#!/usr/bin/env nu
const TARGETS = [
"x86_64-unknown-linux-gnu",
"aarch64-unknown-linux-gnu",
"aarch64-apple-darwin",
]
const FORBIDDEN = ["webpki-roots", "webpki-root-certs"]
const REQUIRED = ["rustls-platform-verifier", "rustls-native-certs"]
def main [] {
for target in $TARGETS {
# --target all includes wasm's bundled fallback, which hydrant does not ship.
let result = (
cargo tree --locked --workspace --target $target --prefix none --format "{p}"
| complete
)
if $result.exit_code != 0 {
error make {
msg: $"cargo tree failed for ($target):\n($result.stderr)"
}
}
let packages = ($result.stdout | lines | each { split row " " | first } | uniq)
let bundled = ($packages | where {|package| $package in $FORBIDDEN})
if not ($bundled | is-empty) {
error make {
msg: $"($target): bundled certificate roots found: ($bundled | str join ', ')"
}
}
let missing = ($REQUIRED | where {|package| $package not-in $packages})
if not ($missing | is-empty) {
error make {
msg: $"($target): native trust support missing: ($missing | str join ', ')"
}
}
}
print "TLS root dependency check passed"
}