From c978f59725ab4995daa9e0df9b2df8b7d30e7182 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:13:29 +0900
Subject: [PATCH 1/6] Prepare standalone Rust application builds with a pinned
 released SDK

---
 .github/workflows/rust-sdk-check.yml |   17 +
 actions/setup-rust-sdk/action.yml    |   22 +
 rust-sdk/README.md                   |   50 +
 rust-sdk/build.py                    |  154 ++
 rust-sdk/komeup.Cargo.lock           | 2113 ++++++++++++++++++++++++++
 rust-sdk/setup.py                    |  146 ++
 rust-sdk/sources.lock.json           |   46 +
 rust-sdk/tests/test_build.py         |   71 +
 8 files changed, 2619 insertions(+)
 create mode 100644 .github/workflows/rust-sdk-check.yml
 create mode 100644 actions/setup-rust-sdk/action.yml
 create mode 100644 rust-sdk/README.md
 create mode 100644 rust-sdk/build.py
 create mode 100644 rust-sdk/komeup.Cargo.lock
 create mode 100644 rust-sdk/setup.py
 create mode 100644 rust-sdk/sources.lock.json
 create mode 100644 rust-sdk/tests/test_build.py

diff --git a/.github/workflows/rust-sdk-check.yml b/.github/workflows/rust-sdk-check.yml
new file mode 100644
index 0000000..1e9d1bd
--- /dev/null
+++ b/.github/workflows/rust-sdk-check.yml
@@ -0,0 +1,17 @@
+name: Check standalone Rust application SDK
+on:
+  push:
+    branches: [staging, main, master]
+    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', '.github/workflows/rust-sdk-check.yml']
+  pull_request:
+    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', '.github/workflows/rust-sdk-check.yml']
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - run: python3 -m unittest discover -s rust-sdk/tests -v
diff --git a/actions/setup-rust-sdk/action.yml b/actions/setup-rust-sdk/action.yml
new file mode 100644
index 0000000..f9d5d96
--- /dev/null
+++ b/actions/setup-rust-sdk/action.yml
@@ -0,0 +1,22 @@
+name: Set up mochiOS Rust application SDK
+description: Install a pinned C SDK through komeup and prepare Rust, AppCore and ViewKit without an OS checkout.
+inputs:
+  output:
+    description: Fresh directory for the isolated SDK (prefer runner.temp).
+    required: true
+outputs:
+  sdk:
+    description: Local app-build.json, for this runner only; do not publish it.
+    value: ${{ steps.setup.outputs.sdk }}
+  helper:
+    description: Path to the generic Rust app build/test/staging helper.
+    value: ${{ steps.setup.outputs.helper }}
+runs:
+  using: composite
+  steps:
+    - id: setup
+      shell: bash
+      env:
+        SDK_OUTPUT: ${{ inputs.output }}
+        SDK_ACTION: ${{ github.action_path }}
+      run: python3 "$SDK_ACTION/../../rust-sdk/setup.py" --output "$SDK_OUTPUT"
diff --git a/rust-sdk/README.md b/rust-sdk/README.md
new file mode 100644
index 0000000..b433942
--- /dev/null
+++ b/rust-sdk/README.md
@@ -0,0 +1,50 @@
+# Standalone Rust application builds
+
+`actions/setup-rust-sdk` prepares a native Rust application build environment on
+Ubuntu 24.04. It installs the explicit released C/C++ SDK through komeup, verifies
+the reviewed archive SHA-256, and fetches the fixed Rust std, ViewKit, font and
+protocol sources from `sources.lock.json`. AppCore comes from the same DevKit
+revision as the Action. No OS checkout, image build, SDK release, credential or
+organization membership is required.
+
+This initial source SDK prepares one application at a time. It uses the existing
+mochiOS Rust std fork and pinned nightly compiler. It is not a newly published
+binary Rust SDK. The runner-local `app-build.json` contains local paths and must
+not be uploaded or shipped. Immutable source pins and font hashes are public;
+the installation does not change the developer's default komeup/rustup choices.
+
+Example caller (replace `staging` with a reviewed full commit SHA):
+
+```yaml
+- id: sdk
+  uses: mochiOS/devkit/actions/setup-rust-sdk@staging
+  with:
+    output: ${{ runner.temp }}/mochios-rust-sdk
+- name: Test, compile and stage
+  env:
+    HELPER: ${{ steps.sdk.outputs.helper }}
+    SDK: ${{ steps.sdk.outputs.sdk }}
+  run: python3 "$HELPER" --source "$GITHUB_WORKSPACE" --sdk "$SDK" --output "$RUNNER_TEMP/app-build" --test
+- id: package
+  uses: mochiOS/devkit/actions/build-mpkg@20d3fb71b952ae7a4ff583dafe8cc3d00e24d3a3
+  with:
+    manifest: ${{ runner.temp }}/app-build/stage/manifest.toml
+    payload: ${{ runner.temp }}/app-build/stage/payload
+    output: dist/Example.mpkg
+```
+
+Compilation and native host unit tests run in an isolated staged Cargo project.
+The helper maps the existing AppCore/protocol source dependencies into the SDK,
+preserves the application's lockfile as input, and exports its actual resulting
+resolution as `resolved.Cargo.lock` for review. It never edits or rolls back the
+source checkout's Cargo.lock. SDK changes can require adopting this resolution
+into the application repository before production release.
+
+The staging helper supports a single-entry Rust application with a completed
+MPKG manifest. It preserves document associations and requested capabilities,
+copies declared resources, binds real file hashes/modes, removes source-tree
+built-in provenance, and changes the binary destination to the normal
+`/applications/<name>.app` package path. ELF and host-path checks do not execute
+target programs and do not establish native runtime success. The public MPKG
+Action separately creates the unsigned container. Signing, approval and release
+publication remain caller workflow responsibilities.
diff --git a/rust-sdk/build.py b/rust-sdk/build.py
new file mode 100644
index 0000000..d9d2405
--- /dev/null
+++ b/rust-sdk/build.py
@@ -0,0 +1,154 @@
+#!/usr/bin/env python3
+"""Build/test a Rust app and stage an unsigned package for the public MPKG Action."""
+import argparse
+import copy
+import hashlib
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import shutil
+import struct
+import subprocess
+import tomllib
+
+
+def run(args, **kwargs):
+    """Preserve real compiler and test failures with streaming build output."""
+    subprocess.run([str(a) for a in args], check=True, **kwargs)
+
+
+def dumps(data):
+    """Write ordinary Cargo/MPKG tables, preserving nested metadata and array tables."""
+    lines = []
+    def table(mapping, path=(), header=None):
+        if header:
+            lines.append(header)
+        children = []
+        for key, value in mapping.items():
+            if isinstance(value, dict) or (isinstance(value, list) and value and isinstance(value[0], dict)):
+                children.append((key, value))
+            else:
+                lines.append(json.dumps(key) + ' = ' + json.dumps(value, ensure_ascii=True, allow_nan=False))
+        for key, value in children:
+            child = (*path, key)
+            name = '.'.join(json.dumps(p) for p in child)
+            for item in value if isinstance(value, list) else [value]:
+                lines.append('')
+                table(item, child, '[[' + name + ']]' if isinstance(value, list) else '[' + name + ']')
+    table(data)
+    return '\n'.join(lines) + '\n'
+
+
+def resource(source, name):
+    """Find a declared bundle-local resource without following links outside source."""
+    path = PurePosixPath(name)
+    if not name or path.is_absolute() or '..' in path.parts or '\\' in name:
+        raise ValueError('Invalid resource path: ' + name)
+    for candidate in (source / name, source / 'resources' / name):
+        if candidate.is_file() and candidate.resolve().is_relative_to(source.resolve()):
+            return candidate
+    raise ValueError('Missing or external resource: ' + name)
+
+
+def stage(source, binary, output, licenses=None):
+    """Preserve capabilities/associations and bind actual files without claiming built-in trust."""
+    with binary.open('rb') as stream:
+        header = stream.read(64)
+    if len(header) != 64 or header[:6] != b'\x7fELF\x02\x01' or struct.unpack_from('<HH', header, 16) != (2, 62):
+        raise ValueError('Expected a native x86-64 ELF executable')
+    manifest = copy.deepcopy(tomllib.loads((source / 'manifest.toml').read_text()))
+    package, app = manifest['package'], manifest['application']
+    package.pop('provenance', None)
+    name = package['name']
+    if not re.fullmatch('[A-Za-z][A-Za-z0-9_-]*', name) or app['entry'] != 'entry.elf' or len(manifest.get('binary', [])) != 1:
+        raise ValueError('Expected a single-entry native application')
+    if output.exists():
+        raise ValueError('Use a fresh package stage')
+    bundle = output / 'payload/bundle'
+    bundle.mkdir(parents=True)
+    shutil.copyfile(binary, bundle / 'entry.elf')
+    (bundle / 'entry.elf').chmod(0o755)
+    for name in dict.fromkeys([app['icon'], *app.get('resources', [])]):
+        target = bundle / name
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(resource(source, name), target)
+        target.chmod(0o644)
+    if licenses and licenses.is_dir():
+        shutil.copytree(licenses, bundle / 'licenses/fonts')
+    manifest['file'] = []
+    for index, path in enumerate(sorted(bundle.rglob('*'))):
+        if path.is_file():
+            relative = path.relative_to(bundle).as_posix()
+            path.chmod(0o755 if relative == 'entry.elf' else 0o644)
+            manifest['file'].append(dict(id='f' + str(index), path='$/' + relative,
+                digest='sha256:' + hashlib.sha256(path.read_bytes()).hexdigest(), size=path.stat().st_size,
+                mode='0755' if relative == 'entry.elf' else '0644'))
+    entry = next(f for f in manifest['file'] if f['path'] == '$/entry.elf')
+    manifest['binary'][0].update(path='/applications/' + package['name'] + '.app/entry.elf', file=entry['id'])
+    (output / 'manifest.toml').write_text(dumps(manifest))
+    return manifest
+
+
+def build(source, output, sdk, tests):
+    """Build independently of the caller's checkout layout; never change its lockfile."""
+    project = output / 'project'
+    project.mkdir(parents=True)
+    manifest = tomllib.loads((source / 'Cargo.toml').read_text())
+    for group in [manifest.get('dependencies', {})] + [v.get('dependencies', {}) for v in manifest.get('target', {}).values()]:
+        for dependency in group.values():
+            if not isinstance(dependency, dict) or 'path' not in dependency:
+                continue
+            path = dependency['path']
+            if path == '../../tools/devkit/crates/appcore':
+                dependency['path'] = sdk['appcore']
+            elif path.startswith('../../user/crates/'):
+                dependency['path'] = str(Path(sdk['user']) / 'crates' / path.removeprefix('../../user/crates/'))
+            elif (source / path).resolve().is_relative_to(source):
+                dependency['path'] = str((source / path).resolve())
+            else:
+                raise ValueError('External path dependency needs an explicit SDK mapping: ' + path)
+    for child in source.iterdir():
+        if child.name not in ('.git', '.github', 'out', 'target', 'Cargo.toml', 'Cargo.lock'):
+            (project / child.name).symlink_to(child.resolve(), target_is_directory=child.is_dir())
+    (project / 'Cargo.toml').write_text(dumps(manifest))
+    shutil.copyfile(source / 'Cargo.lock', project / 'Cargo.lock')
+    options = []
+    for config in sdk['cargo_config']:
+        options += ['--config', config]
+    host_env = dict(os.environ, **sdk['fonts'], CARGO_PROFILE_TEST_DEBUG='0')
+    for key in ('RUSTFLAGS', 'CARGO_ENCODED_RUSTFLAGS', 'RUSTC', 'RUSTDOC'):
+        host_env.pop(key, None)
+    if tests:
+        run(['cargo', 'test', '--manifest-path', project / 'Cargo.toml', '--target-dir', output / 'host-target', *options],
