Skip to content
SafeMesh

Pinned Rust source install

These exact instructions were tested against this exact source revision:

cab067b1113605007d8cd0098cbc996b15fffafc

SafeMesh is a small replicated-state library with explicit merge rules. This Linux x86_64 recipe builds a standalone consumer of the v0-focus G-Counter, merges two independent tallies, and asserts that replay leaves the total at 6. It does not demonstrate a network or persistence.

You need Git, Bash, a native C linker and rustup, with its proxies on PATH, plus internet access to GitHub and the Rust toolchain server. Start in an empty directory. Copy this whole block; build progress goes to stderr. Cargo finds the safemesh-crdt workspace member by package name in the Git source. The full rev selects its source, and --locked enforces the committed resolution.

Terminal window
mkdir pinned-consumer
cd pinned-consumer
mkdir src
cat > Cargo.toml <<'SAFEMESH_FILE'
[package]
name = "safemesh-pinned-consumer"
version = "0.0.0"
edition = "2021"
publish = false


[dependencies]
safemesh-crdt = { git = "https://github.com/velvetmonkey/safemesh", rev = "cab067b1113605007d8cd0098cbc996b15fffafc" }
SAFEMESH_FILE
cat > Cargo.lock <<'SAFEMESH_FILE'
# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4


[[package]]
name = "safemesh-crdt"
version = "0.1.0"
source = "git+https://github.com/velvetmonkey/safemesh?rev=cab067b1113605007d8cd0098cbc996b15fffafc#cab067b1113605007d8cd0098cbc996b15fffafc"


[[package]]
name = "safemesh-pinned-consumer"
version = "0.0.0"
dependencies = [
 "safemesh-crdt",
]
SAFEMESH_FILE
cat > rust-toolchain.toml <<'SAFEMESH_FILE'
[toolchain]
channel = "1.96.1"
profile = "minimal"
SAFEMESH_FILE
cat > src/main.rs <<'SAFEMESH_FILE'
use safemesh_crdt::GCounter;


fn main() {
    let mut left = GCounter::new(2);
    let mut right = GCounter::new(2);
    left.try_apply_bump(0, 4).unwrap();
    right.try_apply_bump(1, 2).unwrap();
    left.try_merge(&right).unwrap();
    right.try_merge(&left).unwrap();
    assert_eq!(left.state(), right.state());
    assert_eq!(left.value(), 6);
    println!("merged total={}", left.value());
    left.try_merge(&right).unwrap();
    assert_eq!(left.value(), 6);
    println!("duplicate replay total={}", left.value());
}
SAFEMESH_FILE
rustup show active-toolchain >&2
cargo run --quiet --locked

Stdout is exactly:

merged total=6
duplicate replay total=6

The example commits Cargo.toml (the Git dependency), Cargo.lock (Cargo’s exact resolution), rust-toolchain.toml (Rust 1.96.1 and the minimal profile) and src/main.rs (the executable assertions). The block above is generated from those files; retain the lockfile and toolchain file when adapting this application.

This gives no registry release, no prebuilt bindings, and no promise about a later revision. TypeScript/WASM and Python users still build the bindings from source today; the six support fields distinguish that build requirement from API presence and runtime evidence.

Support evidence

Section titled “Support evidence”
FieldWhat this recipe records
API presentRust G-Counter at the full revision above
Artifact availableGit source; no registry package or prebuilt bindings provided
Build checkedLinux x86_64, Rust 1.96.1, exact locked Git dependency
Runtime testedThe merge and replay assertions and stdout shown above on Linux x86_64
Integration testedStandalone Cargo consumer; in-process merge and replay only
Maintainer-supportedNo additional support pledge established by this recipe

No Windows, macOS, hardware, browser or Python runtime evidence is implied. See the claims and evidence for the separate proof boundary.

How the recipe stays pinned

Section titled “How the recipe stays pinned”

The pinned-source job in the documentation workflow extracts this page’s command and expected-output blocks, runs with a new empty CARGO_HOME and consumer directory, and fails on any command failure, stdout difference or resolved-revision mismatch. It checks this page and the example against Cargo’s committed Git resolution, then checks the fresh consumer’s lockfile after execution. It does not substitute the workflow checkout’s HEAD for the named library source revision.

Maintainers regenerate with python3 scripts/check-pinned-source.py --generate <git-revision>: the generator resolves that commit with Git, writes the dependency, asks Cargo to generate the lockfile, executes the asserting example and derives these blocks. CI runs without --generate; it cannot repair drift. Review generated changes before updating the pinned recipe. Updating the recipe requires a new test run.