From 77b702d3cc79ead20daa317f7f3d985d93361208 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 16:36:07 +0900
Subject: [PATCH 1/3] Support signing existing CI-built MPKG artifacts without
 rebuilding projects

---
 crates/kome/src/cli.rs            |  3 +-
 crates/kome/src/commands/sign.rs  | 98 +++++++++++++++++++++++++++++--
 crates/msign/src/cli.rs           |  7 +++
 crates/msign/src/commands/mpkg.rs | 28 +++++++--
 crates/msign/src/main.rs          |  3 +
 docs/package-signing.md           | 22 +++++++
 6 files changed, 150 insertions(+), 11 deletions(-)

diff --git a/crates/kome/src/cli.rs b/crates/kome/src/cli.rs
index 097b045..6d91f00 100644
--- a/crates/kome/src/cli.rs
+++ b/crates/kome/src/cli.rs
@@ -158,7 +158,8 @@ pub struct PackArgs {
 
 #[derive(Debug, Args)]
 pub struct SignArgs {
-    /// Unsigned MPKG input; defaults to dist/<name>-unsigned.mpkg.
+    /// Sign an existing MPKG without building/repacking or requiring Kome.toml.
+    /// Omit this input to build and sign the current Kome project instead.
     pub package: Option<PathBuf>,
 
     #[arg(long, default_value = ".")]
diff --git a/crates/kome/src/commands/sign.rs b/crates/kome/src/commands/sign.rs
index f35a4ed..2eef459 100644
--- a/crates/kome/src/commands/sign.rs
+++ b/crates/kome/src/commands/sign.rs
@@ -26,11 +26,24 @@ use crate::{
 
 pub fn run(args: SignArgs) -> Result<()> {
     let project_dir = absolute_project_path(&args.project)?;
-    let manifest = project::read_manifest(&project_dir)?;
-    let paths = SignPaths::new(&project_dir, &manifest, &args);
-
-    ensure_built(&project_dir, &manifest, &paths, args.release)?;
-    ensure_packed(&project_dir, &manifest, &paths, args.release)?;
+    let (manifest, paths) = if let Some(package) = &args.package {
+        let package = project_path(&project_dir, package);
+        let manifest = artifact_requirements(&package)?;
+        let mut paths = SignPaths::new(&project_dir, &manifest, &args);
+        if args.output.is_none() {
+            paths.signed_package = default_signed_path(&package)?;
+        }
+        (manifest, paths)
+    } else {
+        let manifest = project::read_manifest(&project_dir)?;
+        let paths = SignPaths::new(&project_dir, &manifest, &args);
+        ensure_built(&project_dir, &manifest, &paths, args.release)?;
+        ensure_packed(&project_dir, &manifest, &paths, args.release)?;
+        (manifest, paths)
+    };
+    if paths.unsigned_package == paths.signed_package {
+        bail!("Signed output must differ from the unsigned input");
+    }
     keygen::run_in_project(
         KeygenArgs {
             private_key: paths.private_key.clone(),
@@ -94,6 +107,53 @@ pub fn run(args: SignArgs) -> Result<()> {
     Ok(())
 }
 
+#[derive(serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+struct ArtifactRequirements {
+    package_id: String,
+    capabilities: Vec<String>,
+}
+
+fn artifact_requirements(package: &Path) -> Result<KomeManifest> {
+    let result = Command::new("msign")
+        .arg("package")
+        .arg("requirements")
+        .arg(package)
+        .output()
+        .context("failed to inspect MPKG signing requirements; install the matching msign")?;
+    if !result.status.success() {
+        bail!(
+            "MPKG requirement inspection failed: {}",
+            String::from_utf8_lossy(&result.stderr)
+        );
+    }
+    parse_artifact_requirements(&result.stdout)
+}
+
+fn parse_artifact_requirements(bytes: &[u8]) -> Result<KomeManifest> {
+    if bytes.len() > 1024 * 1024 {
+        bail!("MPKG signing requirements exceed the size limit");
+    }
+    let requirements: ArtifactRequirements = serde_json::from_slice(bytes)?;
+    if !mochios_certificate::is_valid_package_id(&requirements.package_id) {
+        bail!("Invalid MPKG package ID");
+    }
+    // This value carries certificate selection inputs only. It is never used to
+    // build, repack, or replace the artifact's actual application metadata.
+    let mut manifest =
+        KomeManifest::new_app("Package".into(), requirements.package_id, String::new());
+    manifest.capabilities.required = requirements.capabilities;
+    Ok(manifest)
+}
+
+fn default_signed_path(package: &Path) -> Result<PathBuf> {
+    let stem = package
+        .file_stem()
+        .and_then(|name| name.to_str())
+        .ok_or_else(|| anyhow::anyhow!("MPKG input needs a UTF-8 file name"))?;
+    Ok(package.with_file_name(format!("{stem}-signed.mpkg")))
+}
+
 struct SignPaths {
     unsigned_package: PathBuf,
     signed_package: PathBuf,
@@ -354,6 +414,34 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn artifact_requirements_use_actual_identity_and_capabilities() {
+        let manifest = parse_artifact_requirements(
+            br#"{"package_id":"org.mochios.edit","capabilities":["fs.read.user","window.create"]}"#,
+        )
+        .unwrap();
+        assert_eq!(manifest.package.id, "org.mochios.edit");
+        assert_eq!(
+            required_capabilities(&manifest),
+            vec!["fs.read.user", "window.create"]
+        );
+        for invalid in [
+            br#"{"package_id":"../bad","capabilities":[]}"#.as_slice(),
+            br#"{"package_id":"org.mochios.edit","capabilities":[],"developer_id":"override"}"#,
+        ] {
+            assert!(parse_artifact_requirements(invalid).is_err());
+        }
+        assert!(parse_artifact_requirements(&vec![b' '; 1024 * 1024 + 1]).is_err());
+    }
+
+    #[test]
+    fn existing_artifact_default_output_preserves_its_input() {
+        assert_eq!(
+            default_signed_path(Path::new("/tmp/Edit.mpkg")).unwrap(),
+            Path::new("/tmp/Edit-signed.mpkg")
+        );
+    }
+
     #[test]
     fn required_capabilities_are_a_sorted_union() {
         let mut manifest = KomeManifest::new_app(
diff --git a/crates/msign/src/cli.rs b/crates/msign/src/cli.rs
index e9e3278..0980869 100644
--- a/crates/msign/src/cli.rs
+++ b/crates/msign/src/cli.rs
@@ -81,6 +81,8 @@ pub enum CertificateCommand {
 
