From 8cd554b8366c4e3be811c6fca6a62cb32cbce849 Mon Sep 17 00:00:00 2001 From: Uruk Date: Thu, 12 Mar 2026 19:29:19 +0100 Subject: [PATCH 1/3] build(deps): pins dependencies and optimizes docker build process pins crate versions in the project manifest to ensure reproducible builds. replaces the logging implementation and adds gzip compression support to the http client. implements dependency caching in the dockerfile to significantly reduce build times. improves container security and efficiency by refining user management and minimizing layer size. --- Cargo.lock | 42 ++++++++++++++++++++++++++++++++++++++---- Cargo.toml | 37 +++++++++++++++++++------------------ docker/Dockerfile | 28 ++++++++++++++++------------ 3 files changed, 73 insertions(+), 34 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 1f3728e..4374ff9 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -227,6 +227,18 @@ version = "0.7.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50" +[[package]] +name = "async-compression" +version = "0.4.41" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d0f9ee0f6e02ffd7ad5816e9464499fba7b3effd01123b515c41d1697c43dad1" +dependencies = [ + "compression-codecs", + "compression-core", + "pin-project-lite", + "tokio", +] + [[package]] name = "atomic-waker" version = "1.1.2" @@ -383,6 +395,23 @@ dependencies = [ "memchr", ] +[[package]] +name = "compression-codecs" +version = "0.4.37" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "eb7b51a7d9c967fc26773061ba86150f19c50c0d65c887cb1fbe295fd16619b7" +dependencies = [ + "compression-core", + "flate2", + "memchr", +] + +[[package]] +name = "compression-core" +version = "0.4.31" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "75984efb6ed102a0d42db99afb6c1948f0380d1d91808d5529916e6c08b49d8d" + [[package]] name = "convert_case" version = "0.10.0" @@ -1225,9 +1254,9 @@ checksum = "cf97ec579c3c42f953ef76dbf8d55ac91fb219dde70e49aa4a6b7d74e9919050" [[package]] name = "once_cell" -version = "1.21.3" +version = "1.21.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" +checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" [[package]] name = "openssl-probe" @@ -1658,9 +1687,9 @@ dependencies = [ [[package]] name = "schannel" -version = "0.1.28" +version = "0.1.29" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "891d81b926048e76efe18581bf793546b4c0eaf8448d72be8de2bbee5fd166e1" +checksum = "91c1b7e4904c873ef0710c1f407dde2e6287de2bebc1bbbf7d430bb7cbffd939" dependencies = [ "windows-sys 0.61.2", ] @@ -2099,13 +2128,18 @@ version = "0.6.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d4e6559d53cc268e5031cd8429d05415bc4cb4aefc4aa5d6cc35fbf5b924a1f8" dependencies = [ + "async-compression", "bitflags", "bytes", + "futures-core", "futures-util", "http 1.4.0", "http-body", + "http-body-util", "iri-string", "pin-project-lite", + "tokio", + "tokio-util", "tower", "tower-layer", "tower-service", diff --git a/Cargo.toml b/Cargo.toml index 239f38e..c35adee 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -4,27 +4,28 @@ version = "0.9.0" edition = "2024" [dependencies] -actix-web = "4" -futures = "0.3" -futures-util = "0.3" -hex = "0.4.3" -log = "0.4" -pretty_env_logger = "0.5" -qstring = "0.7.2" -reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] } -secp256k1 = { version = "0.31.1", features = ["global-context"] } -serde = { version = "1.0", features = ["derive"] } -serde_json = "1.0.140" -sha2 = "0.10.9" -tokio = { version = "1.48.0", features = ["rt", "macros", "rt-multi-thread"] } -url = "2" -tokio-socks = "0.5" -tokio-tungstenite = { version = "0.28", features = ["rustls-tls-native-roots"] } -urlencoding = "2.1" -uuid = { version = "1", features = ["v4"] } +actix-web = "=4.13.0" +futures = "=0.3.32" +futures-util = "=0.3.32" +hex = "=0.4.3" +log = "=0.4.29" +pretty_env_logger = "=0.5" +qstring = "=0.7.2" +reqwest = { version = "=0.13.2", default-features = false, features = ["json", "rustls", "gzip"] } +secp256k1 = { version = "=0.31.1", features = ["global-context"] } +serde = { version = "=1.0.228", features = ["derive"] } +serde_json = "=1.0.149" +sha2 = "=0.10.9" +tokio = { version = "=1.50.0", features = ["rt", "macros", "rt-multi-thread"] } +url = "=2.5.8" +tokio-socks = "=0.5.2" +tokio-tungstenite = { version = "=0.28.0", features = ["rustls-tls-native-roots"] } +urlencoding = "=2.1.3" +uuid = { version = "=1.22.0", features = ["v4"] } [profile.release] opt-level = "z" lto = true codegen-units = 1 strip = true + \ No newline at end of file diff --git a/docker/Dockerfile b/docker/Dockerfile index d7eefea..8edf35a 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -34,7 +34,15 @@ RUN if [ "${SKIP_UPX}" = "0" ]; then \ WORKDIR /usr/src/app -# Copy project files +# Cache Cargo dependencies separately from source code. +# This layer is only rebuilt when Cargo.toml or Cargo.lock change. +COPY Cargo.toml Cargo.lock ./ +RUN mkdir src && echo "fn main() {}" > src/main.rs \ + && BUILD_COMMIT=cache BUILD_DATE=cache BUILD_BRANCH=cache \ + cargo build --release \ + && rm -rf src + +# Copy project files and build COPY . . # Build the project @@ -56,10 +64,10 @@ ARG BUILD_DATE=unknown ARG BUILD_BRANCH=unknown # Install runtime dependencies -RUN apt-get update && apt-get install -y \ - adduser \ +RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates \ curl \ + passwd \ && apt-get clean autoclean --yes \ && apt-get autoremove --yes \ && rm -rf /var/cache/apt/archives* /var/lib/apt/lists/* @@ -69,18 +77,14 @@ WORKDIR /app # Copy the built binary from the build stage COPY --from=builder /usr/src/app/target/release/ygege /app/ygege -RUN chmod +x /app/ygege - -# Create necessary directories -RUN mkdir -p /app/sessions - # Create non-root user with specific UID/GID for better compatibility # Using UID/GID 10001 to avoid conflicts with host systems # --no-log-init: Prevents large UID values from causing issues -# --system: Creates a system user without password -# --shell /sbin/nologin: Prevents login shell access for security -RUN addgroup --gid 10001 --system ygege \ - && adduser --uid 10001 --system --ingroup ygege --home /home/ygege --shell /sbin/nologin ygege \ +RUN chmod +x /app/ygege \ + && mkdir -p /app/sessions \ + && groupadd --gid 10001 --system ygege \ + && useradd --uid 10001 --system --gid ygege --home-dir /home/ygege --shell /sbin/nologin --no-log-init ygege \ + && mkdir -p /home/ygege \ && chown -R ygege:ygege /app /home/ygege VOLUME ["/app/sessions"] From 9bafebf5be68c463e655d5a49dce8c33c866d470 Mon Sep 17 00:00:00 2001 From: Gauvain <68083474+Gauvino@users.noreply.github.com> Date: Thu, 12 Mar 2026 20:03:04 +0100 Subject: [PATCH 2/3] Update Cargo.toml Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- Cargo.toml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/Cargo.toml b/Cargo.toml index c35adee..0c49ae9 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -27,5 +27,4 @@ uuid = { version = "=1.22.0", features = ["v4"] } opt-level = "z" lto = true codegen-units = 1 -strip = true - \ No newline at end of file +strip = true \ No newline at end of file From f170abe11d685580c620a313b4b108e0f67db977 Mon Sep 17 00:00:00 2001 From: Uruk Date: Thu, 12 Mar 2026 20:07:04 +0100 Subject: [PATCH 3/3] build(docker): optimize and reorganize dockerignore patterns updates the exclusion list to minimize the build context size and improve build performance. reorganizes ignored files into logical categories and includes additional patterns for documentation, ci configurations, nix files, and testing artifacts. --- docker/.dockerignore | 41 +++++++++++++++++++++++++++++++++-------- 1 file changed, 33 insertions(+), 8 deletions(-) diff --git a/docker/.dockerignore b/docker/.dockerignore index 82dbe97..5558b84 100644 --- a/docker/.dockerignore +++ b/docker/.dockerignore @@ -1,10 +1,35 @@ +# Build artifacts target/ -.git/* -.github/* -docs/* -Dockerfile -compose.yml + +# Git & CI +.git/ +.github/ +.gitignore +.devcontainer/ + +# Documentation +docs/ +website/ README.md -README-fr.md -.dockerignore -exctractor.js \ No newline at end of file +README-en.md +DISCLAIMER.md +DISCLAIMER-fr.md +SECURITY.md +LICENCE + +# Docker files (not needed inside the build context) +docker/ + +# Nix +flake.nix +flake.lock + +# Scripts & config examples +scripts/ +Cross.toml +ygege.yml +ygege-en.yml +exctractor.js + +# Tests +tests/ \ No newline at end of file