Make split modules own their dependency imports

crates/lazaret-core/src/configuration.rs

@@ -1,22 +1,18 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::ffi::{OsStr, OsString};
 use std::fmt;
-use std::fs::File;
+use std::os::fd::OwnedFd;
-use std::io::{Read, Seek, SeekFrom};
-use std::os::fd::{AsRawFd, OwnedFd};
 use std::os::unix::ffi::OsStrExt;
 use std::path::{Path, PathBuf};
 
-use rustix::fs::{AtFlags, FileType, Mode, OFlags, ResolveFlags, Stat, StatxFlags, openat2, statx};
+use rustix::fs::{AtFlags, FileType, Mode, OFlags, ResolveFlags, StatxFlags, openat2, statx};
 use sha2::{Digest, Sha256};
 
 use crate::identity::{ConfigurationFingerprint, DeviceId, DomainId, HostPath, InodeId, MountId};
 use crate::records::{
-    ConfigurationFingerprintRecordV1, EnvironmentReference, MailboxRequest,
+    ConfigurationFingerprintRecordV1, MailboxRequest, ResolvedAutoApprovalRule,
-    NetworkProbeTargetConfigurationV1, NetworkReadinessConfigurationV1, ProfileConfigurationV1,
-    ResolvedAutoApprovalRule, ResolvedDnsProbeTargetV1, ResolvedNetworkProbeTargetV1,
     ResolvedNetworkReadinessV1, ResolvedVolume, TRUSTED_HOST_CONFIGURATION_SCHEMA_ID,
-    TrustedHostConfigurationV1, VolumeAccess, VolumeKind,
+    TrustedHostConfigurationV1, VolumeKind,
 };
 use confined_io::{io_error, open_absolute_directory, validate_executable};
 use validation::validate_sandbox_path;

crates/lazaret-core/src/configuration/confined_io.rs

@@ -1,15 +1,28 @@
+use std::collections::{BTreeMap, BTreeSet};
+use std::ffi::OsString;
+use std::fmt;
+use std::fs::File;
+use std::io::{Read, Seek, SeekFrom};
+use std::os::fd::{AsRawFd, OwnedFd};
+use std::os::unix::ffi::OsStrExt;
+use std::path::{Path, PathBuf};
+
+use rustix::fs::{FileType, Mode, OFlags, ResolveFlags, Stat, openat2};
+
+use crate::identity::HostPath;
+use crate::records::{
+    EnvironmentReference, NetworkProbeTargetConfigurationV1, NetworkReadinessConfigurationV1,
+    ProfileConfigurationV1, ResolvedAutoApprovalRule, ResolvedDnsProbeTargetV1,
+    ResolvedNetworkProbeTargetV1, ResolvedNetworkReadinessV1, ResolvedVolume,
+    TrustedHostConfigurationV1, VolumeAccess, VolumeKind,
+};
+
 use super::validation::{
     validate_declared_host_path, validate_environment_name, validate_sandbox_path,
 };
 use super::{
-    AsRawFd, BTreeMap, BTreeSet, ConfigurationError, ConfigurationErrorKind,
+    ConfigurationError, ConfigurationErrorKind, ConfigurationLoadRequest, ConfinedPathPlan,
-    ConfigurationLoadRequest, ConfinedPathPlan, ConfinedPathType, EnvironmentReference,
+    ConfinedPathType, EnvironmentValue, Ipv4Prefix, MAX_CONFIGURATION_BYTES,
-    EnvironmentValue, File, FileType, HostPath, Ipv4Prefix, MAX_CONFIGURATION_BYTES, Mode,
-    NetworkProbeTargetConfigurationV1, NetworkReadinessConfigurationV1, OFlags, OsStrExt, OsString,
-    OwnedFd, Path, PathBuf, ProfileConfigurationV1, Read, ResolveFlags, ResolvedAutoApprovalRule,
-    ResolvedDnsProbeTargetV1, ResolvedNetworkProbeTargetV1, ResolvedNetworkReadinessV1,
-    ResolvedVolume, Seek, SeekFrom, Stat, TrustedHostConfigurationV1, VolumeAccess, VolumeKind,
-    fmt, openat2,
 };
 
 pub(super) fn validate_host_base(path: &Path, name: &str) -> Result<(), ConfigurationError> {

crates/lazaret-host-coordinator/src/recovery.rs

@@ -1,40 +1,17 @@
 use std::io;
-use std::os::fd::AsRawFd;
-use std::os::unix::ffi::OsStrExt;
-use std::path::Path;
 use std::time::{Duration, Instant};
 