+            env=host_env, cwd=project)
+    env = dict(host_env, RUSTC=sdk['rustc'], RUSTDOC=sdk['rustdoc'],
+               CARGO_ENCODED_RUSTFLAGS='\x1f'.join(sdk['rustflags'] + ['--remap-path-prefix=' + str(source) + '=/src/app',
+                 '--remap-path-prefix=' + str(output) + '=/build/app']))
+    run([sdk['cargo'], 'build', '--release', '-Z', 'build-std=std,panic_abort,compiler_builtins', '-Z', 'json-target-spec',
+         '--manifest-path', project / 'Cargo.toml', '--target', sdk['target'], '--target-dir', sdk['target_dir'],
+         '--bin', manifest['package']['name'], *options], env=env, cwd=project)
+    shutil.copyfile(project / 'Cargo.lock', output / 'resolved.Cargo.lock')
+    binary = Path(sdk['target_dir']) / Path(sdk['target']).stem / 'release' / manifest['package']['name']
+    for option in ('-l', '-d', '--version-info'):
+        text = subprocess.check_output(['readelf', option, str(binary)], text=True)
+        if any(value in text for value in ('GLIBC_', 'libc.so.6', '/ld-linux', '(RUNPATH)', '(RPATH)')):
+            raise ValueError('Host linkage or runtime search path in native executable')
+    data = binary.read_bytes()
+    for prefix in (str(source), str(output), str(Path.home())):
+        if prefix.encode() in data:
+            raise ValueError('Build-host path in executable')
+    package = stage(source, binary, output / 'stage', Path(sdk['font_licenses']))
+    revision = subprocess.check_output(['git', '-C', str(source), 'rev-parse', 'HEAD'], text=True).strip()
+    (output / 'build-info.json').write_text(json.dumps(dict(format=1, source_commit=revision,
+        package=package['package'], sources=sdk['sources'], runtime_tested=False, signed=False), indent=2) + '\n')
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--source', type=Path, required=True)
+    parser.add_argument('--sdk', type=Path, required=True)
+    parser.add_argument('--output', type=Path, required=True)
+    parser.add_argument('--test', action='store_true')
+    args = parser.parse_args()
+    build(args.source.resolve(), args.output.resolve(), json.loads(args.sdk.read_text()), args.test)
diff --git a/rust-sdk/komeup.Cargo.lock b/rust-sdk/komeup.Cargo.lock
new file mode 100644
index 0000000..53c450b
--- /dev/null
+++ b/rust-sdk/komeup.Cargo.lock
@@ -0,0 +1,2113 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "cc"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86e055fa6e3e40ad6187ba25b6855eeb635d5271f8e0f0e1e9a5826b8d75bea0"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "clap"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa8876b300ab35ba921adea3dfd70157a46249b33f95c9084ae5709785478946"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0797fb7aeb1406c84efac526901f7ec3ead2124f946b494e72879d4b54704d"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9c751b79415d4e559e3d1fcf128e09e720eb673a06d26cf6f392d37d75b66e0"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c133bc6a41be0d194c306b5506d15e6feeea7b1d6604bd3f8310dfb2ca96486"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c66915cc5391097de7a2b0b972e8505aa33c0df401fd3a6811dbdb32881ba48"
+
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-io"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc03d96684f9226b8a787cdb71488417b53ab5ea8fdb1dac946cb9431cc8bff"
+dependencies = [
+ "base64 0.23.1",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "httparse",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe090a42a0d3140fed8c63263ed1fecc02422cb2f4bfe55cd8de2de1b8e105dd"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25d29b57c17c6528d0dc4c2141cfa2d08200465acb537a3909c8b9b8a4a984c0"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "404a3b8c486f205c87fe7f23ab6894d84a4ad76d6e4671ae1981ba7def87c599"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20f0088bfb7441f7a37fa0c9e20cb1e9cba1cac6b9ce8cd2a6dc44294f8e8cbc"
+
+[[package]]
+name = "icu_properties"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ea83d991c56158f7cf898bf86436c1dfe7c07ee82fe88951f2695c9f37a379f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98f29af82d02b163fe50161388350e743bb3107cc8e8c2f7314cb505faddfcf"
+
+[[package]]
+name = "icu_provider"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413099315636c588ee8f011190b329b971a09a8fae9d157e01dcae8379468514"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc4e190f5d26ca7051642629da2c52fc03bde85a03197c99408dcd291734c855"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bd1574e617a9a6c1f8f8181bd7e841e1f20e4277607ef28945765188d6284d4"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dc09d2154098bbf4ef54eab6b117a3c24cbbffe94046b16ee6d6d4510584d3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "komeup"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap",
+ "dirs",
+ "flate2",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tar",
+ "tempfile",
+ "toml",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.191"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+
+[[package]]
+name = "libredox"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d9d19d1d6efa0109d2f65ff4c85cddd50bd572e5a00127ab10987290bcefae"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b18443e9c262bfe8fa82f51666e2642c53393f7e5c27b3e1aeab922cff5b9d8"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d83eb9bc6d8e5cf568e7a1101d60ee05e81ed50ea106026f3d18deeb046d7661"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4e608c6638b9c18977b00b475ac1f28d14e84b27d8d42f70e0bf1e3dec127ac"
+dependencies = [
+ "getrandom 0.2.17",
+ "libredox",
+ "thiserror",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.154"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.16.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "149309498a5f7334b12ddae0cad8aba81ce785fe91755068867e017cf98fee46"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ae9ccbea3a7b0b09443036490c8f34a8b1b760fd345e5c0dae0aac718faea79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "901704edd0dfe137f1987838ee4f259e4e063c31371bdb423f7ae38ec6f77f02"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abc840c238154d58f9e86b2792261edfde565a17696e1cda1a449de27979801a"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
+[[package]]
+name = "tokio"
+version = "1.54.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b52fd3255258d26fac7264ab5a76b53c13367136dc011d3d6ad4f8ed070396a3"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.8+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.2.0+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "009dbb7700f11c55ef83aebbe4c0e9cf1f1ac0844bd8d6f00dc38f302026e13a"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2c754d6c33795a1c324727428e5a7dedb5b06195f9890bdbcba760d3e246563"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af3bd9d3e571c26fcce9d033b87ea5ab061b8d2ffe9b7a5675d810d68f03edf0"
+dependencies = [
+ "utf_types",
+]
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "utf_types"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a3b425286980a367278453f3b6d28cdcb134b574e5a35824a6ff5eebad50bb6"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.4+wasi-0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67efb37e106e55ce722a510d6b5f9c17f083e5fc79afc2badeb12cc313d9487"
+dependencies = [
+ "wit-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0181c14ddd6c7b8b0b0132a5f1ea2f32be0d893cd3ea97b6e3b28886b8a3d1c"
+dependencies = [
+ "cfg-if",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e14e0327cb5368ad60ccb22d04a9827a693c95a926d8d125e9fa39e0baec501"
+dependencies = [
+ "js-sys",
+ "tokio",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e931a02a39abdbf66966fc35902b5ed58344750a70885bed4ebb3d8eaf28ed9"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ca4b54280e455bd831e33a6b8e734baf432fe63fbc35c42ac14ce67a043a53a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.130"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b1f9c3798725016c6ee5f2f57869ec0831e8bbc0ab0310a86e787e97f41389e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7d179596ff5ec0f6de4db64d54011bde6289cc49603d3a6e4ce3f329207ab88"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "writeable"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
+
+[[package]]
+name = "xattr"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
+dependencies = [
+ "libc",
+ "rustix",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "417ef3fcf6c300b7dbd25c85531a746931c02ad536f3cf4786ed1e88223340b3"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec8ebde2db3681e8c9980cc27822030e68752690ddfa9473e739aeb4dbde6d71"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86502bf56ac7c77571a32e2647bb2a15894565e981fb2a48d7bde2d91c965a9d"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.62"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5457206954b06561e2608c7e19cf58b1926586d999c246eebe4502f7e2039d1a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f75b4683f6c7f45248d4d64056a24298c6281e0993356d7d1b4a1a962ef10d4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
+
+[[package]]
+name = "zerotrie"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea269c3bd32f0a32c321907a2ae912ba6f4649bb0fc764a15627e99a7095a3f"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f58a2799cfe9a1670c7ea8edbd52ef8edb93cb37a7f83bf31ba9e35d9dae6a40"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3743ddbf47738d929cd1ae2e199d40d0162979dfe31aef8ae646d2bf00bf97a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.10",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
diff --git a/rust-sdk/setup.py b/rust-sdk/setup.py
new file mode 100644
index 0000000..b01512b
--- /dev/null
+++ b/rust-sdk/setup.py
@@ -0,0 +1,146 @@
+#!/usr/bin/env python3
+"""Compose a Rust application SDK from source pins and a released SDK, without an OS checkout."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import shlex
+import shutil
+import subprocess
+import tomllib
+
+HERE = Path(__file__).resolve().parent
+
+
+def run(*args, **kwargs):
+    """Stream real tool diagnostics and propagate failures."""
+    subprocess.run([str(a) for a in args], check=True, **kwargs)
+
+
+def checkout(root, name, spec):
+    """Fetch a full reviewed commit, never a mutable branch or submodule graph."""
+    if not re.fullmatch(r'[0-9a-f]{40}', spec['revision']):
+        raise ValueError('Expected a full source commit ID')
+    target = root / name
+    target.mkdir(parents=True)
+    run('git', 'init', target)
+    run('git', '-C', target, 'remote', 'add', 'origin', 'https://github.com/' + spec['repository'] + '.git')
+    if name == 'libraries/rust':
+        run('git', '-C', target, 'sparse-checkout', 'set', 'library', 'src/mochios-backtrace',
+            'src/mochios-libunwind', 'vendor/rustc-literal-escaper')
+    run('git', '-C', target, 'fetch', '--depth=1', '--filter=blob:none', 'origin', spec['revision'])
+    run('git', '-C', target, 'checkout', '--detach', spec['revision'])
+    if subprocess.check_output(['git', '-C', str(target), 'rev-parse', 'HEAD'], text=True).strip() != spec['revision']:
+        raise ValueError('Source revision mismatch')
+
+
+def configs(root):
+    """Use a coherent source graph for standard-library, framework and protocol crates."""
+    patches = {'crates-io': {'libc': root / 'libraries/libc', 'viewkit': root / 'libraries/viewkit'},
+               'https://github.com/mochiOS/libc': {'libc': root / 'libraries/libc'},
+               'https://github.com/mochiOS/viewkit': {'viewkit': root / 'libraries/viewkit'},
+               'https://github.com/mochiOS/mnu': {'mnu-abi': root / 'core/crates/abi'},
+               'https://github.com/mochiOS/mBoot': {'mboot-protocol': root / 'services/mboot-protocol'}}
