Merge pull request #416 from LedgerHQ/mbr/jfrog-rs-client
What the developer wrote
Authored by Mathias BROUSSET
Merge pull request #416 from LedgerHQ/mbr/jfrog-rs-client
jfrog rs client
What changed, and why it matters
This commit adds an automated GitHub Actions job to publish the Rust Bitcoin client library to a package registry (including JFrog) when a version tag is pushed. It also changes the package author metadata from an individual contributor to 'Ledger' and adds a README acknowledgement for that contributor. There are no code changes to the library itself and no apparent security implications.
No security action required. As a routine hygiene check, verify the reusable workflow ledger-app-workflows/.github/workflows/reusable_crates_deployment.yml@v1 handles secrets appropriately and that CARGO_CRATES_TOKEN is scoped only to publishing this crate.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff introduces a new deploy_rust_client job in .github/workflows/ci-workflow.yml that reuses LedgerHQ/ledger-app-workflows/.github/workflows/reusable_crates_deployment.yml@v1, triggered on push of refs/tags/rsclient*. It passes CARGO_CRATES_TOKEN as a secret and enables jfrog_deployment. Cargo.toml’s authors field is updated from ‘Edouard Paris m@edouard.paris’ to ‘Ledger’. README.md adds an Acknowledgements section crediting Edouard PARIS for the initial version. No source code, dependency, cryptographic, or permission changes are present.
Changed components
.github/workflows/ci-workflow.ymlbitcoin_client_rs/Cargo.tomlbitcoin_client_rs/README.mdInspect captured patch +18 / −1
diff --git a/.github/workflows/ci-workflow.yml b/.github/workflows/ci-workflow.yml
index fe33c5a..69c82cf 100644
--- a/.github/workflows/ci-workflow.yml
+++ b/.github/workflows/ci-workflow.yml
@@ -340,3 +340,16 @@ jobs:
run: |
cd bitcoin_client_rs/
cargo test --no-default-features --features="async"
+
+ deploy_rust_client:
+ name: Deploy rust client library
+ needs: job_test_rust_client
+ if: success() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/rsclient')
+ uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_crates_deployment.yml@v1
+ with:
+ package_directory: "bitcoin_client_rs"
+ publish: true
+ release: false
+ jfrog_deployment: true
+ secrets:
+ cargo_token: ${{ secrets.CARGO_CRATES_TOKEN }}
diff --git a/bitcoin_client_rs/Cargo.toml b/bitcoin_client_rs/Cargo.toml
index 6c3b0bd..e9c71d1 100644
--- a/bitcoin_client_rs/Cargo.toml
+++ b/bitcoin_client_rs/Cargo.toml
@@ -1,7 +1,7 @@
[package]
name = "ledger_bitcoin_client"
version = "0.5.0"
-authors = ["Edouard Paris <m@edouard.paris>"]
+authors = ["Ledger"]
edition = "2018"
description = "Ledger Bitcoin application client"
repository = "https://github.com/LedgerHQ/app-bitcoin-new"
diff --git a/bitcoin_client_rs/README.md b/bitcoin_client_rs/README.md
index cf30dc7..9b07c9f 100644
--- a/bitcoin_client_rs/README.md
+++ b/bitcoin_client_rs/README.md
@@ -71,3 +71,7 @@ derivation path and display it on the device screen:
cargo run --package ledger_hwi -- \
get-extended-pubkey --derivation-path "m/44'/0'/0'/0/0" --display
```
+
+## Acknowledgements
+
+The initial version of this client was contributed by Edouard PARIS.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.