhow, url and mockito.
  • cargo audit -D warnings and cargo deny check advisories bans pass.

Tests

  • 83 unit tests.
  • 26 e2e tests in tests/e2e.rs, which run the real binary against a mock crates.io, GitHub and QuickInstall. They cover the direct path, real SOCKS5/SOCKS5h/HTTP CONNECT proxy servers and a stub cargo. Four of them (--ignored) hit the real internet, including through both proxy types.
  • Checked by reverting each fix: dropping the socks-proxy feature, the target fallback or the feature-build path each makes its tests fail.
  • Also passed locally in Docker: Alpine, Alpine with gcompat, and a musl-target build on glibc Debian.

CI

New jobs:

  • e2e on Linux, macOS and Windows
  • a musl build on a glibc host
  • Alpine, with and without gcompat
  • network smoke tests on all three OSes, using GITHUB_TOKEN
  • a weekly schedule, with the audit failing on unmaintained or unsound crates too

Not verified locally

  • The Windows and macOS runs. This PR's CI is their first run.

Known limitations

  • If a fallback binary still can't run, it stays cached until --cache-clean.
  • On case-insensitive filesystems, feature names that differ only by case share a cache entry.

@yfedoseev
feat: release 0.1.1 — target fallback, SOCKS proxies, feature builds
ef109b3 
Fixes #13, #14.

- fix(resolve): try compatible targets when the host target has no
  binary (gnu->musl, musl->gnu with real glibc, darwin->universal and
  x86_64 with Rosetta, windows msvc->gnu/gnullvm) across binstall,
  GitHub Releases and quickinstall; record the resolved target
- fix(http): enable ureq socks-proxy (SOCKS from ALL_PROXY was silently
  ignored) and win-system-proxy; show the proxy in --verbose
- fix(download): raise the 10 MiB ureq body limit to 1 GiB
- feat(cli): -F/--features, --no-default-features, --all-features build
  from source and cache under a separate key
- feat(github): use GITHUB_TOKEN/GH_TOKEN for api.github.com only
- fix(config): validate crate names (no path traversal into the cache)
- chore(deps): update all deps (fixes RUSTSEC advisories in rustls,
  rustls-webpki, tar), xz2 -> liblzma, dirs 7, drop unused clap, anyhow,
  url, mockito
- test: hermetic e2e suite (mock upstreams, SOCKS5/HTTP proxies, stub
  cargo) plus network smoke tests
- ci: musl-on-glibc, Alpine (+gcompat), network smoke on 3 OSes,
  weekly schedule, audit denies warnings
This was referenced Sep 30, 2026
Closed
Closed
@yfedoseev
test(e2e): don't hard-code the full fallback list in the no-binary test
0eabedf 
On macOS runners with Rosetta the list is host, universal, universal2,
x86_64; assert host-first and first-fallback instead.
@yfedoseev
yfedoseev merged commit d257759 into main Sep 30, 2026
14 checks passed
@yfedoseev
yfedoseev deleted the release/0.1.1 branch September 30, 2026 21:06
This was referenced Sep 30, 2026
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

custom features proxy support

1 participant

@yfedoseev