+    patches['https://github.com/mochiOS/syscalls'] = {
+        tomllib.loads(p.read_text())['package']['name']: p.parent for p in (root / 'user/crates').glob('*/Cargo.toml')}
+    for name in ('core', 'alloc', 'std'):
+        patches['crates-io']['rustc-std-workspace-' + name] = root / 'libraries/rust/library' / ('rustc-std-workspace-' + name)
+    return ['patch.' + json.dumps(source) + '.' + json.dumps(name) + '.path=' + json.dumps(str(path))
+            for source, crates in patches.items() for name, path in crates.items()]
+
+
+def overlay(root, toolchain):
+    """Pair the known Rust compiler with mochiOS std, preserving the installed rustup tree."""
+    run('rustup', 'toolchain', 'install', toolchain, '--profile', 'minimal', '--component', 'rust-src')
+    base = Path(subprocess.check_output(['rustc', '+' + toolchain, '--print', 'sysroot'], text=True).strip())
+    output = root / 'rust-overlay'
+    (output / 'bin').mkdir(parents=True)
+    library = output / 'lib/rustlib/src/rust/library'
+    library.mkdir(parents=True)
+    for path in (base / 'bin').iterdir():
+        dest = output / 'bin' / path.name
+        if path.name in ('rustc', 'rustdoc'):
+            dest.write_text('#!/bin/sh\nexec ' + shlex.quote(str(path)) + ' --sysroot ' + shlex.quote(str(output)) + ' "$@"\n')
+            dest.chmod(0o755)
+        else:
+            dest.symlink_to(path)
+    for path in (base / 'lib').iterdir():
+        if path.name != 'rustlib':
+            (output / 'lib' / path.name).symlink_to(path)
+    for path in (base / 'lib/rustlib').iterdir():
+        if path.name != 'src':
+            (output / 'lib/rustlib' / path.name).symlink_to(path)
+    source = root / 'libraries/rust'
+    for path in (source / 'library').iterdir():
+        if path.name not in ('backtrace', 'vendor'):
+            if path.name == 'std':
+                shutil.copytree(path, library / 'std', copy_function=lambda src, dst: os.symlink(src, dst))
+            else:
+                (library / path.name).symlink_to(path)
+    (library / 'backtrace').symlink_to(source / 'src/mochios-backtrace')
+    unwind = output / 'lib/rustlib/src/rust/src/llvm-project'
+    unwind.mkdir(parents=True)
+    (unwind / 'libunwind').symlink_to(source / 'src/mochios-libunwind')
+    for vendor in (library / 'vendor', output / 'lib/rustlib/src/rust/vendor'):
+        vendor.mkdir()
+        (vendor / 'rustc-literal-escaper').symlink_to(source / 'vendor/rustc-literal-escaper')
+    return output, base
+
+
+def prepare(output):
+    """Verify/install the C SDK through komeup, then prepare independent Rust metadata."""
+    root = output.resolve()
+    if root.exists():
+        raise ValueError('Use a fresh SDK output directory')
+    root.mkdir(parents=True)
+    lock = json.loads((HERE / 'sources.lock.json').read_text())
+    for name, spec in lock['sources'].items():
+        checkout(root, name, spec)
+    devkit = root / 'tools/devkit'
+    devkit.parent.mkdir()
+    shutil.copytree(HERE.parent, devkit, ignore=shutil.ignore_patterns('.git', 'target', 'out', '__pycache__'))
+    tool = root / 'komeup-build'
+    tool.mkdir()
+    shutil.copyfile(HERE.parent / 'crates/komeup/Cargo.toml', tool / 'Cargo.toml')
+    shutil.copyfile(HERE / 'komeup.Cargo.lock', tool / 'Cargo.lock')
+    shutil.copytree(HERE.parent / 'crates/komeup/src', tool / 'src')
+    with (tool / 'Cargo.toml').open('a') as stream:
+        stream.write('\n[workspace]\n')
+    run('cargo', 'build', '--locked', '--release', '--manifest-path', tool / 'Cargo.toml', '--target-dir', root / 'host-tools')
+    komeup = root / 'host-tools/release/komeup'
+    env = dict(os.environ, KOMEUP_HOME=str(root / 'manager'))
+    run(komeup, 'sdk', 'install', lock['sdk']['version'], env=env)
+    sdk = Path(subprocess.check_output([str(komeup), 'sdk', 'path', '--version', lock['sdk']['version']], env=env, text=True).strip())
+    receipt = tomllib.loads((sdk / '.komeup-sdk.toml').read_text())
+    if receipt['sha256'] != lock['sdk']['sha256']:
+        raise ValueError('SDK archive differs from the reviewed SHA-256')
+    compiler, base = overlay(root, lock['rust_toolchain'])
+    fonts = root / 'libraries/fonts'
+    run('perl', fonts / 'scripts/install-fonts.pl', '--config', fonts / 'fonts.conf', '--output', fonts / 'out/fonts',
+        '--cache', fonts / 'out/cache', '--work', fonts / 'out/build', '--curl', 'curl')
+    for name, expected in lock['fonts'].items():
+        if hashlib.sha256((fonts / 'out/fonts' / name).read_bytes()).hexdigest() != expected:
+            raise ValueError('Font hash mismatch: ' + name)
+    flags = ['--remap-path-prefix=' + str(Path.home()) + '=/build', '--remap-path-prefix=' + str(base) + '=/toolchain',
+             '--remap-path-prefix=' + str(root) + '=/build/sdk', '-C', 'debuginfo=0', '-C', 'linker=' + str(sdk / 'bin/mochios-cc')]
+    metadata = dict(format=1, cargo=str(compiler / 'bin/cargo'), rustc=str(compiler / 'bin/rustc'),
+                    rustdoc=str(compiler / 'bin/rustdoc'), target=str(root / 'user/targets/x86_64-unknown-mochios.json'),
+                    target_dir=str(root / 'target'), rustflags=flags, cargo_config=configs(root),
+                    appcore=str(devkit / 'crates/appcore'), user=str(root / 'user'),
+                    font_licenses=str(fonts / 'out/fonts/licenses'), sources=lock,
+                    fonts={key: str(fonts / 'out/fonts' / name) for key, name in [
+                        ('VIEWKIT_UI_FONT_PATH', 'InterVariable.ttf'), ('VIEWKIT_MONOSPACE_FONT_PATH', 'UDEVGothic-Regular.ttf'),
+                        ('VIEWKIT_JAPANESE_FONT_PATH', 'IBMPlexSansJP-Regular.ttf')]})
+    description = root / 'app-build.json'
+    description.write_text(json.dumps(metadata, indent=2) + '\n')
+    if os.environ.get('GITHUB_OUTPUT'):
+        with open(os.environ['GITHUB_OUTPUT'], 'a') as stream:
+            stream.write('sdk=' + str(description) + '\nhelper=' + str(HERE / 'build.py') + '\n')
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', type=Path, required=True)
+    prepare(parser.parse_args().output)
diff --git a/rust-sdk/sources.lock.json b/rust-sdk/sources.lock.json
new file mode 100644
index 0000000..70158db
--- /dev/null
+++ b/rust-sdk/sources.lock.json
@@ -0,0 +1,46 @@
+{
+  "format": 1,
+  "rust_toolchain": "nightly-2026-07-16",
+  "sdk": {
+    "version": "27.0-dp.1-shared.8",
+    "sha256": "3a4b09efd45d1ced90d5e7ce137dc2cb5e206797847c86dedfc93719b95b3755"
+  },
+  "sources": {
+    "user": {
+      "repository": "mochiOS/syscalls",
+      "revision": "f585ece9c9b331040707da5bae9a2796eadf1a93"
+    },
+    "core": {
+      "repository": "mochiOS/mnu",
+      "revision": "1cd3f9f694162b07140f9d51ca038ec412c1ad0f"
+    },
+    "services": {
+      "repository": "mochiOS/services",
+      "revision": "2c756be6014dace6cdba0f8be86efadef255370c"
+    },
+    "libraries/rust": {
+      "repository": "mochiOS/rust",
+      "revision": "a53123d944398a09672dd3633e6bed8d1375792e"
+    },
+    "libraries/viewkit": {
+      "repository": "mochiOS/ViewKit",
+      "revision": "21c7a55254b4f624e9bc2796972d2fe0369ebdd9"
+    },
+    "libraries/fonts": {
+      "repository": "mochiOS/fonts",
+      "revision": "233cb947ed6b10e175b0c6570611eb5605f112e1"
+    },
+    "libraries/libc": {
+      "repository": "mochiOS/libc",
+      "revision": "a3c482e222b53700a09d21377633836e2fee07be"
+    }
+  },
+  "fonts": {
+    "UDEVGothic-Regular.ttf": "5a4349e4a54f18a3b9691cba803c10925f277bc0cd27a5644597836be97a2e86",
+    "IBMPlexSansJP-SemiBold.ttf": "4f6a9cf3957c407f0913cf3eb251c88cd051ff1d976f4474b39f149100443f22",
+    "IBMPlexSansJP-Regular.ttf": "25d96fe620f12fba6cf09158807117ec13d1e7c9debff488117cf21dc8844688",
+    "UDEVGothic-Bold.ttf": "fd8f22c8a70796c7853bc34592a1f7affb7b7f25a471cd863d78ef0bfc377587",
+    "InterVariable.ttf": "4989b125924991b90d05b2d16e0e388c48f7d5bb8b30539bbf9c755278d0ccaf",
+    "IBMPlexSansJP-Medium.ttf": "ad2ecca35612dd6637ebbe84fd590bdd8e007957bec17f67a6f5519f64958552"
+  }
+}
diff --git a/rust-sdk/tests/test_build.py b/rust-sdk/tests/test_build.py
new file mode 100644
index 0000000..465d9e3
--- /dev/null
+++ b/rust-sdk/tests/test_build.py
@@ -0,0 +1,71 @@
+import importlib.util
+import json
+from pathlib import Path
+import struct
+import tempfile
+import tomllib
+import unittest
+
+HERE = Path(__file__).resolve().parents[1]
+spec = importlib.util.spec_from_file_location('build_app', HERE / 'build.py')
+build = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(build)
+
+
+class PackageStage(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.source = self.root / 'independent-app'
+        self.source.mkdir()
+        manifest = dict(format=1, package=dict(id='net.example.editor', name='Editor', provenance='built-in',
+            version='1.0.0', revision=1, vendor='Independent developer', kind='application', architecture='x86_64', abi='mochios-1'),
+            application=dict(entry='entry.elf', icon='icon.svg', resources=['icon.svg'],
+                document_extensions=['txt'], document_icons=[dict(extensions=['txt'], resource='icon.svg')]),
+            binary=[dict(path='/system/applications/Editor.app/entry.elf', kind='application', requires=['window.create'])])
+        (self.source / 'manifest.toml').write_text(build.dumps(manifest))
+        (self.source / 'resources').mkdir()
+        (self.source / 'resources/icon.svg').write_text('<svg/>')
+        header = bytearray(64)
+        header[:6] = b'\x7fELF\x02\x01'
+        struct.pack_into('<HH', header, 16, 2, 62)
+        self.binary = self.root / 'program.elf'
+        self.binary.write_bytes(header)
+
+    def test_nested_metadata_and_capabilities_survive_without_builtin_trust(self):
+        result = build.stage(self.source, self.binary, self.root / 'stage')
+        parsed = tomllib.loads((self.root / 'stage/manifest.toml').read_text())
+        self.assertEqual(parsed, result)
+        self.assertNotIn('provenance', parsed['package'])
+        self.assertEqual(parsed['application']['document_extensions'], ['txt'])
+        self.assertEqual(parsed['application']['document_icons'][0]['resource'], 'icon.svg')
+        self.assertEqual(parsed['binary'][0]['requires'], ['window.create'])
+        self.assertEqual(parsed['binary'][0]['path'], '/applications/Editor.app/entry.elf')
+        self.assertTrue(all(f['digest'].startswith('sha256:') for f in parsed['file']))
+        self.assertEqual((self.root / 'stage/payload/bundle/entry.elf').stat().st_mode & 0o777, 0o755)
+
+    def test_resources_cannot_escape_the_checkout(self):
+        for name in ('../manifest.toml', '/etc/passwd', 'a\\b', ''):
+            with self.assertRaises(ValueError):
+                build.resource(self.source, name)
+        (self.source / 'resources/external').symlink_to(self.binary)
+        with self.assertRaises(ValueError):
+            build.resource(self.source, 'external')
+
+    def test_wrong_elf_and_existing_stages_fail(self):
+        self.binary.write_text('Linux shell script')
+        with self.assertRaises(ValueError):
+            build.stage(self.source, self.binary, self.root / 'stage')
+
+    def test_source_and_font_pins_are_immutable(self):
+        lock = json.loads((HERE / 'sources.lock.json').read_text())
+        self.assertEqual(lock['sdk']['version'], '27.0-dp.1-shared.8')
+        for source in lock['sources'].values():
+            self.assertRegex(source['revision'], r'^[0-9a-f]{40}$')
+        for digest in lock['fonts'].values():
+            self.assertRegex(digest, r'^[0-9a-f]{64}$')
+
+
+if __name__ == '__main__':
+    unittest.main()