 #[derive(Debug, Subcommand)]
 pub enum PackageCommand {
+    /// Print the package ID and requested capabilities as JSON; does not authenticate the package.
+    Requirements(PackageRequirementsArgs),
     Sign(PackageSignArgs),
     SignAuto(PackageSignAutoArgs),
     Verify(PackageVerifyArgs),
@@ -88,6 +90,11 @@ pub enum PackageCommand {
     BuiltInRecord(BuiltInRecordArgs),
 }
 
+#[derive(Debug, Args)]
+pub struct PackageRequirementsArgs {
+    pub package: PathBuf,
+}
+
 #[derive(Debug, Args)]
 pub struct BindBuiltInArgs {
     pub manifest: PathBuf,
diff --git a/crates/msign/src/commands/mpkg.rs b/crates/msign/src/commands/mpkg.rs
index bab17a6..1666bdd 100644
--- a/crates/msign/src/commands/mpkg.rs
+++ b/crates/msign/src/commands/mpkg.rs
@@ -31,11 +31,22 @@ struct MpkgEntry {
     mode: u32,
 }
 
+#[derive(serde::Serialize)]
 pub(crate) struct PackageRequirements {
     pub package_id: String,
     pub capabilities: Vec<String>,
 }
 
+/// Inspect declared signing requirements with the canonical bounded MPKG parser.
+/// This does not verify developer identity, signatures, or payload integrity.
+pub fn requirements(args: crate::cli::PackageRequirementsArgs) -> Result<()> {
+    println!(
+        "{}",
+        serde_json::to_string(&package_requirements(&args.package)?)?
+    );
+    Ok(())
+}
+
 pub(crate) fn package_requirements(package: &Path) -> Result<PackageRequirements> {
     let entries = read_mpkg(package)?;
     reject_chain_and_unknown_signatures(&entries)?;
@@ -412,8 +423,8 @@ fn write_mpkg(path: &Path, entries: &[MpkgEntry]) -> Result<()> {
         .parent()
         .filter(|path| !path.as_os_str().is_empty())
         .unwrap_or_else(|| Path::new("."));
-    let directory = PrivateDirectory::new_in(parent, "msign")
-        .context("failed to create temporary MPKG")?;
+    let directory =
+        PrivateDirectory::new_in(parent, "msign").context("failed to create temporary MPKG")?;
     let mut temporary = directory.create_file("package.mpkg")?;
     temporary
         .write_all(&header)
@@ -601,9 +612,7 @@ fn validate_application_metadata(
             let value = value
                 .as_str()
                 .ok_or_else(|| anyhow!("application.{key} entries must be strings"))?;
-            if value.is_empty()
-                || (key == "resources" && !is_normalized_relative_path(value))
-            {
+            if value.is_empty() || (key == "resources" && !is_normalized_relative_path(value)) {
                 bail!("application.{key} contains an invalid entry");
             }
         }
@@ -1033,6 +1042,15 @@ mod tests {
         )
         .unwrap();
 
+        let inspected = serde_json::to_value(package_requirements(&unsigned).unwrap()).unwrap();
+        assert_eq!(
+            inspected,
+            serde_json::json!({
+                "package_id": "org.example.application",
+                "capabilities": ["process.spawn", "window.create"]
+            })
+        );
+
         assert_eq!(request.developer_id, "019f9e5ac6687902b0e72fe53abfbef1");
         assert_eq!(request.package_id, "org.example.application");
         assert_eq!(
diff --git a/crates/msign/src/main.rs b/crates/msign/src/main.rs
index b740fe0..a0325e1 100644
--- a/crates/msign/src/main.rs
+++ b/crates/msign/src/main.rs
@@ -17,6 +17,9 @@ fn main() -> Result<()> {
     let cli = Cli::parse();
 
     match cli.command {
+        Command::Package {
+            command: PackageCommand::Requirements(args),
+        } => commands::mpkg::requirements(args),
         Command::Elf {
             command: ElfCommand::Sign(args),
         } => commands::elf::sign(args),
diff --git a/docs/package-signing.md b/docs/package-signing.md
index 593aeec..864431a 100644
--- a/docs/package-signing.md
+++ b/docs/package-signing.md
@@ -49,6 +49,28 @@ IDs, developer identities, or a central registration mechanism.
 
 ## Automatic selection
 
+For an existing unsigned MPKG produced by CI, Kome can obtain a package-scoped
+certificate and sign it without a `Kome.toml`, compilation, or repackaging:
+
+```bash
+kome login
+kome developer use YOUR_DEVELOPER_ID
+kome sign /path/to/Edit.mpkg \
+  --key /private/edit/application.key \
+  --public-key /private/edit/application.pub \
+  --certificate /private/edit/developer.cert \
+  --issuer-public-key /private/edit/developer.issuer.pub \
+  --output /path/to/Edit-signed.mpkg
+```
+
+Use a private directory outside the source repository for credential files.
+Kome uses `msign package requirements` to read the actual package ID and required
+capabilities with the existing MPKG parser; these are declarations, not proof of
+authenticity. Kome then validates the issued certificate and verifies the signed
+package before publishing the output file. Without an explicit output path,
+the input `Edit.mpkg` produces `Edit-signed.mpkg`. With no MPKG argument, the
+existing Kome project build/package/sign workflow is unchanged.
+
 For an unsigned MPKG, automatic selection reads the Package ID and requested
 binary capabilities from the package manifest. A candidate identity is usable
 only when all of the following are true:

From 22beec108abf2044a9c799822e4eb7dbaccf8807 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:29:07 +0900
Subject: [PATCH 2/3] Build and test locked Kome host tooling for approved
 Actions jobs