-use lazaret_core::configuration::{ConfinedPathType, ResolvedDomainConfiguration};
 use lazaret_core::identity::{
     ConfigurationFingerprint, DomainId, GenerationId, HostPath, MountIdentity, NamespaceIdentity,
     PidfsProcessIdentityV1,
 };
 use lazaret_core::records::{
-    ArtifactLease, DurableDecision, Generation, Participant, ParticipantOwnership, ParticipantRole,
+    Generation, Participant, ParticipantOwnership, ParticipantRole, ParticipantState,
-    ParticipantState, PersistedHostProcessOwnership, SessionPhase,
+    PersistedHostProcessOwnership,
 };
-use lazaret_linux::filesystem::{current_mount_identity, mount_identity};
+use lazaret_linux::process::RetainedProcess;
-use lazaret_linux::process::{
-    PidfsRecoveryMatch, RetainedProcess, TargetCommand, child_broker, match_recovery_process,
-};
-use lazaret_prepared_lower::PreparedLowerStore;
-use lazaret_state_anchor::StateAnchorLayout;
-use lazaret_storage_catalog::{Catalog, CatalogError};
-use rustix::fs::{AtFlags, Mode, OFlags, fstat, openat, statat, unlinkat};
-use rustix::io::{FdFlags, fcntl_setfd};
 use rustix::process::Signal;
 
-use crate::control::{
-    CONTROL_SOCKET_NAME, PUBLICATION_IDENTITY_NAME, STAGED_CONTROL_SOCKET_NAME,
-    STAGED_PUBLICATION_IDENTITY_NAME,
-};
-use crate::domain_store::{DomainStoreMutation, HostCoordinatorDomainStore};
-use crate::runtime::StateAnchorAbsenceObservation;
-use crate::state_anchor::{
-    StateAnchorCoordinator, StateAnchorCoordinatorError, StateAnchorRecoveryOwner,
-};
-use crate::state_maintenance::recover_state_reset;
-
 const PROCESS_EXIT_TIMEOUT: Duration = Duration::from_secs(5);
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]

crates/lazaret-host-coordinator/src/recovery/reconciliation.rs

@@ -1,16 +1,38 @@
+use std::io;
+use std::os::fd::AsRawFd;
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+use lazaret_core::configuration::{ConfinedPathType, ResolvedDomainConfiguration};
+use lazaret_core::identity::{GenerationId, HostPath, MountIdentity, PidfsProcessIdentityV1};
+use lazaret_core::records::{
+    ArtifactLease, DurableDecision, Generation, Participant, ParticipantOwnership, ParticipantRole,
+    ParticipantState, SessionPhase,
+};
+use lazaret_linux::filesystem::{current_mount_identity, mount_identity};
+use lazaret_linux::process::{
+    PidfsRecoveryMatch, TargetCommand, child_broker, match_recovery_process,
+};
+use lazaret_prepared_lower::PreparedLowerStore;
+use lazaret_state_anchor::StateAnchorLayout;
+use lazaret_storage_catalog::{Catalog, CatalogError};
+use rustix::fs::{AtFlags, Mode, OFlags, fstat, openat, statat, unlinkat};
+use rustix::io::{FdFlags, fcntl_setfd};
+
+use crate::control::{
+    CONTROL_SOCKET_NAME, PUBLICATION_IDENTITY_NAME, STAGED_CONTROL_SOCKET_NAME,
+    STAGED_PUBLICATION_IDENTITY_NAME,
+};
+use crate::domain_store::{DomainStoreMutation, HostCoordinatorDomainStore};
+use crate::runtime::StateAnchorAbsenceObservation;
+use crate::state_anchor::{
+    StateAnchorCoordinator, StateAnchorCoordinatorError, StateAnchorRecoveryOwner,
+};
+use crate::state_maintenance::recover_state_reset;
+
 use super::{
-    ArtifactLease, AsRawFd, AtFlags, CONTROL_SOCKET_NAME, Catalog, CatalogError, ConfinedPathType,
+    RuntimeOwnersAbsent, RuntimeProcessRole, RuntimeRecoveryOwnership, SealedProcessMatch,
-    DomainStoreMutation, DurableDecision, FdFlags, Generation, GenerationId,
+    SealedProcessOwner, SealedRuntimeOwners, runtime_recovery_ownership,
-    HostCoordinatorDomainStore, HostPath, Mode, MountIdentity, OFlags, OsStrExt,
-    PUBLICATION_IDENTITY_NAME, Participant, ParticipantOwnership, ParticipantRole,
-    ParticipantState, Path, PidfsProcessIdentityV1, PidfsRecoveryMatch, PreparedLowerStore,
-    ResolvedDomainConfiguration, RuntimeOwnersAbsent, RuntimeProcessRole, RuntimeRecoveryOwnership,
-    STAGED_CONTROL_SOCKET_NAME, STAGED_PUBLICATION_IDENTITY_NAME, SealedProcessMatch,
-    SealedProcessOwner, SealedRuntimeOwners, SessionPhase, StateAnchorAbsenceObservation,
-    StateAnchorCoordinator, StateAnchorCoordinatorError, StateAnchorLayout,
-    StateAnchorRecoveryOwner, TargetCommand, child_broker, current_mount_identity, fcntl_setfd,
-    fstat, io, match_recovery_process, mount_identity, openat, recover_state_reset,
-    runtime_recovery_ownership, statat, unlinkat,
 };
 
