From b5c33bdd52981649803723065171d018835d6b2f Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Date: Mon, 31 Aug 2026 18:22:52 +0200 Subject: [PATCH] fix(deps): repoint tramiton git-deps to the renamed firmwerk repo (fixes CI) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The private git-dependency still pointed at ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git, which is stale two ways: #231 repointed the host to git.breakpilot.com, and the repo was renamed tramiton -> firmwerk. The CI `insteadOf` rewrite is keyed on git.breakpilot.com, so it never matched the old host and Cargo fell back to a raw SSH clone of a dead host -> "Host key verification failed" -> "failed to get tramiton-core as a dependency". This broke `CI / Check` and every Deploy job on main and all PRs. Repoint the three git-deps (tramiton-core/-repro/-sbom) to ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git, tag unchanged (v0.4.1 = same commit ae4fc137, where the crates are still named tramiton-*), and update the matching Cargo.lock source URLs. Pure repoint — no crate rename, no code change. Migrating the deps to the firmwerk-* crates at a newer tag is a follow-up. Validated: `cargo fetch` + `cargo metadata --offline` resolve the dep from the new URL; resolved source is git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv --- Cargo.lock | 6 +++--- compliance-agent/Cargo.toml | 10 ++++++---- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 92627ab..1744bdd 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -6176,7 +6176,7 @@ dependencies = [ [[package]] name = "tramiton-core" version = "0.4.1" -source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" +source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" dependencies = [ "serde", "tempfile", @@ -6188,7 +6188,7 @@ dependencies = [ [[package]] name = "tramiton-repro" version = "0.4.1" -source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" +source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" dependencies = [ "serde", "serde_json", @@ -6203,7 +6203,7 @@ dependencies = [ [[package]] name = "tramiton-sbom" version = "0.4.1" -source = "git+ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" +source = "git+ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git?tag=v0.4.1#ae4fc1376279f9edb9882605b20877335e7ba8ba" dependencies = [ "object", "serde", diff --git a/compliance-agent/Cargo.toml b/compliance-agent/Cargo.toml index 88298e6..437df97 100644 --- a/compliance-agent/Cargo.toml +++ b/compliance-agent/Cargo.toml @@ -16,14 +16,16 @@ compliance-dast = { path = "../compliance-dast" } werkbank-exec = { path = "../werkbank-exec" } # Native firmware build/target detection for bare-metal & RTOS artifacts. # Same-company IP, used directly (not via CLI) so the whole tramiton suite is -# available to the onboarding classifier. NOTE: CI must be able to fetch this +# available to the onboarding classifier. Repo renamed tramiton -> firmwerk +# (git.breakpilot.com/sharang/firmwerk); crates stay tramiton-* at tag v0.4.1. +# NOTE: CI must be able to fetch this # private repo (see the git-auth step in .gitea/workflows/ci.yml). -tramiton-core = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } +tramiton-core = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" } # tramiton-repro drives the reproducible build (NixBackend seal_and_build) that # yields a sealed lock; `libraries_from_inputs` is the analysis-only fallback. -tramiton-repro = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } +tramiton-repro = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" } # tramiton-sbom renders the bill of materials from a sealed lock (+ binary SCA). -tramiton-sbom = { git = "ssh://git@gitea.meghsakha.com:22222/sharang/tramiton.git", tag = "v0.4.1" } +tramiton-sbom = { git = "ssh://git@git.breakpilot.com:22222/sharang/firmwerk.git", tag = "v0.4.1" } serde = { workspace = true } serde_json = { workspace = true } tokio = { workspace = true }