---
 .github/workflows/rust-sdk-check.yml |    9 +-
 rust-sdk/host-tool.py                |   23 +-
 rust-sdk/kome.Cargo.lock             | 2580 ++++++++++++++++++++++++++
 3 files changed, 2605 insertions(+), 7 deletions(-)
 create mode 100644 rust-sdk/kome.Cargo.lock

diff --git a/.github/workflows/rust-sdk-check.yml b/.github/workflows/rust-sdk-check.yml
index 4fb4ab6..93baab3 100644
--- a/.github/workflows/rust-sdk-check.yml
+++ b/.github/workflows/rust-sdk-check.yml
@@ -2,9 +2,9 @@ name: Check standalone Rust application SDK
 on:
   push:
     branches: [staging, main, master]
-    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', '.github/workflows/rust-sdk-check.yml']
+    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', 'crates/kome/**', 'crates/msign/**', '.github/workflows/rust-sdk-check.yml']
   pull_request:
-    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', '.github/workflows/rust-sdk-check.yml']
+    paths: ['rust-sdk/**', 'actions/setup-rust-sdk/**', 'crates/kome/**', 'crates/msign/**', '.github/workflows/rust-sdk-check.yml']
 permissions:
   contents: read
 jobs:
@@ -33,3 +33,8 @@ jobs:
           SDK: ${{ steps.sdk.outputs.sdk }}
           HELPER: ${{ steps.sdk.outputs.helper }}
         run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool msign --output "$RUNNER_TEMP/host-tools" --test
+      - name: Test and build Kome without production credentials
+        env:
+          SDK: ${{ steps.sdk.outputs.sdk }}
+          HELPER: ${{ steps.sdk.outputs.helper }}
+        run: python3 "$(dirname "$HELPER")/host-tool.py" --sdk "$SDK" --tool kome --output "$RUNNER_TEMP/host-tools" --test
diff --git a/rust-sdk/host-tool.py b/rust-sdk/host-tool.py
index 0d4027b..dd4d247 100644
--- a/rust-sdk/host-tool.py
+++ b/rust-sdk/host-tool.py
@@ -5,13 +5,14 @@
 import os
 from pathlib import Path
 import subprocess
+import shutil
 
 
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--sdk', type=Path, required=True)
     parser.add_argument('--output', type=Path, required=True)
-    parser.add_argument('--tool', choices=['msign'], required=True)
+    parser.add_argument('--tool', choices=['msign', 'kome'], required=True)
     parser.add_argument('--test', action='store_true')
     args = parser.parse_args()
     sdk = json.loads(args.sdk.read_text())
@@ -22,15 +23,27 @@ def main():
     env.update(RUSTC=sdk['rustc'], RUSTDOC=sdk['rustdoc'])
     command = [sdk['cargo'], 'build', '--release', '--manifest-path', str(devkit / 'Cargo.toml'),
                '--package', args.tool, '--no-default-features', '--target-dir', str(args.output.resolve())]
-    for config in sdk['cargo_config']:
-        command += ['--config', config]
+    cwd = devkit
+    if args.tool == 'kome':
+        # Host-only CLI resolution is isolated from native application/std patches.
+        project = args.output.resolve() / 'kome-source'
+        project.mkdir(parents=True, exist_ok=False)
+        shutil.copytree(devkit / 'crates/kome/src', project / 'src')
+        (project / 'Cargo.toml').write_text((devkit / 'crates/kome/Cargo.toml').read_text() + '\n[workspace]\n')
+        shutil.copyfile(Path(__file__).parent / 'kome.Cargo.lock', project / 'Cargo.lock')
+        command[command.index('--manifest-path') + 1] = str(project / 'Cargo.toml')
+        command += ['--locked', '--features', 'keyring/vendored']
+        cwd = project
+    else:
+        for config in sdk['cargo_config']:
+            command += ['--config', config]
     if args.test:
         test = command.copy()
         test[1] = 'test'
         test.remove('--release')
         env['CARGO_PROFILE_TEST_DEBUG'] = '0'
-        subprocess.run(test, env=env, cwd=devkit, check=True)
-    subprocess.run(command, env=env, cwd=devkit, check=True)
+        subprocess.run(test, env=env, cwd=cwd, check=True)
+    subprocess.run(command, env=env, cwd=cwd, check=True)
 
