Bootstrap verified Rust implementation workspace

support/external-tools.toml

@@ -0,0 +1,128 @@
+schema = 1
+levels = ["V1", "V2", "V3", "V4", "V5"]
+
+[[command]]
+id = "python"
+program = "python3"
+args = ["--version"]
+version_pattern = '^Python 3\.(1[1-9]|[2-9][0-9])\.'
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Python 3.11 or newer is required for repository verification."
+
+[[command]]
+id = "rustc"
+program = "rustc"
+args = ["--version"]
+version_pattern = '^rustc 1\.90\.0 '
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
+
+[[command]]
+id = "cargo"
+program = "cargo"
+args = ["--version"]
+version_pattern = '^cargo 1\.90\.0 '
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Install the pinned Rust toolchain from rust-toolchain.toml."
+
+[[command]]
+id = "cargo-deny"
+program = "cargo-deny"
+args = ["--version"]
+version_pattern = '^cargo-deny 0\.20\.2$'
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Install cargo-deny 0.20.2 with its locked dependency graph."
+
+[[command]]
+id = "git"
+program = "git"
+args = ["--version"]
+version_pattern = '^git version 2\.'
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Git 2.x is required for generated-file drift checks."
+
+[[command]]
+id = "tlc"
+program = "tlc"
+args = ["-h"]
+version_pattern = 'Version 2\.19 '
+accepted_exit_codes = [0, 1]
+policy = "fail"
+levels = ["V1", "V2", "V3", "V4", "V5"]
+diagnostic = "Install the TLC 2.19 launcher on PATH."
+
+[[command]]
+id = "runsc"
+program = "runsc"
+args = ["--version"]
+version_pattern = '^runsc version release-20260622\.0\nspec: 1\.2\.1$'
+policy = "skip"
+levels = ["V3", "V4", "V5"]
+diagnostic = "The selected composition is qualified on runsc release-20260622.0."
+
+[[command]]
+id = "fuse-overlayfs"
+program = "fuse-overlayfs"
+args = ["--version"]
+version_pattern = '^fusermount3 version: 3\.18\.2\nfuse-overlayfs: version 1\.16\nFUSE library version 3\.18\.2\nusing FUSE kernel interface version 7\.45$'
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Install the qualified fuse-overlayfs 1.16 and FUSE 3.18.2 stack."
+
+[[command]]
+id = "slirp4netns"
+program = "slirp4netns"
+args = ["--version"]
+version_pattern = '^slirp4netns version 1\.3\.1\ncommit: .+\nlibslirp: 4\.9\.1\nSLIRP_CONFIG_VERSION_MAX: 6\nlibseccomp: 2\.6\.0$'
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Install the qualified slirp4netns 1.3.1 and libslirp 4.9.1 stack."
+
+[[feature]]
+id = "linux-x86_64"
+probe = "linux-x86_64"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Physical and composition suites currently support Linux x86_64."
+
+[[feature]]
+id = "kernel"
+probe = "kernel-at-least"
+minimum = "6.8"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Linux 6.8 or newer supplies the qualified namespace and pidfd baseline."
+
+[[feature]]
+id = "user-namespaces"
+probe = "user-namespace"
+program = "unshare"
+sysctl_path = "/proc/sys/user/max_user_namespaces"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Enable functional unprivileged user namespace creation for physical runtime tests."
+
+[[feature]]
+id = "subordinate-ids"
+probe = "subordinate-ids"
+minimum_count = 65536
+uidmap_program = "newuidmap"
+gidmap_program = "newgidmap"
+unshare_program = "unshare"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Configure usable 65,536-ID subordinate UID/GID ranges and mapping helpers for the current user."
+
+[[feature]]
+id = "fuse-device"
+probe = "open-character-device"
+path = "/dev/fuse"
+access = "read-write"
+policy = "skip"
+levels = ["V2", "V3", "V4", "V5"]
+diagnostic = "Expose an openable read-write /dev/fuse device to run physical filesystem suites."