From 125686a1eb4e953542c4bcd0125e084e37faadd5 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:19:38 +0900
Subject: [PATCH 2/6] Use the pinned SDK compiler for host application tests

---
 rust-sdk/build.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rust-sdk/build.py b/rust-sdk/build.py
index d9d2405..11ee7cb 100644
--- a/rust-sdk/build.py
+++ b/rust-sdk/build.py
@@ -119,8 +119,9 @@ def build(source, output, sdk, tests):
     host_env = dict(os.environ, **sdk['fonts'], CARGO_PROFILE_TEST_DEBUG='0')
     for key in ('RUSTFLAGS', 'CARGO_ENCODED_RUSTFLAGS', 'RUSTC', 'RUSTDOC'):
         host_env.pop(key, None)
+    host_env.update(RUSTC=sdk['rustc'], RUSTDOC=sdk['rustdoc'])
     if tests:
-        run(['cargo', 'test', '--manifest-path', project / 'Cargo.toml', '--target-dir', output / 'host-target', *options],
+        run([sdk['cargo'], 'test', '--manifest-path', project / 'Cargo.toml', '--target-dir', output / 'host-target', *options],
             env=host_env, cwd=project)
     env = dict(host_env, RUSTC=sdk['rustc'], RUSTDOC=sdk['rustdoc'],
                CARGO_ENCODED_RUSTFLAGS='\x1f'.join(sdk['rustflags'] + ['--remap-path-prefix=' + str(source) + '=/src/app',