 
 if __name__ == '__main__':
diff --git a/rust-sdk/kome.Cargo.lock b/rust-sdk/kome.Cargo.lock
new file mode 100644
index 0000000..577dbf6
--- /dev/null
+++ b/rust-sdk/kome.Cargo.lock
@@ -0,0 +1,2580 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.102"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
+[[package]]
+name = "bitflags"
+version = "2.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
+
+[[package]]
+name = "cc"
+version = "1.2.64"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
+[[package]]
+name = "clap"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "combine"
+version = "4.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba5a308b75df32fe02788e748662718f03fde005016435c444eea572398219fd"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "ctrlc"
+version = "3.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0b1fab2ae45819af2d0731d60f2afe17227ebb1a1538a236da84c93e9a60162"
+dependencies = [
+ "dispatch2",
+ "nix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "4.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "curve25519-dalek-derive",
+ "digest",
+ "fiat-crypto",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek-derive"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "dbus-secret-service"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "708b509edf7889e53d7efb0ffadd994cc6c2345ccb62f55cfd6b0682165e4fa6"
+dependencies = [
+ "dbus",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "crypto-common",
+]
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags",
+ "block2",
+ "libc",
+ "objc2",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "ed25519"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
+dependencies = [
+ "pkcs8",
+ "signature",
+]
+
+[[package]]
+name = "ed25519-dalek"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
+dependencies = [
+ "curve25519-dalek",
+ "ed25519",
+ "serde",
+ "sha2",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
+
+[[package]]
+name = "fiat-crypto"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bbe89c50d7a535e539b8c17bc0b49bdb77747034daa8087407d655f3f7cc1d"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-io"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cecba35d7ad927e23624b22ad55235f2239cfa44fd10428eecbeba6d6a717718"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c39754e157331b013978ec91992bde1ac089843443c49cbc7f46150b0fad0893"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "wasip2",
+ "wasip3",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "171fefbc92fe4a4de27e0698d6a5b392d6a0e333506bc49133760b3bcf948733"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "http"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "hyper"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55281c53a1894c864990125767da440a4e630446785086f52523b20033b74498"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
+dependencies = [
+ "http",
+ "hyper",
+ "hyper-util",
+ "rustls",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http",
+ "http-body",
+ "hyper",
+ "ipnet",
+ "libc",
+ "percent-encoding",
+ "pin-project-lite",
+ "socket2",
+ "system-configuration",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "windows-registry",
+]
+
+[[package]]
+name = "icu_collections"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
+dependencies = [
+ "displaydoc",
+ "potential_utf",
+ "utf8_iter",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locale_core"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
+dependencies = [
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_properties"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
+dependencies = [
+ "icu_collections",
+ "icu_locale_core",
+ "icu_properties_data",
+ "icu_provider",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
+
+[[package]]
+name = "icu_provider"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
+dependencies = [
+ "displaydoc",
+ "icu_locale_core",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerotrie",
+ "zerovec",
+]
+
+[[package]]
+name = "id-arena"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
+
+[[package]]
+name = "idna"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b0875f23caa03898994f6ddc501886a45c7d3d62d04d2d90788d47be1b1e4de"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.17.1",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
+
+[[package]]
+name = "is-docker"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "928bae27f42bc99b60d9ac7334e3a21d10ad8f1835a4e12ec3ec0464765ed1b3"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "is-wsl"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "173609498df190136aa7dea1a91db051746d339e18476eed5ca40521f02d7aa5"
+dependencies = [
+ "is-docker",
+ "once_cell",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "jobserver"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9afb3de4395d6b3e67a780b6de64b51c978ecf11cb9a462c66be7d4ca9039d33"
+dependencies = [
+ "getrandom 0.3.4",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce57d20d1ea864ce2ac172ab472d409214f4fd359f0b2a2775abdf522e2af99e"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "byteorder",
+ "dbus-secret-service",
+ "log",
+ "security-framework 2.11.1",
+ "security-framework 3.7.0",
+ "windows-sys 0.60.2",
+ "zeroize",
+]
+
+[[package]]
+name = "kome"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64",
+ "clap",
+ "ctrlc",
+ "ed25519-dalek",
+ "keyring",
+ "mochios-certificate",
+ "open",
+ "rand_core 0.6.4",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+ "toml",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "leb128fmt"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
+
+[[package]]
+name = "libc"
+version = "0.2.191"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "litemap"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
+
+[[package]]
+name = "log"
+version = "0.4.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953f07c43838f8e6f9758cab68bf5bed85465e7587ebe0b823f1bcd81978ad3a"
+
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
+[[package]]
+name = "memchr"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mio"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "mochios-certificate"
+version = "0.1.0"
+source = "git+https://github.com/mochiOS/syscalls?rev=af217f5ca6a585110aabac813eb46dff8ccb7bfc#af217f5ca6a585110aabac813eb46dff8ccb7bfc"
+dependencies = [
+ "ed25519-dalek",
+ "sha2",
+]
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a12a8ed07aefc768292f076dc3ac8c48f3781c8f2d5851dd3d98950e8c5a89f"
+dependencies = [
+ "objc2-encode",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "open"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0b3d059e795d52b8a72fef45658620edd4d9c359b338564aa14391ffa511ed5"
+dependencies = [
+ "is-wsl",
+ "libc",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
+[[package]]
+name = "potential_utf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
+dependencies = [
+ "zerovec",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "aws-lc-rs",
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.60.2",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-rustls",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "quinn",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tokio-rustls",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
+dependencies = [
+ "openssl-probe",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework 3.7.0",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+dependencies = [
+ "web-time",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework 3.7.0",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "3.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2691df843ecc5d231c0b14ece2acc3efb62c0a398c7e1d875f3983ce020e3"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a7852d02fc848982e0c167ef163aaff9cd91dc640ba85e263cb1ce46fae51cd"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6662b5879511e06e8999a8a235d848113e942c9124f211511b16466ee2995f26"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "system-configuration-sys",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.2",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.52.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "920602543f0911ab71da12c50d59701da54c196d1a2bf5cb4b75667f137a406a"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_parser",
+ "toml_writer",
+ "winnow",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.4+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bed810ee007d8e7f9cf20b4774e7198142fa27186e0f805871da7f3c39eaf333"
+dependencies = [
+ "winnow",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff67a8a4397373c3ef660812acab3268222035010ab8680ec4215f38ba3d0eed"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+ "serde",
+]
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen 0.57.1",
+]
+
+[[package]]
+name = "wasip3"
+version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
+dependencies = [
+ "wit-bindgen 0.51.0",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aecb87a33d3b0c5e3b7aa46336eaf486cffafbd281b195e4c8b80d50df2351bf"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef4c5d3d2cdf5c54f4231181768f5510842e350db025faf1f7163b1030ed928"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a690d511e3c1a8b3a55e33511e3c2c00c78415cd23650f32b808627f5696b9ed"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "411e4887f0071ef2d2164a9d5fdf2d20efbef78fccd3a78b0c10a1dc5295e48a"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.128"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81941cd78d0c92026c33e5e01312845a4cb1e9af3407f9134b100dd03144103e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wasm-encoder"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
+dependencies = [
+ "leb128fmt",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasm-metadata"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
+dependencies = [
+ "anyhow",
+ "indexmap",
+ "wasm-encoder",
+ "wasmparser",
+]
+
+[[package]]
+name = "wasmparser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
+dependencies = [
+ "bitflags",
+ "hashbrown 0.15.5",
+ "indexmap",
+ "semver",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.105"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fbddc4a036f00ec4f18c83445bd3115cb306a91da554919a099d9222fe4a7f8"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-registry"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02752bf7fbdcce7f2a27a742f798510f3e5ad88dbe84871e5168e2120c3d5720"
+dependencies = [
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm 0.52.6",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
+[[package]]
+name = "winnow"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+
+[[package]]
+name = "wit-bindgen"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
+dependencies = [
+ "wit-bindgen-rust-macro",
+]
+
+[[package]]
+name = "wit-bindgen"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "wit-bindgen-core"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
+dependencies = [
+ "anyhow",
+ "heck",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-bindgen-rust"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
+dependencies = [
+ "anyhow",
+ "heck",
+ "indexmap",
+ "prettyplease",
+ "syn 2.0.117",
+ "wasm-metadata",
+ "wit-bindgen-core",
+ "wit-component",
+]
+
+[[package]]
+name = "wit-bindgen-rust-macro"
+version = "0.51.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
+dependencies = [
+ "anyhow",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "wit-bindgen-core",
+ "wit-bindgen-rust",
+]
+
+[[package]]
+name = "wit-component"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "indexmap",
+ "log",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "wasm-encoder",
+ "wasm-metadata",
+ "wasmparser",
+ "wit-parser",
+]
+
+[[package]]
+name = "wit-parser"
+version = "0.244.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
+dependencies = [
+ "anyhow",
+ "id-arena",
+ "indexmap",
+ "log",
+ "semver",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "unicode-xid",
+ "wasmparser",
+]
+
+[[package]]
+name = "writeable"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
+
+[[package]]
+name = "yoke"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
+dependencies = [
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce1022995ff5ff5d841ad7d994facc23098cd40152f2c1d11cd607c6f530653f"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ae7f38b72ec2a254e2b87ef277cf2cd4fb97cbebf944faa6f33354da0867930"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "zerotrie"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+]
+
+[[package]]
+name = "zerovec"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

From 0f8585fc13691383bebe304633dae8bced8443d1 Mon Sep 17 00:00:00 2001
From: tas0dev <156896971+tas0dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 17:29:10 +0900
Subject: [PATCH 3/3] Initialize atomic app signing identities in
 approval-protected Actions