 #[must_use]

crates/lazaret-host-coordinator/src/recovery/tests.rs

@@ -1,11 +1,15 @@
 use std::collections::BTreeMap;
 use std::fs::{self, File, OpenOptions};
+use std::os::fd::AsRawFd;
+use std::os::unix::ffi::OsStrExt;
 use std::os::unix::fs::symlink;
 use std::os::unix::fs::{FileTypeExt, MetadataExt};
 use std::os::unix::net::UnixListener;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 
-use lazaret_core::configuration::{ConfigurationLoadRequest, load_trusted_configuration};
+use lazaret_core::configuration::{
+    ConfigurationLoadRequest, ResolvedDomainConfiguration, load_trusted_configuration,
+};
 use lazaret_core::identity::{
     BootId, BundleDigest, ContainerId, CoordinatorId, DeviceId, HostPidLocator, IdMapDigest,
     InodeId, MountId, NetworkSidecarId, PidfsDeviceId, PidfsInodeId, PidfsProcessAuthorityV1,
@@ -13,14 +17,24 @@ use lazaret_core::identity::{
     SelectedManifestDigest, SourceIdentity,
 };
 use lazaret_core::records::{
-    ArtifactState, DurableDecision, GitRoutingOwnership, HelperOwnership, PrepareOperation,
+    ArtifactLease, ArtifactState, DurableDecision, GitRoutingOwnership, HelperOwnership,
-    PrepareStageState, PreparedArtifact, PreparedLowerOwnership, PublicationOwnership,
+    PrepareOperation, PrepareStageState, PreparedArtifact, PreparedLowerOwnership,
-    SandboxOwnership, StateAnchorOwnership,
+    PublicationOwnership, SandboxOwnership, StateAnchorOwnership,
 };
-use lazaret_linux::filesystem::try_exclusive_flock;
+use lazaret_linux::filesystem::{current_mount_identity, try_exclusive_flock};
+use lazaret_linux::process::{PidfsRecoveryMatch, match_recovery_process};
+use lazaret_prepared_lower::PreparedLowerStore;
 use lazaret_runtime_supervisor::sandbox::default_sandbox_layout;
+use lazaret_state_anchor::StateAnchorLayout;
+use lazaret_storage_catalog::Catalog;
+use rustix::fs::{AtFlags, unlinkat};
 
 use super::*;
+use crate::control::{
+    CONTROL_SOCKET_NAME, PUBLICATION_IDENTITY_NAME, STAGED_CONTROL_SOCKET_NAME,
+    STAGED_PUBLICATION_IDENTITY_NAME,
+};
+use crate::domain_store::{DomainStoreMutation, HostCoordinatorDomainStore};
 
 fn process(value: u64) -> PidfsProcessIdentityV1 {
     PidfsProcessIdentityV1::new(

crates/lazaret-runtime-supervisor/src/supervision.rs

@@ -17,38 +17,25 @@ use lazaret_core::records::{
     HostProcessOwnershipSlot, NetworkReadinessAttestation, ProcessOwnershipCommitAck,
     StagedProcessOwnership,
 };
-use lazaret_ignored_workspace::{GitSentry, PRIVATE_ROUTER_ROLE};
-use lazaret_linux::capability;
 use lazaret_linux::filesystem::{mount_identity, require_write_sealed, sealed_memfd};
 use lazaret_linux::process::{
     ChildStandardIo, ParentEdge, ProcessOwnershipContext, RetainedProcess, TargetCommand,
-    child_broker, current_process_identity,
+    child_broker,
 };
 use lazaret_state_anchor::{
-    RuntimeStateAnchorAbsenceAuthority, RuntimeStateAnchorAuthority, RuntimeStateAnchorInherited,
+    RuntimeStateAnchorAbsenceAuthority, RuntimeStateAnchorMount, StateAnchorLaunchAuthority,
-    RuntimeStateAnchorMount, StateAnchorLaunchAuthority,
 };
 use rustix::event::{PollFd, PollFlags, Timespec, poll};
-use rustix::fs::{FileType, MemfdFlags, Mode, OFlags, ResolveFlags, fstat, memfd_create, openat2};
+use rustix::fs::{FileType, fstat};
 use rustix::io::{FdFlags, fcntl_setfd, read, write};
-use rustix::pipe::{PipeFlags, pipe_with};
 use rustix::process::Signal;
-use rustix::thread::CapabilitySet;
 use serde::{Deserialize, Serialize};
 
