Cargo.toml

[package]
name = "sq-pkcs11"
version = "0.3.0"
edition = "2021"
# Floor is set by the largest transitive in our dependency graph: as of
# sequoia-openpgp 2.2, the idna_adapter 1.2.x → icu_* 2.2 chain requires
# rustc 1.86.  Cargo's MSRV-aware resolver will refuse to pick newer
# transitive versions that bump this further so long as rust-version is
# declared.  Update both this field and the README in lockstep when the
# floor moves.
rust-version = "1.86"
description = "Sign OpenPGP release artifacts using keys stored on a PKCS#11 HSM"
license = "Apache-2.0"

[dependencies]
# PKCS#11
cryptoki = "0.12"

# OpenPGP
sequoia-openpgp = { version = "2", default-features = false, features = ["crypto-openssl"] }

# CLI
clap = { version = "4", features = ["derive", "env"] }

# Error handling
anyhow = "1"
thiserror = "2"

# Secure passphrase prompting.  Pinned to 7.4.x because rpassword 7.5
# adopts let-chain syntax (stabilised in Rust 1.88) without declaring
# its own rust-version, which silently breaks builds on our declared
# MSRV (1.86).  Loosen to "7" once rpassword either declares its MSRV
# or we bump ours.
rpassword = "~7.4"

# Hex encoding for CKA_ID display/parsing
hex = "0.4"

# RFC 3339 / ISO 8601 timestamp parsing for --creation-time
humantime = "2"

# Calendar-aware year arithmetic for --validity-period `Ny`.  Without this,
# the 365.25-day Julian-year approximation drifts ~6h/year off the wall-clock
# anniversary of the creation timestamp — annoying for audit-trail clarity
# on multi-year release-signing certs.  Only `std` is enabled; we don't need
# clock/now or the IANA timezone database.
chrono = { version = "0.4", default-features = false, features = ["std"] }

[dev-dependencies]
# CLI integration test scaffolding
assert_cmd = "2"
tempfile   = "3"
dotenvy    = "0.15"

# Strict OpenPGP packet parsing for integration-test assertions on cert-revoke
# and subkey-revoke output. Same crate + features as [dependencies], so Cargo
# unifies the build.
sequoia-openpgp = { version = "2", default-features = false, features = ["crypto-openssl"] }