---
 rust-sdk/README.md                   |  35 ++++++
 rust-sdk/release.py                  |  29 ++++-
 rust-sdk/signing-setup.py            | 171 +++++++++++++++++++++++++++
 rust-sdk/tests/test_release.py       |  14 +++
 rust-sdk/tests/test_signing_setup.py | 126 ++++++++++++++++++++
 5 files changed, 373 insertions(+), 2 deletions(-)
 create mode 100644 rust-sdk/signing-setup.py
 create mode 100644 rust-sdk/tests/test_signing_setup.py

diff --git a/rust-sdk/README.md b/rust-sdk/README.md
index 18d979e..4f99f7a 100644
--- a/rust-sdk/README.md
+++ b/rust-sdk/README.md
@@ -71,6 +71,10 @@ Official app callers use an `app-release` Environment with
 variable `APP_RELEASE_ENABLED` is explicitly set to `true` and these Environment
 values have been configured:
 
+New callers should use one atomic Secret, `MSIGN_IDENTITY_B64`, populated by the
+approval-protected initializer described below. The release helper also accepts
+the following legacy inputs, but refuses to mix them with an atomic identity:
+
 * Secret `MSIGN_CERTIFICATE_B64`: base64 of the issued Developer Certificate file.
 * Secret `MSIGN_PRIVATE_KEY_B64`: base64 of its corresponding private-key file.
 * Variable `MSIGN_ROOT_PUBLIC_KEY_B64`: base64 of the trusted issuer public-key file.
@@ -82,3 +86,34 @@ success or failure. The signed package is verified against the trusted root
 before publication. Existing release tags/assets are never replaced. The initial
 release helper publishes prereleases as `v<version>-r<revision>`; update the
 manifest revision before making another release of the same version.
+
+## First-time signing setup on Actions
+
+`signing-setup.py` runs only from an explicitly dispatched default-branch job
+protected by the configured Environment/Team. It accepts only successful
+default-branch artifacts from the chosen package workflow and verifies their
+actual source revision, SDK receipt, package identity and checksum. It builds no
+application code and does not publish or enable releases.
+
+The caller needs the pinned SDK's `msign` and `kome` host tools and a short-lived
+fine-grained PAT, limited to the caller repository with Environments read/write,
+as the Environment Secret `SIGNING_SETUP_TOKEN`. This token is used only by `gh`
+to encrypt/store/delete Environment Secrets; it is never passed to Kome or msign.
+The normal read-only job token reads run and protection metadata.
+
+The initializer creates a new package-specific key on the ephemeral runner and
+first saves an encrypted `MSIGN_SETUP_KEYPAIR_B64` recovery Secret. A retry must
+restore the same package/developer key. It never silently rotates credentials.
+Kome prints its public device-login URL/code to the Actions log; the maintainer
+authorizes in a browser, and Kome validates the selected Developer membership,
+obtains the certificate, signs the selected MPKG, and verifies it locally.
+
+Only after verification does the initializer atomically save the certificate,
+key and issuer public key as `MSIGN_IDENTITY_B64`. No credential or signed test
+package is uploaded as an artifact. The temporary Kome session is logged out,
+local temporary files are removed, and recovery/setup Secrets are deleted on
+success. Deleting the setup Secret does not revoke its PAT: revoke that short-
+lived PAT in GitHub settings after setup. On issuance failure, the recovery
+Secret remains for the next approved attempt; session/files are still cleaned.
+Existing production credentials are refused, and publication must remain
+disabled throughout setup. Credential rotation is deliberately a separate task.
diff --git a/rust-sdk/release.py b/rust-sdk/release.py
index 5e39e2b..3428187 100644
--- a/rust-sdk/release.py
+++ b/rust-sdk/release.py
@@ -69,14 +69,20 @@ def validate(directory, expected_id, expected_commit, expected_sdk_ref):
 def sign(package, output, msign):
     """Use explicit environment credentials, verify the result, and remove temporary keys."""
     required = ('MSIGN_CERTIFICATE_B64', 'MSIGN_PRIVATE_KEY_B64', 'MSIGN_ROOT_PUBLIC_KEY_B64')
-    if any(not os.environ.get(key) for key in required):
+    values = {key: os.environ.get(key) for key in required}
+    if os.environ.get('MSIGN_IDENTITY_B64'):
+        if any(values.values()):
+            raise ValueError('Configure one atomic identity or legacy signing values, not both')
+        identity = decode_identity(os.environ['MSIGN_IDENTITY_B64'])
+        values = dict(zip(required, (identity['certificate'], identity['private_key'], identity['issuer_public_key'])))
+    if any(not values[key] for key in required):
         raise ValueError('Signing certificate, private key, and trusted root public key must be configured before enabling releases')
     with tempfile.TemporaryDirectory(prefix='mpkg-signing-') as temporary:
         root = Path(temporary)
         root.chmod(0o700)
         paths = []
         for key in required:
-            data = base64.b64decode(os.environ[key], validate=True)
+            data = base64.b64decode(values[key], validate=True)
             if not data or len(data) > 1024 * 1024:
                 raise ValueError('Invalid signing credential file')
             path = root / key
@@ -89,6 +95,9 @@ def sign(package, output, msign):
         # Do not propagate the credential values to subprocess environments.
         for key in required:
             env.pop(key, None)
+        env.pop('MSIGN_IDENTITY_B64', None)
+        env.pop('SIGNING_SETUP_TOKEN', None)
+        env.pop('MSIGN_SETUP_KEYPAIR_B64', None)
         for key in ('GH_TOKEN', 'GITHUB_TOKEN'):
             env.pop(key, None)
         subprocess.run([str(msign), 'identity', 'import', 'ci-release', '--certificate', str(certificate), '--key', str(private)], env=env, check=True)
@@ -96,6 +105,22 @@ def sign(package, output, msign):
         subprocess.run([str(msign), 'package', 'verify', str(output), '--root-public-key', str(issuer), '--unix-time', str(int(time.time()))], env=env, check=True)
 
