[jdx]

Summary

Follow-up to #1068, unblocking mise embedding aube's install path (aube::embed::add) instead of shelling out to the aube binary. Depending on the aube crate as a library currently drags in two things an install-only embedder never needs; this makes both opt-out.

publish feature (default on) — gates the sigstore stack

The sigstore provenance/signing supply chain (sigstore-sign/oidc/types + ambient-id, transitively x509-cert, sigstore-{bundle,crypto,merkle,rekor,tsa,tuf,trust-root}, etc.) is only used by aube publish — 2 files. It's now behind a publish feature (in default), so an embedder builds without it. The Commands::Publish CLI variant, its dispatch arms, and the two command modules are #[cfg(feature = "publish")].

hickory-dns out of aube-registry's default

reqwest's hickory-dns cargo feature flips the default DNS resolver for every reqwest client in the final binary via feature unification. With it in aube-registry's defaults, an embedder pulling aube-registry transitively (through aube-resolver/aube-store) silently gets hickory forced on — even if it carefully disabled it on its own direct dep. Fixed by dropping hickory-dns from aube-registry's default (now default = ["rustls"]); the aube binary re-enables it via the aube crate's default features, so standalone behavior is unchanged, and embedders opt in explicitly.

aube crate TLS/DNS feature forwards

Adds rustls and hickory-dns features on the aube crate that forward to reqwest / aube-registry / aube-util, so it can be depended on with default-features = false, features = ["rustls"].

Verification

• Default build (cargo build -p aube): unchanged — tree still contains sigstore, hickory-dns, ratatui, mimalloc (37 sigstore/hickory nodes). 665 lib tests pass.
• Embed shape (--no-default-features --features rustls): builds clean under RUSTFLAGS=-D warnings; tree contains 0 sigstore / hickory / ratatui / mimalloc nodes. clippy clean.
• One dead-code field (BuiltArchive.unpacked_size, read only by publish) is #[cfg_attr(not(feature = "publish"), allow(dead_code))].

Suggested CI addition (token lacks workflow scope)

Alongside the existing embed-shape check, add:

      - run: cargo check -p aube --no-default-features --features rustls

This PR was generated by an AI coding assistant (Claude Code).

---

Note

Low Risk
Cargo feature and cfg gating only; standalone aube defaults preserve prior behavior, with embed builds as the main behavioral surface change.

Overview
Makes the aube library embeddable without dragging in publish/signing or forced Hickory DNS, so install-only hosts (e.g. mise) can depend on aube with default-features = false, features = ["rustls"].

A new publish feature (still on by default) gates the sigstore/ambient-id dependencies and wraps publish / publish_provenance plus all Publish CLI wiring in #[cfg(feature = "publish")]. BuiltArchive.unpacked_size is allowed as dead code when publish is off.

aube-registry defaults drop hickory-dns (now default = ["rustls"] only) so transitive pulls do not flip reqwest’s DNS resolver for the whole binary via feature unification. The aube crate re-enables Hickory in its own defaults and adds explicit rustls / hickory-dns features that forward to reqwest, aube-registry, and aube-util.

^{Reviewed by Cursor Bugbot for commit 812ad6b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

@jdx, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a90509f-a284-4e67-a3dd-cd009098031d

📥 Commits

Reviewing files that changed from the base of the PR and between 3975564 and 812ad6b.

📒 Files selected for processing (5)

• crates/aube-registry/Cargo.toml
• crates/aube/Cargo.toml
• crates/aube/src/commands/mod.rs
• crates/aube/src/commands/pack.rs
• crates/aube/src/lib.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR makes the aube library safe for install-only embedders (e.g. mise) by introducing two independent opt-out mechanisms: a publish feature that gates the entire sigstore/OIDC signing stack, and removal of hickory-dns from aube-registry's defaults to prevent the reqwest DNS resolver from being silently forced on transitive dependents via feature unification.

• publish feature: sigstore/OIDC deps become optional; Commands::Publish, its two dispatch arms, and the publish/publish_provenance modules are all consistently #[cfg(feature = "publish")]. A dead-code suppression attr is added to BuiltArchive.unpacked_size for non-publish builds.
• DNS/TLS feature forwarding: aube-registry defaults drop to ["rustls"] only; the aube crate's hickory-dns feature forwards directly to both reqwest/hickory-dns and aube-registry/hickory-dns (mirroring the rustls forwarding pattern), and the binary's default features re-enable both to preserve existing standalone behavior.

Confidence Score: 5/5

Safe to merge — default standalone builds are behavior-equivalent, and the embed path is verified clean under RUSTFLAGS=-D warnings.

All feature gates are applied consistently across module declarations, the enum variant, and both dispatch arms. The hickory-dns forwarding asymmetry noted in a prior review is resolved by directly listing reqwest/hickory-dns in the hickory-dns feature alongside aube-registry/hickory-dns. publish_provenance is only called from within publish.rs, so both modules gating together is complete with no missing sites.

No files require special attention.

Important Files Changed

Filename	Overview
crates/aube/Cargo.toml	Adds publish, rustls, and hickory-dns features to the aube crate's default set. The publish feature gates sigstore/OIDC optional deps; rustls and hickory-dns forward explicitly to reqwest, aube-registry, and aube-util so embedders can control TLS/DNS without silent feature-unification surprises. The hickory-dns feature now explicitly lists reqwest/hickory-dns directly (not just through aube-registry), addressing the potential asymmetry with rustls forwarding.
crates/aube-registry/Cargo.toml	Removes hickory-dns from default features, keeping only rustls. The hickory-dns feature remains available for opt-in. This is the core change enabling embedders to avoid the DNS resolver side-effect; the aube binary re-enables it via its own default features.
crates/aube/src/lib.rs	Gates Commands::Publish enum variant and its two dispatch arms in async_main behind #[cfg(feature = "publish")]. All three sites are consistently gated; the match exhaustiveness remains correct without the feature.
crates/aube/src/commands/mod.rs	Gates publish and publish_provenance module declarations behind #[cfg(feature = "publish")]. Correct — publish_provenance is only referenced from within publish.rs, so both modules gating together is complete.
crates/aube/src/commands/pack.rs	Adds #[cfg_attr(not(feature = "publish"), allow(dead_code))] to BuiltArchive.unpacked_size so non-publish builds stay warning-clean.

_{Reviews (2): Last reviewed commit: "chore(aube): list reqwest/hickory-dns di..." | Re-trigger Greptile}