From 9fbeaeaaeb8dcb597b662fe0cdc8df145d065395 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:30:05 +0900
Subject: [PATCH 3/6] Resolve Rust standard-library shims through the single
 overlay sysroot

---
 rust-sdk/setup.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust-sdk/setup.py b/rust-sdk/setup.py
index b01512b..281a265 100644
--- a/rust-sdk/setup.py
+++ b/rust-sdk/setup.py
@@ -46,7 +46,7 @@ def configs(root):
     patches['https://github.com/mochiOS/syscalls'] = {
         tomllib.loads(p.read_text())['package']['name']: p.parent for p in (root / 'user/crates').glob('*/Cargo.toml')}
     for name in ('core', 'alloc', 'std'):
-        patches['crates-io']['rustc-std-workspace-' + name] = root / 'libraries/rust/library' / ('rustc-std-workspace-' + name)
+        patches['crates-io']['rustc-std-workspace-' + name] = root / 'rust-overlay/lib/rustlib/src/rust/library' / ('rustc-std-workspace-' + name)
     return ['patch.' + json.dumps(source) + '.' + json.dumps(name) + '.path=' + json.dumps(str(path))
             for source, crates in patches.items() for name, path in crates.items()]
 

From 7f21c1fc538d064cdd2bc13c81fb69c1703bbedf Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:34:48 +0900
Subject: [PATCH 4/6] Verify approved package artifacts before signing and
 publication

---
 .github/workflows/rust-sdk-check.yml |  18 ++++
 rust-sdk/README.md                   |  30 ++++++
 rust-sdk/host-tool.py                |  37 ++++++++
 rust-sdk/release.py                  | 133 +++++++++++++++++++++++++++
 rust-sdk/tests/test_release.py       |  89 ++++++++++++++++++
 5 files changed, 307 insertions(+)
 create mode 100644 rust-sdk/host-tool.py
 create mode 100644 rust-sdk/release.py
 create mode 100644 rust-sdk/tests/test_release.py

