From bc7ad945423fc47f8bd95e1a8a12e4e6e807a671 Mon Sep 17 00:00:00 2001
From: Albert Hui <i@hack9u.online>
Date: Sun, 2 Aug 2026 03:11:06 +0800
Subject: [PATCH] lints: complete the canonical lints block

lzo carried a partial block: unsafe_code = "forbid" and pedantic, but no
unwrap_used/expect_used, no correctness/suspicious, and none of the
canonical cast_* allows. The panic lints are the gap that matters - this
crate decodes attacker-controllable compressed streams, so ADR-0012's
untrusted-input superset applies.

Added: all, correctness = "deny", suspicious = "deny", unwrap_used =
"deny", expect_used = "deny", and the canonical cast_*/module_name/
must_use/missing_panics allows.

The two pre-existing allows (verbose_bit_mask, missing_errors_doc) are
kept with their original rationale comments, but rewritten from bare
`= "allow"` to `{ level = "allow", priority = 1 }`. That is required, not
cosmetic: clippy's lint_groups_priority rejects a manifest where a lint
group set to "deny" shares priority 0 with an individual lint, so the
bare form fails the build once correctness/suspicious are denied.

Zero findings in production code. The unwraps that surfaced are all in
tests/, which now carry the sanctioned top-level allow.

Gate: cargo build --all-targets, cargo test, cargo clippy --all-targets
-- -D warnings, cargo fmt --check - all clean.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 Cargo.toml         | 16 ++++++++++++++--
 tests/errors.rs    |  2 ++
 tests/roundtrip.rs |  2 ++
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 4cdb339..a1cbdd5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -26,9 +26,21 @@ alloc = []
 unsafe_code = "forbid"
 
 [lints.clippy]
+all = { level = "warn", priority = -1 }
 pedantic = { level = "warn", priority = -1 }
+correctness = "deny"
+suspicious = "deny"
+unwrap_used = "deny"
+expect_used = "deny"
 # The `x & MASK == 0` form mirrors the LZO1X spec's instruction decoding and is
 # clearer here than `trailing_zeros()`.
-verbose_bit_mask = "allow"
+verbose_bit_mask = { level = "allow", priority = 1 }
 # Error variants are self-describing via `Error`'s docs/Display.
-missing_errors_doc = "allow"
+missing_errors_doc = { level = "allow", priority = 1 }
+module_name_repetitions = { level = "allow", priority = 1 }
+must_use_candidate = { level = "allow", priority = 1 }
+missing_panics_doc = { level = "allow", priority = 1 }
+cast_possible_truncation = { level = "allow", priority = 1 }
+cast_possible_wrap = { level = "allow", priority = 1 }
+cast_sign_loss = { level = "allow", priority = 1 }
+cast_precision_loss = { level = "allow", priority = 1 }
diff --git a/tests/errors.rs b/tests/errors.rs
index f47acf4..323e2bb 100644
--- a/tests/errors.rs
+++ b/tests/errors.rs
@@ -2,6 +2,8 @@
 //! malformed, truncated, or crafted input — so these double as e2e coverage of
 //! the decoder's guards, and assert it never panics on hostile bytes.
 
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use lzo::{decompress_into, Error};
 
 // "hello, lzo world!" compressed by liblzo2's lzo1x_1, then the EOF marker.
diff --git a/tests/roundtrip.rs b/tests/roundtrip.rs
index b965701..a53902f 100644
--- a/tests/roundtrip.rs
+++ b/tests/roundtrip.rs
@@ -3,6 +3,8 @@
 //! original, `<name>.lzo` the compressed block). Each block must decompress to
 //! exactly its original.
 
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use std::path::Path;
 
 const DATA: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/tests/data");