 
+def decode_identity(encoded):
+    """Decode an atomically stored signing identity without printing its contents."""
+    if len(encoded) > 64 * 1024:
+        raise ValueError('Signing identity exceeds the size limit')
+    value = json.loads(base64.b64decode(encoded, validate=True))
+    expected = {'format', 'developer_id', 'package_id', 'certificate', 'private_key', 'issuer_public_key'}
+    if (not isinstance(value, dict) or set(value) != expected or type(value['format']) is not int
+            or value['format'] != 1 or not re.fullmatch('[0-9a-f]{32}', value['developer_id'])
+            or not re.fullmatch('[a-z0-9]+(?:[.-][a-z0-9]+)+', value['package_id'])):
+        raise ValueError('Invalid signing identity metadata')
+    for key in ('certificate', 'private_key', 'issuer_public_key'):
+        if not isinstance(value[key], str) or not base64.b64decode(value[key], validate=True):
+            raise ValueError('Invalid signing identity file')
+    return value
+
+
 def absent(repository, path):
     """Require a definite 404; authentication/network failures are never interpreted as absence."""
     result = subprocess.run(['gh', 'api', '-i', 'repos/' + repository + '/' + path], capture_output=True, text=True)
diff --git a/rust-sdk/signing-setup.py b/rust-sdk/signing-setup.py
new file mode 100644
index 0000000..6dcafed
--- /dev/null
+++ b/rust-sdk/signing-setup.py
@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""Initialize a package-scoped identity on an approval-protected GitHub runner."""
+import argparse
+import base64
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+import tempfile
+from urllib.parse import quote
+
+import release
+
+RECOVERY = 'MSIGN_SETUP_KEYPAIR_B64'
+IDENTITY = 'MSIGN_IDENTITY_B64'
+SETUP_TOKEN = 'SIGNING_SETUP_TOKEN'
+
+
+def child_environment():
+    """Never give signing tools GitHub tokens or stored identity/recovery values."""
+    return {key: value for key, value in os.environ.items()
+            if key not in ('GH_TOKEN', 'GITHUB_TOKEN', SETUP_TOKEN, IDENTITY, RECOVERY)
+            and not key.startswith('MSIGN_')}
+
+
+def gh(args, *, token=None, data=None, capture=False):
+    """Send secret values via stdin; suppress API diagnostics that could expose inputs."""
+    env = child_environment()
+    env['GH_TOKEN'] = token or os.environ.get('GH_TOKEN', '')
+    result = subprocess.run(['gh', *args], env=env, input=data, text=True,
+                            stdout=subprocess.PIPE if capture else subprocess.DEVNULL, stderr=subprocess.PIPE)
+    if result.returncode:
+        raise RuntimeError('GitHub operation failed; check token permissions and expiration (secret values withheld)')
+    return result.stdout if capture else None
+
+
+def api(path):
+    """Read workflow/run metadata using the job's read-only GitHub token."""
+    return json.loads(gh(['api', path], capture=True))
+
+
+def encode(data):
+    """Encode a file or record for write-only GitHub Secret storage."""
+    return base64.b64encode(data).decode('ascii')
+
+
+def mask(value):
+    """Register dynamically generated secrets with the Actions log redactor."""
+    if os.environ.get('GITHUB_ACTIONS') == 'true':
+        print('::add-mask::' + value.replace('%', '%25').replace('\r', '%0D').replace('\n', '%0A'), flush=True)
+
+
+def store(repository, environment, name, value):
+    """Encrypt and save a Secret to the explicitly approved Environment via gh."""
+    mask(value)
+    gh(['secret', 'set', name, '--repo', repository, '--env', environment],
+       token=os.environ[SETUP_TOKEN], data=value)
+
+
+def verify_run(record, repository, branch, workflow):
+    """Reject failed runs, PR/fork artifacts, and builds from another workflow/branch."""
+    if (record.get('status') != 'completed' or record.get('conclusion') != 'success'
+            or record.get('event') not in ('push', 'workflow_dispatch') or record.get('head_branch') != branch
+            or record.get('path') != workflow or record.get('repository', {}).get('full_name') != repository
+            or record.get('head_repository', {}).get('full_name') != repository
+            or not re.fullmatch('[0-9a-f]{40}', record.get('head_sha', ''))):
+        raise ValueError('Select a successful default-branch build from the approved package workflow')
+    return record['head_sha']
+
+
+def restore_recovery(encoded, package_id, developer_id, private, public):
+    """Restore the same key after interruption; never generate a silent replacement."""
+    if len(encoded) > 64 * 1024:
+        raise ValueError('Recovery record exceeds the size limit')
+    value = json.loads(base64.b64decode(encoded, validate=True))
+    if (set(value) != {'format', 'package_id', 'developer_id', 'private_key', 'public_key'}
+            or type(value['format']) is not int or value['format'] != 1
+            or value['package_id'] != package_id or value['developer_id'] != developer_id):
+        raise ValueError('Recovery record belongs to a different package/developer')
+    for path, key in ((private, 'private_key'), (public, 'public_key')):
+        data = base64.b64decode(value[key], validate=True)
+        raw = base64.b64decode(data.strip(), validate=True)
+        if len(raw) != 32:
+            raise ValueError('Invalid recovery key file')
+        mask(data.decode().strip())
+        with path.open('xb') as stream:
+            path.chmod(0o600)
+            stream.write(data)
+
+
+def initialize(args):
+    """Generate, recover, obtain, verify, and atomically save one identity; never release."""
+    if (os.environ.get('GITHUB_ACTIONS') != 'true' or os.environ.get('GITHUB_EVENT_NAME') != 'workflow_dispatch'
+            or os.environ.get('GITHUB_REPOSITORY') != args.repository
+            or os.environ.get('GITHUB_REF') != 'refs/heads/' + args.branch):
+        raise ValueError('Signing initialization runs only in the default-branch Actions job')
+    if os.environ.get('APP_RELEASE_ENABLED') == 'true':
+        raise ValueError('Disable publication before initializing signing credentials')
+    if not os.environ.get(SETUP_TOKEN):
+        raise ValueError('Configure the short-lived Environment-write SIGNING_SETUP_TOKEN first')
+    release.approval_policy(args.repository, args.environment, args.reviewer_team, args.branch)
+    commit = verify_run(api('repos/' + args.repository + '/actions/runs/' + args.build_run),
+                        args.repository, args.branch, args.build_workflow)
+    package, _, _ = release.validate(args.artifacts.resolve(), args.package_id, commit, args.sdk_ref)
+    endpoint = 'repos/' + args.repository + '/environments/' + quote(args.environment, safe='') + '/secrets?per_page=100'
+    listed = json.loads(gh(['api', endpoint], token=os.environ[SETUP_TOKEN], capture=True))
+    names = {entry['name'] for entry in listed['secrets']}
+    if listed['total_count'] != len(names):
+        raise ValueError('Could not completely inspect the Environment Secret inventory')
+    if names & {IDENTITY, 'MSIGN_PRIVATE_KEY_B64', 'MSIGN_CERTIFICATE_B64'}:
+        raise ValueError('Signing is already initialized; this workflow never rotates existing credentials')
+    recovery = os.environ.get(RECOVERY, '')
+    if (RECOVERY in names) != bool(recovery):
+        raise ValueError('Recovery state changed; start a fresh approved setup run')
+    with tempfile.TemporaryDirectory(prefix='signing-setup-') as temporary:
+        root = Path(temporary)
+        root.chmod(0o700)
+        private, public = root / 'application.key', root / 'application.pub'
+        env = child_environment()
+        env.update(PATH=str(args.tools.resolve()) + os.pathsep + env.get('PATH', ''),
+                   KOME_CONFIG_HOME=str(root / 'session'), DBUS_SESSION_BUS_ADDRESS='unix:path=' + str(root / 'no-session-bus'))
+        if recovery:
+            restore_recovery(recovery, args.package_id, args.developer_id, private, public)
+        subprocess.run([str(args.tools / 'kome'), 'keygen', '--private-key', str(private), '--public-key', str(public)],
+                       env=env, cwd=root, check=True)
+        mask(private.read_text().strip())
+        if not recovery:
+            record = dict(format=1, package_id=args.package_id, developer_id=args.developer_id,
+                          private_key=encode(private.read_bytes()), public_key=encode(public.read_bytes()))
+            store(args.repository, args.environment, RECOVERY, encode(json.dumps(record).encode()))
+        certificate, issuer = root / 'developer.cert', root / 'issuer.pub'
+        try:
+            print('Authorize Kome using the public URL/code shown below. Never paste tokens into logs.', flush=True)
+            subprocess.run([str(args.tools / 'kome'), 'login', '--no-browser'], env=env, cwd=root, check=True)
+            subprocess.run([str(args.tools / 'kome'), 'developer', 'use', args.developer_id], env=env, cwd=root, check=True)
+            subprocess.run([str(args.tools / 'kome'), 'sign', str(package), '--key', str(private), '--public-key', str(public),
+                            '--certificate', str(certificate), '--issuer-public-key', str(issuer),
+                            '--output', str(root / 'verification.mpkg')], env=env, cwd=root, check=True)
+            identity = dict(format=1, package_id=args.package_id, developer_id=args.developer_id,
+                            private_key=encode(private.read_bytes()), certificate=encode(certificate.read_bytes()),
+                            issuer_public_key=encode(issuer.read_bytes()))
+            encoded = encode(json.dumps(identity).encode())
+            release.decode_identity(encoded)
+            store(args.repository, args.environment, IDENTITY, encoded)
+        finally:
+            # Revoke the temporary CLI session; no refresh token is uploaded or retained.
+            subprocess.run([str(args.tools / 'kome'), 'logout'], env=env, cwd=root,
+                           stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, check=False)
+        for name in (RECOVERY, SETUP_TOKEN):
+            gh(['secret', 'delete', name, '--repo', args.repository, '--env', args.environment], token=os.environ[SETUP_TOKEN])
+        print('Signing identity saved and temporary setup Secrets removed. Publication remains disabled.', flush=True)
+
+
+def main():
+    """Parse trusted caller inputs without accepting arbitrary credential paths or publication commands."""
+    parser = argparse.ArgumentParser(description=__doc__)
+    for name in ('repository', 'environment', 'branch', 'package-id', 'developer-id', 'build-run', 'build-workflow', 'sdk-ref'):
+        parser.add_argument('--' + name, required=True)
+    parser.add_argument('--reviewer-team', type=int, required=True)
+    parser.add_argument('--artifacts', type=Path, required=True)
+    parser.add_argument('--tools', type=Path, required=True)
+    args = parser.parse_args()
+    if (not re.fullmatch('[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+', args.repository)
+            or not re.fullmatch('[0-9a-f]{32}', args.developer_id) or not args.build_run.isdecimal()):
+        raise ValueError('Invalid setup input')
+    initialize(args)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/rust-sdk/tests/test_release.py b/rust-sdk/tests/test_release.py
index 6d504a6..db9c87d 100644
--- a/rust-sdk/tests/test_release.py
+++ b/rust-sdk/tests/test_release.py
@@ -84,6 +84,20 @@ def test_credentials_and_github_tokens_do_not_enter_signer_environment(self):
                 self.assertTrue(all(key not in call.kwargs['env'] for key in values))
             self.assertIn('verify', run.call_args_list[-1].args[0])
 
