From cb80e3f3fac163ed7c006bdf5275458c8fca3859 Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 9 Aug 2026 14:23:06 +0000 Subject: [PATCH 1/2] fix(deps): widen state-history-forensic to 0.2 Completes the chain. "0.1" cannot reach 0.2.x -- for a 0.x crate cargo treats the minor as the major -- so this crate was pinned to the 0.1 line with no lock refresh able to cross it. Ordered last on purpose. Widening here first was tried and measured: it resolves 0.1.1 and 0.2.1 side by side, because forensic-vfs and forensic-vfs-resolver both carried the old requirement. Both had to publish (0.7.2 and 0.3.2) before this converges. Also unsticks two layer-2 lock lags this crate had accumulated: forensic-vfs 0.7.0 -> 0.7.2 (0.7.1 was published and never picked up) and state-history-forensic 0.1.0 -> 0.2.1, where 0.1.0 still declared rust-version 1.85 -- the floor the 0.1.1 backport existed to correct. Verified, three ways: - `cargo tree -i state-history-forensic@0.1.1` -> did not match any packages - single 0.2.1 entry in Cargo.lock - `cargo tree -d` duplicate set is byte-identical to origin/main's, so no new duplicate is introduced (35 pre-existing pairs, unchanged) `cargo metadata --locked` passes and the suite is green: 90 passed, 0 failed, 33 test targets. --- Cargo.lock | 15 +++++++++------ Cargo.toml | 2 +- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d907be4..ba9629a 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -781,9 +781,9 @@ checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb" [[package]] name = "forensic-vfs" -version = "0.7.0" +version = "0.7.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "285cbb38f775a1c3c476e7e20bffea29eea6a62f73e0721957c04cb3867d1fa6" +checksum = "a0ddd42a9ee486369f4a16bec780a21faa546a07a31e9950522791c286c64fb7" dependencies = [ "forensicnomicon-core", "state-history-forensic", @@ -830,9 +830,9 @@ dependencies = [ [[package]] name = "forensic-vfs-resolver" -version = "0.3.1" +version = "0.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2e41e140c22b5599f470ec33cfc4dd63ba887a13cacfc69567b08156847f1ecc" +checksum = "f5dd23708f5232362171cae4254e6d88a8baa4e091889ae93b5e5d66b3f1d388" dependencies = [ "forensic-vfs", "state-history-forensic", @@ -1563,9 +1563,12 @@ checksum = "199905e6153d6405f9728fe44daace35f8f837bbf830bb6e85fbd5828709a886" [[package]] name = "state-history-forensic" -version = "0.1.0" +version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "06d95f05c0dd49a5dfae0eb6cb6fae7bb3bd5c1f787300c94a3a5adecb44d98f" +checksum = "dc4d5ce31ae7f3521c8f64584056d13b8dcc52c1f59d780f1eba667994109343" +dependencies = [ + "forensicnomicon-core", +] [[package]] name = "static_assertions" diff --git a/Cargo.toml b/Cargo.toml index 56a33ed..eb946e7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -34,7 +34,7 @@ exclude = [ forensic-vfs = "0.7" # The generic layer resolver: the `SourceOpen` extension trait over `Openers`. forensic-vfs-resolver = "0.3" -state-history-forensic = "0.1" +state-history-forensic = "0.2" # Batteries-included: every fleet reader is compiled in, non-optional, so the # zero-config build resolves the whole container/volume/filesystem stack. Each From 9617231d77eba546fa326d4030e628c0822e98cf Mon Sep 17 00:00:00 2001 From: Albert Hui Date: Sun, 9 Aug 2026 14:45:08 +0000 Subject: [PATCH 2/2] chore(vet): refresh publisher records for the three versions this widen pulls in CI runs `cargo vet --locked`, which will not refresh imports.lock, so the cached publisher records still named forensic-vfs 0.7.0, forensic-vfs-resolver 0.3.1 and state-history-forensic 0.1.0 while the widen resolves 0.7.2, 0.3.2 and 0.2.1. Bookkeeping, not a supply-chain decision. All three already have [[trusted.*]] entries for user-id 347968 (h4x0r) with criteria safe-to-deploy, and every new version was published by that same account inside its trust window: forensic-vfs 0.7.2 published 2026-08-09 window 2026-07-07..2027-08-06 forensic-vfs-resolver 0.3.2 published 2026-08-09 window 2026-07-18..2027-08-05 state-history-forensic 0.2.1 published 2026-08-06 window 2026-06-16..2027-08-06 Dates read from the crates.io API, independently of cargo-vet. The set of attested crate NAMES is unchanged at 41 before and after -- the check that separates version churn (this) from a new crate entering the graph, which would be a decision and not a refresh. No exemption added, no certify, and not --accept-all. --- supply-chain/imports.lock | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock index e936190..de3273c 100644 --- a/supply-chain/imports.lock +++ b/supply-chain/imports.lock @@ -128,15 +128,15 @@ user-login = "h4x0r" user-name = "Albert Hui" [[publisher.forensic-vfs]] -version = "0.7.0" -when = "2026-07-20" +version = "0.7.2" +when = "2026-08-09" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" [[publisher.forensic-vfs-resolver]] -version = "0.3.1" -when = "2026-07-20" +version = "0.3.2" +when = "2026-08-09" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui" @@ -226,8 +226,8 @@ user-login = "h4x0r" user-name = "Albert Hui" [[publisher.state-history-forensic]] -version = "0.1.0" -when = "2026-06-16" +version = "0.2.1" +when = "2026-08-06" user-id = 347968 user-login = "h4x0r" user-name = "Albert Hui"