diff --git a/.github/workflows/rust-sdk-check.yml b/.github/workflows/rust-sdk-check.yml
index 1e9d1bd..4fb4ab6 100644
--- a/.github/workflows/rust-sdk-check.yml
+++ b/.github/workflows/rust-sdk-check.yml
@@ -15,3 +15,21 @@ jobs:
         with:
           persist-credentials: false
       - run: python3 -m unittest discover -s rust-sdk/tests -v
+  signer:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      CARGO_BUILD_JOBS: '4'
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - id: sdk
+        uses: ./actions/setup-rust-sdk
+        with:
+          output: ${{ runner.temp }}/mochios-rust-sdk
+      - name: Test and build the trusted signer without application sources or credentials
+        env:
+          SDK: ${{ steps.sdk.outputs.sdk }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+        run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/host-tools" --test
diff --git a/rust-sdk/README.md b/rust-sdk/README.md
index b433942..befbf08 100644
--- a/rust-sdk/README.md
+++ b/rust-sdk/README.md
@@ -48,3 +48,33 @@ built-in provenance, and changes the binary destination to the normal
 target programs and do not establish native runtime success. The public MPKG
 Action separately creates the unsigned container. Signing, approval and release
 publication remain caller workflow responsibilities.
+
+## Approval-protected publication
+
+The generic `release.py` helper consumes the unsigned artifact from the same
+successful workflow run. It checks the source commit, package ID, actual MPKG
+manifest, SDK source lock and archive checksum before accessing signing inputs.
+It does not compile or execute application code. `host-tool.py` builds msign from
+the same trusted SDK source revision, with developer-CA networking disabled.
+
+The caller must place its publication job behind a protected GitHub Environment.
+Configure the repository's chosen reviewer/team and restrict the environment to
+its default branch. The public packaging/SDK Actions have no organization or
+team requirement of their own.
+
+Official app callers use an `app-release` Environment with
+`application-maintainers` approval. Releases stay disabled until the repository
+variable `APP_RELEASE_ENABLED` is explicitly set to `true` and these Environment
+values have been configured:
+
+* Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued Developer Certificate file.
+* Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file.
+* Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file.
+
+No root private key, fixture key, generated substitute identity or unsigned
+publication is accepted. Credentials are decoded into a private temporary
+directory, not propagated as subprocess environment values, and removed on
+success or failure. The signed package is verified against the trusted root
+before publication. Existing release tags/assets are never replaced. The initial
+release helper publishes prereleases as `v<version>-r<revision>`; update the
+manifest revision before making another release of the same version.
diff --git a/rust-sdk/host-tool.py b/rust-sdk/host-tool.py
new file mode 100644
index 0000000..0d4027b
--- /dev/null
+++ b/rust-sdk/host-tool.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+"""Build a trusted SDK host tool without compiling or executing application code."""
+import argparse
+import json
+import os
+from pathlib import Path
+import subprocess
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--sdk', type=Path, required=True)
+    parser.add_argument('--output', type=Path, required=True)
+    parser.add_argument('--tool', choices=['msign'], required=True)
+    parser.add_argument('--test', action='store_true')
+    args = parser.parse_args()
+    sdk = json.loads(args.sdk.read_text())
+    devkit = Path(sdk['appcore']).parents[1]
+    env = os.environ.copy()
+    for key in ('RUSTFLAGS', 'CARGO_ENCODED_RUSTFLAGS', 'CARGO_BUILD_TARGET'):
+        env.pop(key, None)
+    env.update(RUSTC=sdk['rustc'], RUSTDOC=sdk['rustdoc'])
+    command = [sdk['cargo'], 'build', '--release', '--manifest-path', str(devkit / 'Cargo.toml'),
+               '--package', args.tool, '--no-default-features', '--target-dir', str(args.output.resolve())]
+    for config in sdk['cargo_config']:
+        command += ['--config', config]
+    if args.test:
+        test = command.copy()
+        test[1] = 'test'
+        test.remove('--release')
+        env['CARGO_PROFILE_TEST_DEBUG'] = '0'
+        subprocess.run(test, env=env, cwd=devkit, check=True)
+    subprocess.run(command, env=env, cwd=devkit, check=True)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/rust-sdk/release.py b/rust-sdk/release.py
new file mode 100644
index 0000000..d81a99a
--- /dev/null
+++ b/rust-sdk/release.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""Sign and publish one approved build artifact; never compile application source."""
+import argparse
+import base64
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import tarfile
+import tempfile
+import time
+import tomllib
+
+HERE = Path(__file__).resolve().parent
+
+
+def digest(path):
+    """Hash the complete artifact without trusting build metadata."""
+    result = hashlib.sha256()
+    with path.open('rb') as stream:
+        for chunk in iter(lambda: stream.read(1024 * 1024), b''):
+            result.update(chunk)
+    return result.hexdigest()
+
+
+def validate(directory, expected_id, expected_commit):
+    """Bind the approved source revision, SDK, package identity, and actual bytes."""
+    if not re.fullmatch('[0-9a-f]{40}', expected_commit):
+        raise ValueError('Release requires an exact source commit')
+    metadata = directory / 'build-info.json'
+    checksums = directory / 'SHA256SUMS'
+    packages = list(directory.glob('*.mpkg'))
+    if len(packages) != 1:
+        raise ValueError('Expected exactly one unsigned MPKG')
+    package = packages[0]
+    if any(p.is_symlink() or not p.is_file() for p in (metadata, checksums, package)):
+        raise ValueError('Release artifacts must be ordinary files')
+    if metadata.stat().st_size > 1024 * 1024 or checksums.stat().st_size > 4096:
+        raise ValueError('Artifact metadata exceeds the size limit')
+    record = json.loads(metadata.read_text())
+    lock = json.loads((HERE / 'sources.lock.json').read_text())
+    if (record.get('format') != 1 or record.get('source_commit') != expected_commit
+            or record.get('signed') is not False or record.get('sources') != lock):
+        raise ValueError('Artifact source/SDK does not match the approved release')
+    if checksums.read_text() != digest(package) + '  ' + package.name + '\n':
+        raise ValueError('Unsigned artifact checksum mismatch')
+    with package.open('rb') as stream:
+        header = stream.read(32)
+        if len(header) != 32 or header[:12] != b'MPKG\x01\0\0\0\x20\0\0\0':
+            raise ValueError('Expected unsigned MPKG v1')
+        with tarfile.open(fileobj=stream, mode='r|') as archive:
+            first = next(iter(archive))
+            if first.name != 'manifest.toml' or not first.isfile() or first.size > 1024 * 1024:
+                raise ValueError('Invalid MPKG manifest')
+            manifest = tomllib.loads(archive.extractfile(first).read().decode('utf-8'))
+    identity = manifest.get('package', {})
+    if identity != record.get('package') or identity.get('id') != expected_id or 'provenance' in identity:
+        raise ValueError('MPKG identity differs from the approved application')
+    version, revision = identity.get('version'), identity.get('revision')
+    if (not isinstance(version, str) or not re.fullmatch('[0-9][0-9A-Za-z.+-]*', version)
+            or type(revision) is not int or revision < 1):
+        raise ValueError('Invalid release version/revision')
+    return package, identity, 'v' + version + '-r' + str(revision)
+
+
+def sign(package, output, msign):
+    """Use explicit environment credentials, verify the result, and remove temporary keys."""
+    required = ('MSIGN_CERTIFICATE_B64', 'MSIGN_PRIVATE_KEY_B64', 'MSIGN_ROOT_PUBLIC_KEY_B64')
+    if any(not os.environ.get(key) for key in required):
+        raise ValueError('Signing certificate, private key, and trusted root public key must be configured before enabling releases')
+    with tempfile.TemporaryDirectory(prefix='mpkg-signing-') as temporary:
+        root = Path(temporary)
+        root.chmod(0o700)
+        paths = []
+        for key in required:
+            data = base64.b64decode(os.environ[key], validate=True)
+            if not data or len(data) > 1024 * 1024:
+                raise ValueError('Invalid signing credential file')
+            path = root / key
+            with path.open('xb') as stream:
+                path.chmod(0o600)
+                stream.write(data)
+            paths.append(path)
+        certificate, private, issuer = paths
+        env = dict(os.environ, MOCHIOS_SIGNING_HOME=str(root / 'identity'))
+        # Do not propagate the credential values to subprocess environments.
+        for key in required:
+            env.pop(key, None)
+        for key in ('GH_TOKEN', 'GITHUB_TOKEN'):
+            env.pop(key, None)
+        subprocess.run([str(msign), 'identity', 'import', 'ci-release', '--certificate', str(certificate), '--key', str(private)], env=env, check=True)
+        subprocess.run([str(msign), 'package', 'sign-auto', str(package), '--identity', 'ci-release', '--output', str(output)], env=env, check=True)
+        subprocess.run([str(msign), 'package', 'verify', str(output), '--root-public-key', str(issuer), '--unix-time', str(int(time.time()))], env=env, check=True)
+
+
+def absent(repository, path):
+    """Require a definite 404; authentication/network failures are never interpreted as absence."""
+    result = subprocess.run(['gh', 'api', '-i', 'repos/' + repository + '/' + path], capture_output=True, text=True)
+    if result.returncode == 0 or 'HTTP 404' not in result.stderr:
+        raise ValueError('Release/tag already exists or could not be checked; refusing to overwrite')
+
+
+def main():
+    """Only an approval-protected caller should execute this publication command."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--artifacts', type=Path, required=True)
+    parser.add_argument('--msign', type=Path, required=True)
+    parser.add_argument('--package-id', required=True)
+    parser.add_argument('--commit', required=True)
+    parser.add_argument('--repository', required=True)
+    args = parser.parse_args()
+    if not re.fullmatch('[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', args.repository):
+        raise ValueError('Invalid release repository')
+    package, identity, tag = validate(args.artifacts.resolve(), args.package_id, args.commit)
+    absent(args.repository, 'releases/tags/' + tag)
+    absent(args.repository, 'git/ref/tags/' + tag)
+    with tempfile.TemporaryDirectory(prefix='mpkg-release-') as temporary:
+        root = Path(temporary)
+        output = root / package.name
+        sign(package, output, args.msign.resolve())
+        checksums = root / 'SHA256SUMS'
+        checksums.write_text(digest(output) + '  ' + output.name + '\n')
+        notes = root / 'notes.md'
+        notes.write_text('Native mochiOS application package.\n\nSource commit: `' + args.commit + '`\n')
+        subprocess.run(['gh', 'release', 'create', tag, str(output), str(checksums), '--repo', args.repository,
+                        '--target', args.commit, '--title', identity['name'] + ' ' + identity['version'] + ' (r' + str(identity['revision']) + ')',
+                        '--prerelease', '--notes-file', str(notes)], check=True)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/rust-sdk/tests/test_release.py b/rust-sdk/tests/test_release.py
new file mode 100644
index 0000000..e3f999d
--- /dev/null
+++ b/rust-sdk/tests/test_release.py
@@ -0,0 +1,89 @@
+import base64
+import hashlib
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import struct
+import tarfile
+import tempfile
+import unittest
+from unittest.mock import patch
+
+HERE = Path(__file__).resolve().parents[1]
+spec = importlib.util.spec_from_file_location('release_app', HERE / 'release.py')
+release = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(release)
+
+
+class ApprovedArtifact(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.commit = 'a' * 40
+        self.identity = dict(id='net.example.editor', name='Editor', version='1.0.0', revision=1)
+        data = b'[package]\nid="net.example.editor"\nname="Editor"\nversion="1.0.0"\nrevision=1\n'
+        stream = io.BytesIO()
+        with tarfile.open(fileobj=stream, mode='w') as tar:
+            entry = tarfile.TarInfo('manifest.toml')
+            entry.size = len(data)
+            tar.addfile(entry, io.BytesIO(data))
+        header = bytearray(32)
+        header[:12] = b'MPKG\x01\0\0\0\x20\0\0\0'
+        struct.pack_into('<Q', header, 12, len(stream.getvalue()))
+        self.package = self.root / 'Editor.mpkg'
+        self.package.write_bytes(header + stream.getvalue())
+        (self.root / 'SHA256SUMS').write_text(release.digest(self.package) + '  Editor.mpkg\n')
+        self.record = dict(format=1, source_commit=self.commit, signed=False, package=self.identity,
+                           sources=json.loads((HERE / 'sources.lock.json').read_text()))
+        self.save()
+
+    def save(self):
+        (self.root / 'build-info.json').write_text(json.dumps(self.record))
+
+    def test_accepts_only_the_bound_artifact_and_source_commit(self):
+        self.assertEqual(release.validate(self.root, self.identity['id'], self.commit)[2], 'v1.0.0-r1')
+        for identity, commit in [('net.attacker.app', self.commit), (self.identity['id'], 'b' * 40)]:
+            with self.assertRaises(ValueError):
+                release.validate(self.root, identity, commit)
+
+    def test_tampered_bytes_and_sdk_are_rejected(self):
+        self.record['sources']['sdk']['sha256'] = 'b' * 64
+        self.save()
+        with self.assertRaises(ValueError):
+            release.validate(self.root, self.identity['id'], self.commit)
+        self.record['sources'] = json.loads((HERE / 'sources.lock.json').read_text())
+        self.save()
+        with self.package.open('ab') as stream:
+            stream.write(b'tampered')
+        with self.assertRaises(ValueError):
+            release.validate(self.root, self.identity['id'], self.commit)
+
+    def test_metadata_cannot_relabel_the_actual_manifest(self):
+        self.record['package']['id'] = 'net.attacker.app'
+        self.save()
+        with self.assertRaises(ValueError):
+            release.validate(self.root, 'net.attacker.app', self.commit)
+
+    def test_missing_keys_fail_before_invoking_a_signer(self):
+        with patch.dict(os.environ, {}, clear=True), patch.object(release.subprocess, 'run') as run:
+            with self.assertRaises(ValueError):
+                release.sign(self.package, self.root / 'signed.mpkg', Path('/msign'))
+            run.assert_not_called()
+
+    def test_credentials_and_github_tokens_do_not_enter_signer_environment(self):
+        values = {key: base64.b64encode(b'fixture only').decode() for key in
+                  ('MSIGN_CERTIFICATE_B64', 'MSIGN_PRIVATE_KEY_B64', 'MSIGN_ROOT_PUBLIC_KEY_B64')}
+        values['GH_TOKEN'] = 'fixture-token'
+        with patch.dict(os.environ, values, clear=True), patch.object(release.subprocess, 'run') as run:
+            release.sign(self.package, self.root / 'signed.mpkg', Path('/msign'))
+            self.assertEqual(run.call_count, 3)
+            for call in run.call_args_list:
+                self.assertTrue(all(key not in call.kwargs['env'] for key in values))
+            self.assertIn('verify', run.call_args_list[-1].args[0])
+
+
+if __name__ == '__main__':
+    unittest.main()