+    def test_atomic_identity_is_decoded_without_passing_it_to_the_signer(self):
+        encoded_file = base64.b64encode(b'synthetic fixture').decode()
+        identity = dict(format=1, developer_id='a'*32, package_id=self.identity['id'],
+                        certificate=encoded_file, private_key=encoded_file, issuer_public_key=encoded_file)
+        encoded = base64.b64encode(json.dumps(identity).encode()).decode()
+        with patch.dict(os.environ, {'MSIGN_IDENTITY_B64':encoded,'SIGNING_SETUP_TOKEN':'fixture'}, clear=True), patch.object(release.subprocess,'run') as run:
+            release.sign(self.package,self.root/'signed.mpkg',Path('/msign'))
+            self.assertEqual(run.call_count,3)
+            self.assertNotIn('MSIGN_IDENTITY_B64',run.call_args.kwargs['env'])
+            self.assertNotIn('SIGNING_SETUP_TOKEN',run.call_args.kwargs['env'])
+        with patch.dict(os.environ, {'MSIGN_IDENTITY_B64':encoded,'MSIGN_PRIVATE_KEY_B64':encoded_file}, clear=True), patch.object(release.subprocess,'run') as run:
+            with self.assertRaises(ValueError):release.sign(self.package,self.root/'signed.mpkg',Path('/msign'))
+            run.assert_not_called()
+
 
