[JacobStephens2]

Summary

the_binary_never_links_openssl reads Cargo.lock instead of asking cargo tree offline, so it no longer needs every platform's crates in the cargo cache.

 the_binary_never_links_openssl
-  cargo tree --edges normal,build --target all --offline   # fails on a host-only cache
-  no line starts with openssl-sys, openssl or native-tls
+  read Cargo.lock                                          # every package, every target, no registry
+  openssl_packages(lockfile) is empty
+
+a_lockfile_with_openssl_or_native_tls_in_it_is_caught      # new: the matching, on a fixture lockfile

The lockfile also names dev-dependencies, so the check is stricter than before: a test-only OpenSSL fails it too. The test says so.

Seams tested: the packaging tests themselves, and openssl_packages(lockfile: &str), the matching they share.

Evidence

On an empty CARGO_HOME with only cargo fetch --locked --target x86_64-unknown-linux-gnu run in it:

• Before: cargo test --test packaging

  test the_binary_never_links_openssl ... FAILED
  error: failed to download `android_system_properties v0.1.6`
    attempting to make an HTTP request, but --offline was specified
  test result: FAILED. 2 passed; 1 failed
  

  After:

  test a_lockfile_with_openssl_or_native_tls_in_it_is_caught ... ok
  test the_binary_never_links_openssl ... ok
  test package_leaves_out_the_repository_tooling ... ok
  test package_carries_the_factory_skills_with_their_license_and_credits ... ok
  test result: ok. 4 passed; 0 failed
  

• Checked by hand, not committed: with native-tls = "0.2" under [target.'cfg(windows)'.dependencies], on Linux:

  test the_binary_never_links_openssl ... FAILED
  ["native-tls 0.2.18", "openssl 0.10.81", "openssl-sys 0.9.117"] are dependencies
  

• cargo fmt --check, cargo clippy --all-targets -- -D warnings and the full cargo test pass locally.

Merge Danger

Door: two-way

One test file; reverting restores the old check.

Blast Radius: tests

A dev-dependency that brings in OpenSSL now fails the test, where before only normal and build dependencies did.

Unaddressed findings

Standards

• Mysterious Name (mild): the_binary_never_links_openssl now asserts on the whole lockfile, dev-dependencies included. Kept: the name states what ADR 0003 asks for, the issue names the test as the interface to keep, and the doc comment on openssl_packages says where the check is stricter.
• Mysterious Name (mild): openssl_packages also returns native-tls. Kept: native-tls is banned because it links OpenSSL on Linux, which the doc line "would link OpenSSL" covers; the reviewer also suggested leaving it unless the list grows.

Spec

None: the Spec review reported no findings.

Closes #269

🤖 Generated with Claude Code