Cargo.toml

[package]
name = "image-rs"
version = "0.1.0"
description = "The OCI Images Rust Crate"
repository = "https://github.com/confidential-containers/guest-components/tree/main/image-rs"
readme = "README.md"
license = "Apache-2.0"
authors = ["The image-rs Authors"]
edition = "2021"

[dependencies]
anyhow.workspace = true
async-compression = { version = "0.4.18", features = [
    "futures-io",
    "tokio",
    "gzip",
    "zstd",
] }
async-trait.workspace = true
base64.workspace = true
cfg-if.workspace = true
devicemapper = { version = "0.34.4", optional = true }
dircpy = { version = "0.3.19", optional = true }
filetime = "0.2"
flate2 = "1.0"
fs_extra = { version = "1.2.0", optional = true }
futures = { version = "0.3.31", optional = true }
futures-util = "0.3"
hex = { workspace = true, optional = true }
kbc = { path = "../attestation-agent/kbc", default-features = false, optional = true }
lazy_static = { workspace = true, optional = true }
log = "0.4.22"
loopdev = { git = "https://github.com/mdaffin/loopdev", rev = "c9f91e8f0326ce8a3364ac911e81eb32328a5f27" }
nix = { workspace = true, optional = true, features = ["mount", "fs"] }
oci-client = { version = "0.14", default-features = false, optional = true }
oci-spec = "0.7.1"
ocicrypt-rs = { path = "../ocicrypt-rs", default-features = false, features = [
    "async-io",
], optional = true }
prost = { workspace = true, optional = true }
protobuf = { workspace = true, optional = true }
reqwest = { workspace = true, features = ["json"], optional = true }
resource_uri = { path = "../attestation-agent/deps/resource_uri", optional = true }
sequoia-openpgp = { version = "1.22.0", default-features = false, features = [
    "compression",
    "crypto-rust",
    "allow-experimental-crypto",
    "allow-variable-time-crypto",
], optional = true }
serde = { workspace = true, features = ["serde_derive", "rc"] }
serde_json.workspace = true
serde_yaml = { version = "0.9", optional = true }
sha2.workspace = true
sigstore = { git = "https://github.com/sigstore/sigstore-rs.git", rev = "037b7be86a68bc63e1d2ee7f16ea8f843ddcc7d8", default-features = false, optional = true }
strum.workspace = true
strum_macros = "0.26"
krata-tokio-tar = "0.4.2"
tokio.workspace = true
tokio-util = "0.7.13"
tonic = { workspace = true, optional = true }
ttrpc = { workspace = true, features = ["async"], optional = true }
url = "2.5.4"
walkdir = "2"
xattr = "1"
zstd = "0.13"

nydus-api = { version = "0.3.0", optional = true }
nydus-service = { version = "0.3.0", features = ["coco"], optional = true }

[build-dependencies]
anyhow.workspace = true
tonic-build = { workspace = true, optional = true }
ttrpc-codegen = { workspace = true, optional = true }

[dev-dependencies]
cfg-if.workspace = true
nix = { workspace = true, features = ["user"] }
ring.workspace = true
rstest.workspace = true
serial_test = "3.2.0"
strum.workspace = true
tempfile.workspace = true
test-utils = { path = "libs/test-utils" }
tokio = { workspace = true, features = ["process"] }

[features]
default = [
    "snapshot-overlayfs",
    "signature-cosign-rustls",
    "keywrap-grpc",
    "oci-client-rustls",
    "signature-simple-xrss"
]

# This will be based on `ring` dependency
kata-cc-rustls-tls = [
    "encryption-ring",
    "keywrap-ttrpc",
    "snapshot-overlayfs",
    "signature-cosign-rustls",
    "signature-simple",
    "kbs",
    "oci-client/rustls-tls",
    "reqwest?/rustls-tls",
]
enclave-cc-cckbc-rustls-tls = [
    "encryption-ring",
    "keywrap-native",
    "snapshot-unionfs",
    "signature-simple",
    "kbs",
    "signature-cosign-rustls",
    "oci-client-rustls",
    "reqwest?/rustls-tls",
]

# This will be based on `openssl` dependency
kata-cc-native-tls = [
    "encryption-openssl",
    "keywrap-ttrpc",
    "snapshot-overlayfs",
    "signature-cosign-native",
    "signature-simple",
    "kbs",
    "oci-client/native-tls",
    "reqwest?/default-tls",
]
enclave-cc-cckbc-native-tls = [
    "encryption-openssl",
    "keywrap-native",
    "snapshot-unionfs",
    "signature-simple",
    "kbs",
    "signature-cosign-native",
    "oci-client-native",
    "reqwest?/default-tls",
]

encryption = ["ocicrypt-rs/block-cipher"]
encryption-ring = [
    "ocicrypt-rs/block-cipher-ring",
    "kbc?/rust-crypto",
    "encryption",
]
encryption-openssl = [
    "ocicrypt-rs/block-cipher-openssl",
    "kbc?/openssl",
    "encryption",
]

keywrap-cmd = ["ocicrypt-rs/keywrap-keyprovider-cmd"]

keywrap-grpc = [
    "ocicrypt-rs/keywrap-keyprovider-grpc",
    "prost",
    "tonic",
    "tonic-build",
]
keywrap-native = [
    "ocicrypt-rs/keywrap-keyprovider-native",
    "kbc/cc_kbc",
    "kbc/sample_kbc",
    "kbc/sgx-attester",
    "resource_uri",
]
keywrap-ttrpc = [
    "ocicrypt-rs/keywrap-keyprovider-ttrpc",
    "dep:ttrpc",
    "dep:protobuf",
    "ttrpc-codegen",
]

# Enable keywrap-jwe to decrypt image
keywrap-jwe = ["ocicrypt-rs/keywrap-jwe"]

signature = ["hex"]
signature-cosign = ["signature", "futures"]
signature-cosign-rustls = ["signature-cosign", "sigstore/cosign-rustls-tls"]
signature-cosign-native = ["signature-cosign", "sigstore/cosign-native-tls"]

oci-client-rustls = ["oci-client/rustls-tls"]
oci-client-native = ["oci-client/native-tls"]

signature-simple-xrss = ["signature-simple", "dep:reqwest"]
signature-simple = ["signature", "sequoia-openpgp", "serde_yaml"]

snapshot-overlayfs = ["hex", "nix"]
snapshot-unionfs = ["nix", "dircpy", "fs_extra"]

# This features controls whether kbs uri scheme is supported in resource location, s.t. `kbs://...`
# it will try to connect to a service with `GetResource` API, typically `Confidential Data Hub`.
# The concrete way is via ttrpc (aligns with feature `keywrap-ttrpc`), gRPC (aligns with `keywrap-grpc`)
# or directly connects to KBS (aligns with feature `keywrap-native`. This way is used in enclave-cc)
kbs = []

nydus = ["lazy_static", "nydus-api", "nydus-service"]

verity = ["devicemapper"]