What the developer wrote
Authored by Nick Johnson
Move gen dep tree to its own script.
Invert crate whitelist to a blacklist and exclude bitcoin-fuzz since it
is internal only. The exisiting whitelist had a broken version for
hashes, but the blacklist approach should be more robust.
What changed, and why it matters
This commit simply moves a helper command that draws a dependency tree from one project file (the justfile) into its own shell script. It also switches from listing specific crates to excluding only an internal fuzz-testing crate. There is no change to the actual Bitcoin library code, no security fix, and no vulnerability.
No action required. This is a non-security tooling refactor.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change refactors how cargo tree is invoked to generate a workspace dependency graph. The previous justfile recipe used an explicit crate whitelist (with a reportedly stale version pin for bitcoin_hashes) and is replaced by a script that uses --workspace --exclude bitcoin-fuzz. The command still prunes serde, rand, bincode, and serde_json and excludes dev/build edges. It is a build/maintenance tooling refactor only.
Changed components
contrib/gen-dep-tree.shjustfileInspect captured patch +18 / −6
diff --git a/contrib/gen-dep-tree.sh b/contrib/gen-dep-tree.sh
new file mode 100755
index 00000000..e50b87a0
--- /dev/null
+++ b/contrib/gen-dep-tree.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+#
+# Generate dependency tree for all workspace packages except fuzz.
+set -euo pipefail
+
+exec cargo tree \
+ --workspace \
+ --exclude bitcoin-fuzz \
+ --all-features \
+ --edges=no-dev,no-build \
+ --format='{lib}' \
+ --no-dedupe \
+ --prune=serde_json \
+ --prune=rand \
+ --prune=bincode \
+ --prune=serde
diff --git a/justfile b/justfile
index f47ff1d1..3ca6fda8 100644
--- a/justfile
+++ b/justfile
@@ -58,10 +58,6 @@ githooks-install:
githooks-remove:
{{justfile_directory()}}/contrib/copy-githooks.sh -r
-# Generate a dependency tree
+# Generate a dependency tree for workspace crates.
gen-dep-tree:
- cargo tree --all-features --edges=no-dev,no-build --format={lib} --no-dedupe \
- --prune=serde_json --prune=rand --prune=bincode --prune=serde \
- -p bitcoin -p bitcoin-internals -p bitcoin_hashes@0.16.0 -p bitcoin-units \
- -p bitcoin-primitives -p chacha20-poly1305 -p base58ck -p bitcoin-addresses -p bitcoin-io@0.2.0 \
- -p bitcoin-consensus-encoding
+ {{justfile_directory()}}/contrib/gen-dep-tree.sh
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.