-use crate::network::{
+use crate::network::{NetworkProbeRequest, PreparedNetwork};
-    NetworkAttestationContext, NetworkProbeRequest, PreparedNetwork,
-    enter_generation_filesystem_namespaces, enter_generation_network_namespace, prepare_network,
-    probe_current_network,
-};
 use crate::sandbox::RunscCommand;
 
 use handoff::{build_runtime_handoff, parse_runtime_handoff};
-use runtime::{
+use runtime::{receive_message, send_message};
-    attached_runsc_standard_io, fail_network, fail_runtime_components, fail_with_runtime_cleanup,
-    receive_message, require_lifetime_held, runsc_delete_target, runsc_target, send_message,
-    supervise, wait_and_reap, wait_for_runsc_ready,
-};
 use startup::{RuntimeGitRouting, inherited_directory_at, run_supervisor};
 
 pub const PRIVATE_RUNTIME_ROLE: &str = "--lazaret-runtime-supervisor-role";

crates/lazaret-runtime-supervisor/src/supervision/startup.rs

@@ -1,17 +1,39 @@
-use super::{
+use std::fs::File;
-    AsFd, AsRawFd, CapabilitySet, CoordinatorMessage, Duration, FdFlags, File, FileType, GitSentry,
+use std::io::{self, Read};
-    HostProcessOwnershipSlot, Instant, MemfdFlags, Mode, MountIdentity, NamespaceIdentity,
+use std::os::fd::{AsFd, AsRawFd};
-    NetworkAttestationContext, OFlags, PRIVATE_ROUTER_ROLE, PathBuf, PipeFlags, PreparedNetwork,
+use std::path::PathBuf;
-    ProcessOwnershipContext, READINESS_TIMEOUT, Read, ResolveFlags, RetainedProcess,
+use std::time::{Duration, Instant};
-    RuntimeArguments, RuntimeGitRoutingArguments, RuntimeNetworkArguments,
+
+use lazaret_core::identity::{MountIdentity, NamespaceIdentity};
+use lazaret_core::records::{HostProcessOwnershipSlot, StagedProcessOwnership};
+use lazaret_ignored_workspace::{GitSentry, PRIVATE_ROUTER_ROLE};
+use lazaret_linux::capability;
+use lazaret_linux::filesystem::mount_identity;
+use lazaret_linux::process::{
+    ProcessOwnershipContext, RetainedProcess, TargetCommand, child_broker, current_process_identity,
+};
+use lazaret_state_anchor::{
     RuntimeStateAnchorAbsenceAuthority, RuntimeStateAnchorAuthority, RuntimeStateAnchorInherited,
-    RuntimeStateAnchorMount, StagedProcessOwnership, SupervisorEvent, TargetCommand,
+    RuntimeStateAnchorMount,
-    attached_runsc_standard_io, capability, child_broker, current_process_identity,
+};
-    enter_generation_filesystem_namespaces, enter_generation_network_namespace, fail_network,
+use rustix::fs::{FileType, MemfdFlags, Mode, OFlags, ResolveFlags, fstat, memfd_create, openat2};
-    fail_runtime_components, fail_with_runtime_cleanup, fcntl_setfd, fstat, io, memfd_create,
+use rustix::io::{FdFlags, fcntl_setfd};
-    mount_identity, openat2, pipe_with, prepare_network, probe_current_network, receive_message,
+use rustix::pipe::{PipeFlags, pipe_with};
-    require_lifetime_held, runsc_delete_target, runsc_target, send_message, supervise,
+use rustix::thread::CapabilitySet;
-    wait_and_reap, wait_for_runsc_ready,
+
+use crate::network::{
+    NetworkAttestationContext, PreparedNetwork, enter_generation_filesystem_namespaces,
+    enter_generation_network_namespace, prepare_network, probe_current_network,
+};
+
+use super::runtime::{
+    attached_runsc_standard_io, fail_network, fail_runtime_components, fail_with_runtime_cleanup,
+    receive_message, require_lifetime_held, runsc_delete_target, runsc_target, send_message,
+    supervise, wait_and_reap, wait_for_runsc_ready,
+};
+use super::{
+    CoordinatorMessage, READINESS_TIMEOUT, RuntimeArguments, RuntimeGitRoutingArguments,
+    RuntimeNetworkArguments, SupervisorEvent,
 };
 
 pub(super) fn run_supervisor(arguments: &RuntimeArguments) -> io::Result<()> {

crates/lazaret-runtime-supervisor/src/supervision/tests.rs

@@ -7,6 +7,7 @@ use lazaret_linux::process::ChildStandardIoPolicy;
 use rustix::pipe::{PipeFlags, pipe_with};
 use sha2::{Digest, Sha256};
 
+use super::runtime::{attached_runsc_standard_io, runsc_delete_target, runsc_target};
 use super::*;
 
 #[test]