From e1549dea1c72bdc4de4baf2d9cef0148a576a297 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 15:36:39 +0900
Subject: [PATCH 5/6] Bind application build receipts to the exact SDK Action
 revision

---
 actions/setup-rust-sdk/action.yml |  1 +
 rust-sdk/build.py                 |  2 +-
 rust-sdk/release.py               |  9 +++++----
 rust-sdk/setup.py                 |  4 +++-
 rust-sdk/tests/test_release.py    | 12 ++++++------
 5 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/actions/setup-rust-sdk/action.yml b/actions/setup-rust-sdk/action.yml
index f9d5d96..27e7124 100644
--- a/actions/setup-rust-sdk/action.yml
+++ b/actions/setup-rust-sdk/action.yml
@@ -19,4 +19,5 @@ runs:
       env:
         SDK_OUTPUT: ${{ inputs.output }}
         SDK_ACTION: ${{ github.action_path }}
+        SDK_ACTION_REF: ${{ github.action_ref }}
       run: python3 "$SDK_ACTION/../../rust-sdk/setup.py" --output "$SDK_OUTPUT"
diff --git a/rust-sdk/build.py b/rust-sdk/build.py
index 11ee7cb..7790fb2 100644
--- a/rust-sdk/build.py
+++ b/rust-sdk/build.py
@@ -142,7 +142,7 @@ def build(source, output, sdk, tests):
     package = stage(source, binary, output / 'stage', Path(sdk['font_licenses']))
     revision = subprocess.check_output(['git', '-C', str(source), 'rev-parse', 'HEAD'], text=True).strip()
     (output / 'build-info.json').write_text(json.dumps(dict(format=1, source_commit=revision,
-        package=package['package'], sources=sdk['sources'], runtime_tested=False, signed=False), indent=2) + '\n')
+        package=package['package'], sources=sdk['sources'], devkit_ref=sdk['devkit_ref'], runtime_tested=False, signed=False), indent=2) + '\n')
 
 
 if __name__ == '__main__':
diff --git a/rust-sdk/release.py b/rust-sdk/release.py
index d81a99a..3d47d74 100644
--- a/rust-sdk/release.py
+++ b/rust-sdk/release.py
@@ -25,9 +25,9 @@ def digest(path):
     return result.hexdigest()
 
 
-def validate(directory, expected_id, expected_commit):
+def validate(directory, expected_id, expected_commit, expected_sdk_ref):
     """Bind the approved source revision, SDK, package identity, and actual bytes."""
-    if not re.fullmatch('[0-9a-f]{40}', expected_commit):
+    if not re.fullmatch('[0-9a-f]{40}', expected_commit) or not re.fullmatch('[0-9a-f]{40}', expected_sdk_ref):
         raise ValueError('Release requires an exact source commit')
     metadata = directory / 'build-info.json'
     checksums = directory / 'SHA256SUMS'
@@ -42,7 +42,7 @@ def validate(directory, expected_id, expected_commit):
     record = json.loads(metadata.read_text())
     lock = json.loads((HERE / 'sources.lock.json').read_text())
     if (record.get('format') != 1 or record.get('source_commit') != expected_commit
-            or record.get('signed') is not False or record.get('sources') != lock):
+            or record.get('signed') is not False or record.get('sources') != lock or record.get('devkit_ref') != expected_sdk_ref):
         raise ValueError('Artifact source/SDK does not match the approved release')
     if checksums.read_text() != digest(package) + '  ' + package.name + '\n':
         raise ValueError('Unsigned artifact checksum mismatch')
@@ -109,11 +109,12 @@ def main():
     parser.add_argument('--msign', type=Path, required=True)
     parser.add_argument('--package-id', required=True)
     parser.add_argument('--commit', required=True)
+    parser.add_argument('--sdk-ref', required=True)
     parser.add_argument('--repository', required=True)
     args = parser.parse_args()
     if not re.fullmatch('[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', args.repository):
         raise ValueError('Invalid release repository')
-    package, identity, tag = validate(args.artifacts.resolve(), args.package_id, args.commit)
+    package, identity, tag = validate(args.artifacts.resolve(), args.package_id, args.commit, args.sdk_ref)
     absent(args.repository, 'releases/tags/' + tag)
     absent(args.repository, 'git/ref/tags/' + tag)
     with tempfile.TemporaryDirectory(prefix='mpkg-release-') as temporary:
diff --git a/rust-sdk/setup.py b/rust-sdk/setup.py
index 281a265..503d815 100644
--- a/rust-sdk/setup.py
+++ b/rust-sdk/setup.py
@@ -96,6 +96,8 @@ def prepare(output):
         raise ValueError('Use a fresh SDK output directory')
     root.mkdir(parents=True)
     lock = json.loads((HERE / 'sources.lock.json').read_text())
+    revision = os.environ.get('SDK_ACTION_REF') or subprocess.check_output(
+        ['git', '-C', str(HERE.parent), 'rev-parse', 'HEAD'], text=True).strip()
     for name, spec in lock['sources'].items():
         checkout(root, name, spec)
     devkit = root / 'tools/devkit'
@@ -125,7 +127,7 @@ def prepare(output):
             raise ValueError('Font hash mismatch: ' + name)
     flags = ['--remap-path-prefix=' + str(Path.home()) + '=/build', '--remap-path-prefix=' + str(base) + '=/toolchain',
              '--remap-path-prefix=' + str(root) + '=/build/sdk', '-C', 'debuginfo=0', '-C', 'linker=' + str(sdk / 'bin/mochios-cc')]
-    metadata = dict(format=1, cargo=str(compiler / 'bin/cargo'), rustc=str(compiler / 'bin/rustc'),
+    metadata = dict(format=1, devkit_ref=revision, cargo=str(compiler / 'bin/cargo'), rustc=str(compiler / 'bin/rustc'),
                     rustdoc=str(compiler / 'bin/rustdoc'), target=str(root / 'user/targets/x86_64-unknown-mochios.json'),
                     target_dir=str(root / 'target'), rustflags=flags, cargo_config=configs(root),
                     appcore=str(devkit / 'crates/appcore'), user=str(root / 'user'),
diff --git a/rust-sdk/tests/test_release.py b/rust-sdk/tests/test_release.py
index e3f999d..dd45634 100644
--- a/rust-sdk/tests/test_release.py
+++ b/rust-sdk/tests/test_release.py
@@ -36,7 +36,7 @@ def setUp(self):
         self.package = self.root / 'Editor.mpkg'
         self.package.write_bytes(header + stream.getvalue())
         (self.root / 'SHA256SUMS').write_text(release.digest(self.package) + '  Editor.mpkg\n')
-        self.record = dict(format=1, source_commit=self.commit, signed=False, package=self.identity,
+        self.record = dict(format=1, source_commit=self.commit, devkit_ref=self.commit, signed=False, package=self.identity,
                            sources=json.loads((HERE / 'sources.lock.json').read_text()))
         self.save()
 