 class PublicationPolicy(unittest.TestCase):
     def setUp(self):
diff --git a/rust-sdk/tests/test_signing_setup.py b/rust-sdk/tests/test_signing_setup.py
new file mode 100644
index 0000000..8623f51
--- /dev/null
+++ b/rust-sdk/tests/test_signing_setup.py
@@ -0,0 +1,126 @@
+import base64
+import contextlib
+import importlib.util
+import io
+import json
+import os
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+from types import SimpleNamespace
+import unittest
+from unittest.mock import patch
+
+HERE = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(HERE))
+spec = importlib.util.spec_from_file_location('setup_signing', HERE / 'signing-setup.py')
+setup = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(setup)
+
+
+class SetupFlow(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.package = Path(self.tmp.name) / 'App.mpkg'
+        self.package.write_bytes(b'fixture')
+        self.args = SimpleNamespace(repository='example/app', environment='release', branch='main',
+            package_id='org.example.app', developer_id='a' * 32, build_run='123', build_workflow='.github/workflows/package.yml',
+            sdk_ref='b' * 40, reviewer_team=123, artifacts=Path(self.tmp.name), tools=Path('/trusted/tools'))
+        self.env = dict(GITHUB_ACTIONS='true', GITHUB_EVENT_NAME='workflow_dispatch', GITHUB_REPOSITORY='example/app',
+            GITHUB_REF='refs/heads/main', GH_TOKEN='read-only-fixture', SIGNING_SETUP_TOKEN='write-fixture')
+        self.run = dict(status='completed', conclusion='success', event='push', head_branch='main',
+            path=self.args.build_workflow, repository=dict(full_name='example/app'),
+            head_repository=dict(full_name='example/app'), head_sha='c' * 40)
+        self.commands, self.saved = [], []
+        self.names = {'SIGNING_SETUP_TOKEN'}
+        self.fail_sign = False
+
+    def command(self, args, **kwargs):
+        self.commands.append((args, kwargs))
+        self.assertTrue(all(key not in kwargs['env'] for key in ('GH_TOKEN', 'GITHUB_TOKEN', setup.SETUP_TOKEN, setup.RECOVERY, setup.IDENTITY)))
+        if args[1] == 'keygen':
+            for flag, byte in (('--private-key', 1), ('--public-key', 2)):
+                path = Path(args[args.index(flag) + 1])
+                if not path.exists():
+                    path.write_bytes(base64.b64encode(bytes([byte]) * 32))
+        if args[1] == 'sign':
+            if self.fail_sign:
+                raise subprocess.CalledProcessError(1, 'kome sign')
+            Path(args[args.index('--certificate') + 1]).write_bytes(b'synthetic certificate')
+            Path(args[args.index('--issuer-public-key') + 1]).write_bytes(base64.b64encode(b'3' * 32))
+        return SimpleNamespace(returncode=0)
+
+    def execute(self):
+        with contextlib.ExitStack() as stack:
+            stack.enter_context(patch.dict(os.environ, self.env, clear=True))
+            stack.enter_context(contextlib.redirect_stdout(io.StringIO()))
+            stack.enter_context(patch.object(setup.release, 'approval_policy'))
+            stack.enter_context(patch.object(setup.release, 'validate', return_value=(self.package, {}, 'v1')))
+            stack.enter_context(patch.object(setup, 'api', return_value=self.run))
+            stack.enter_context(patch.object(setup, 'gh', return_value=json.dumps(dict(total_count=len(self.names),secrets=[dict(name=n) for n in self.names]))))
+            stack.enter_context(patch.object(setup, 'store', side_effect=lambda r,e,n,v:self.saved.append((n,v))))
+            stack.enter_context(patch.object(setup.subprocess, 'run', side_effect=self.command))
+            setup.initialize(self.args)
+
+    def test_success_is_atomic_and_never_uploads_or_releases(self):
+        self.execute()
+        self.assertEqual([name for name,_ in self.saved], [setup.RECOVERY, setup.IDENTITY])
+        identity = setup.release.decode_identity(self.saved[1][1])
+        self.assertEqual(identity['package_id'],self.args.package_id)
+        self.assertEqual(identity['developer_id'],self.args.developer_id)
+        self.assertEqual([args[1] for args,_ in self.commands], ['keygen','login','developer','sign','logout'])
+        for args,_ in self.commands:
+            for flag in ('--private-key','--key','--certificate'):
+                if flag in args:
+                    self.assertFalse(Path(args[args.index(flag)+1]).exists())
+
+    def test_issuance_failure_preserves_recovery_and_revokes_session(self):
+        self.fail_sign=True
+        with self.assertRaises(subprocess.CalledProcessError): self.execute()
+        self.assertEqual([name for name,_ in self.saved],[setup.RECOVERY])
+        self.assertEqual(self.commands[-1][0][1],'logout')
+
+    def test_retry_restores_same_key_without_new_recovery_record(self):
+        self.fail_sign=True
+        with self.assertRaises(subprocess.CalledProcessError): self.execute()
+        recovery=self.saved[0][1]
+        self.env[setup.RECOVERY]=recovery;self.names.add(setup.RECOVERY)
+        self.fail_sign=False;self.saved=[];self.commands=[]
+        self.execute()
+        identity=setup.release.decode_identity(self.saved[0][1])
+        previous=json.loads(base64.b64decode(recovery))
+        self.assertEqual(identity['private_key'],previous['private_key'])
+        self.assertEqual([name for name,_ in self.saved],[setup.IDENTITY])
+
+    def test_existing_identity_and_publication_enabled_are_rejected(self):
+        self.names.add(setup.IDENTITY)
+        with self.assertRaises(ValueError):self.execute()
+        self.assertEqual(self.commands,[])
+        self.names.remove(setup.IDENTITY);self.env['APP_RELEASE_ENABLED']='true'
+        with self.assertRaises(ValueError):self.execute()
+        self.assertEqual(self.commands,[])
+
+    def test_local_pr_fork_and_wrong_branch_cannot_generate_keys(self):
+        for event in ('pull_request','push'):
+            self.env['GITHUB_EVENT_NAME']=event
+            with self.assertRaises(ValueError):self.execute()
+        self.env['GITHUB_EVENT_NAME']='workflow_dispatch'
+        for field,value in [('event','pull_request'),('head_branch','staging'),('conclusion','failure'),('path','other.yml'),('head_repository',{'full_name':'fork/app'})]:
+            previous=self.run[field];self.run[field]=value
+            with self.assertRaises(ValueError):self.execute()
+            self.run[field]=previous
+        self.assertEqual(self.commands,[])
+
+    def test_secret_transport_uses_stdin_and_environment_token_only(self):
+        result=SimpleNamespace(returncode=0,stdout='')
+        with patch.dict(os.environ,self.env,clear=True),patch.object(setup.subprocess,'run',return_value=result) as run:
+            setup.gh(['secret','set','EXAMPLE'],token='write-fixture',data='private-fixture')
+            self.assertNotIn('private-fixture',str(run.call_args.args))
+            self.assertEqual(run.call_args.kwargs['input'],'private-fixture')
+            self.assertEqual(run.call_args.kwargs['env']['GH_TOKEN'],'write-fixture')
+            self.assertNotIn(setup.SETUP_TOKEN,run.call_args.kwargs['env'])
+
+
+if __name__ == '__main__':unittest.main()