@@ -44,28 +44,28 @@ def save(self):
         (self.root / 'build-info.json').write_text(json.dumps(self.record))
 
     def test_accepts_only_the_bound_artifact_and_source_commit(self):
-        self.assertEqual(release.validate(self.root, self.identity['id'], self.commit)[2], 'v1.0.0-r1')
+        self.assertEqual(release.validate(self.root, self.identity['id'], self.commit, self.commit)[2], 'v1.0.0-r1')
         for identity, commit in [('net.attacker.app', self.commit), (self.identity['id'], 'b' * 40)]:
             with self.assertRaises(ValueError):
-                release.validate(self.root, identity, commit)
+                release.validate(self.root, identity, commit, self.commit)
 
     def test_tampered_bytes_and_sdk_are_rejected(self):
         self.record['sources']['sdk']['sha256'] = 'b' * 64
         self.save()
         with self.assertRaises(ValueError):
-            release.validate(self.root, self.identity['id'], self.commit)
+            release.validate(self.root, self.identity['id'], self.commit, self.commit)
         self.record['sources'] = json.loads((HERE / 'sources.lock.json').read_text())
         self.save()
         with self.package.open('ab') as stream:
             stream.write(b'tampered')
         with self.assertRaises(ValueError):
-            release.validate(self.root, self.identity['id'], self.commit)
+            release.validate(self.root, self.identity['id'], self.commit, self.commit)
 
     def test_metadata_cannot_relabel_the_actual_manifest(self):
         self.record['package']['id'] = 'net.attacker.app'
         self.save()
         with self.assertRaises(ValueError):
-            release.validate(self.root, 'net.attacker.app', self.commit)
+            release.validate(self.root, 'net.attacker.app', self.commit, self.commit)
 
     def test_missing_keys_fail_before_invoking_a_signer(self):
         with patch.dict(os.environ, {}, clear=True), patch.object(release.subprocess, 'run') as run:

From 1ae906d7417e9882b11541e338552c3039c981fb Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:06:00 +0900
Subject: [PATCH 6/6] Require the configured approval Team and branch before
 app publication

---
 rust-sdk/README.md             |  6 +++++-
 rust-sdk/release.py            | 26 +++++++++++++++++++++++
 rust-sdk/tests/test_release.py | 39 ++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/rust-sdk/README.md b/rust-sdk/README.md
index befbf08..18d979e 100644
--- a/rust-sdk/README.md
+++ b/rust-sdk/README.md
@@ -59,7 +59,11 @@ the same trusted SDK source revision, with developer-CA networking disabled.
 
 The caller must place its publication job behind a protected GitHub Environment.
 Configure the repository's chosen reviewer/team and restrict the environment to
-its default branch. The public packaging/SDK Actions have no organization or
+its default branch. Pass `--environment`, `--reviewer-team` (numeric Team ID),
+and `--branch` to the release helper. It requires exactly that Team as reviewer,
+admin bypass disabled, and exactly that branch allowed; unreadable or changed
+policy aborts publication. This verifies configuration, while GitHub's protected
+job enforces the approval itself. The public packaging/SDK Actions have no organization or
 team requirement of their own.
 
 Official app callers use an `app-release` Environment with
diff --git a/rust-sdk/release.py b/rust-sdk/release.py
index 3d47d74..5e39e2b 100644
--- a/rust-sdk/release.py
+++ b/rust-sdk/release.py
@@ -12,6 +12,7 @@
 import tempfile
 import time
 import tomllib
+from urllib.parse import quote
 
 HERE = Path(__file__).resolve().parent
 
@@ -102,6 +103,27 @@ def absent(repository, path):
         raise ValueError('Release/tag already exists or could not be checked; refusing to overwrite')
 
 
+def approval_policy(repository, environment, team, branch):
+    """Fail closed if the caller's required Team or branch restriction was removed."""
+    endpoint = 'repos/' + repository + '/environments/' + quote(environment, safe='')
+    def fetch(path):
+        return json.loads(subprocess.check_output(['gh', 'api', path], text=True))
+    policy = fetch(endpoint)
+    reviewers = [reviewer for rule in policy.get('protection_rules', [])
+                 if rule.get('type') == 'required_reviewers' for reviewer in rule.get('reviewers', [])]
+    # GitHub accepts approval from any listed reviewer. Do not allow a different
+    # user/team to substitute for the Team explicitly selected by the publisher.
+    if (policy.get('can_admins_bypass') is not False or len(reviewers) != 1
+            or reviewers[0].get('type') != 'Team' or reviewers[0].get('reviewer', {}).get('id') != team
+            or policy.get('deployment_branch_policy') != dict(protected_branches=False, custom_branch_policies=True)):
+        raise ValueError('Required Team approval or environment restrictions are missing')
+    branches = fetch(endpoint + '/deployment-branch-policies?per_page=100')
+    entries = branches.get('branch_policies', [])
+    if (branches.get('total_count') != 1 or len(entries) != 1
+            or entries[0].get('name') != branch or entries[0].get('type') != 'branch'):
+        raise ValueError('Publication environment must allow only the selected branch')
+
+
 def main():
     """Only an approval-protected caller should execute this publication command."""
     parser = argparse.ArgumentParser(description=__doc__)
@@ -111,10 +133,14 @@ def main():
     parser.add_argument('--commit', required=True)
     parser.add_argument('--sdk-ref', required=True)
     parser.add_argument('--repository', required=True)
+    parser.add_argument('--environment', required=True)
+    parser.add_argument('--reviewer-team', type=int, required=True)
+    parser.add_argument('--branch', required=True)
     args = parser.parse_args()
     if not re.fullmatch('[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', args.repository):
         raise ValueError('Invalid release repository')
     package, identity, tag = validate(args.artifacts.resolve(), args.package_id, args.commit, args.sdk_ref)
+    approval_policy(args.repository, args.environment, args.reviewer_team, args.branch)
     absent(args.repository, 'releases/tags/' + tag)
     absent(args.repository, 'git/ref/tags/' + tag)
     with tempfile.TemporaryDirectory(prefix='mpkg-release-') as temporary:
diff --git a/rust-sdk/tests/test_release.py b/rust-sdk/tests/test_release.py
index dd45634..6d504a6 100644
--- a/rust-sdk/tests/test_release.py
+++ b/rust-sdk/tests/test_release.py
@@ -85,5 +85,44 @@ def test_credentials_and_github_tokens_do_not_enter_signer_environment(self):
             self.assertIn('verify', run.call_args_list[-1].args[0])
 
 
+class PublicationPolicy(unittest.TestCase):
+    def setUp(self):
+        self.policy = dict(can_admins_bypass=False,
+            protection_rules=[dict(type='required_reviewers', reviewers=[dict(type='Team', reviewer=dict(id=123))])],
+            deployment_branch_policy=dict(protected_branches=False, custom_branch_policies=True))
+        self.branches = dict(total_count=1, branch_policies=[dict(type='branch', name='main')])
+
+    def check(self):
+        with patch.object(release.subprocess, 'check_output', side_effect=[json.dumps(self.policy), json.dumps(self.branches)]):
+            release.approval_policy('example/app', 'release', 123, 'main')
+
+    def test_explicit_team_and_single_branch_are_required(self):
+        self.check()
+        self.policy['protection_rules'][0]['reviewers'] = []
+        with self.assertRaises(ValueError):
+            self.check()
+
+    def test_alternative_reviewers_and_admin_bypass_are_rejected(self):
+        self.policy['protection_rules'][0]['reviewers'].append(dict(type='User', reviewer=dict(id=456)))
+        with self.assertRaises(ValueError):
+            self.check()
+        self.policy['protection_rules'][0]['reviewers'].pop()
+        self.policy['can_admins_bypass'] = True
+        with self.assertRaises(ValueError):
+            self.check()
+
+    def test_tags_wildcards_and_additional_branch_rules_are_rejected(self):
+        for entries in ([dict(type='tag', name='main')], [dict(type='branch', name='*')],
+                        [dict(type='branch', name='main'), dict(type='branch', name='staging')]):
+            self.branches = dict(total_count=len(entries), branch_policies=entries)
+            with self.assertRaises(ValueError):
+                self.check()
+
+    def test_api_failure_does_not_skip_policy_checks(self):
+        with patch.object(release.subprocess, 'check_output', side_effect=release.subprocess.CalledProcessError(1, 'gh')):
+            with self.assertRaises(release.subprocess.CalledProcessError):
+                release.approval_policy('example/app', 'release', 123, 'main')
+
+
 if __name__ == '__main__':
     unittest.main()