justfile: catch misplaced cfg(feature) via just check

Cargo.toml

@@ -65,7 +65,7 @@ tempfile = "3.27"
 ssh-key-import = { path = "crates/ssh-key-import", optional = true }
 
 [dev-dependencies]
-varlink-http-bridge = { path = ".", features = ["test-helpers"] }
+varlink-http-bridge = { path = ".", default-features = false, features = ["test-helpers"] }
 reqwest = { version = "0.13", default-features = false, features = ["json", "native-tls"] }
 test-with = { version = "0.17", default-features = false, features = ["runtime", "executable"] }
 tempfile = "3.27"

justfile

@@ -31,10 +31,14 @@ build profile:
 
 check: check_srv_binary_size check_helper_binary_size
 	cargo fmt --check
-	cargo clippy --all-targets --locked -- -W clippy::pedantic
+	cargo clippy --all-targets --locked -- -W clippy::pedantic -D warnings
+	# without default features we catch misplaced cfg(feature) attribute
+	cargo clippy --all-targets --no-default-features --locked -- -W clippy::pedantic -D warnings
 
 test:
 	cargo test --locked
+	# without default features so that cfg(not(feature)) tests run too
+	cargo test --no-default-features --locked
 
 # the httpd service
 srv_binary := "target/release/varlink-httpd"

src/bin/varlink-httpd/import_ssh.rs

@@ -33,7 +33,7 @@ fn default_authorized_keys_path() -> String {
         .into_owned()
 }
 
-/// Write `text` as the authorized_keys at `out`. Mode 0644 because the
+/// Write `text` as the `authorized_keys` at `out`. Mode 0644 because the
 /// bridge can run as non-root.
 fn write_authorized_keys(out: &std::path::Path, text: &str) -> anyhow::Result<()> {
     let parent = out

src/bin/varlink-httpd/main.rs

@@ -1699,6 +1699,7 @@ fn default_bind(insecure: bool) -> (String, Option<String>) {
     }
 }
 
+#[allow(clippy::too_many_lines)]
 fn parse_cli() -> anyhow::Result<Command> {
     use lexopt::prelude::*;
 

src/bin/varlink-httpd/openapi.rs

@@ -157,6 +157,7 @@ const ONEWAY_NOTE: &str = "Send the call with the varlink 'oneway' flag: the \
      service is still reported as 502 Bad Gateway, but errors raised by the \
      service itself, including an unknown method, are not.";
 
+#[allow(clippy::too_many_lines)]
 pub fn idl_to_openapi(address: &str, iface: &Interface) -> Value {
     let mut paths = serde_json::Map::new();
 

src/bin/varlink-httpd/tests.rs

@@ -2093,11 +2093,14 @@ fn test_unit_imports_every_mechanism_credential() {
         .map(|value| value.split_once(':').map_or(value, |(id, _alias)| id))
         .collect();
 
-    let mut looked_for: Vec<&str> = crate::auth_api_key::API_KEY_CREDENTIALS.to_vec();
     #[cfg(feature = "sshauth")]
-    {
-        looked_for.extend(crate::auth_ssh::SSH_AUTHORIZED_KEYS_CREDENTIALS);
-    }
+    let ssh_credentials = crate::auth_ssh::SSH_AUTHORIZED_KEYS_CREDENTIALS;
+    #[cfg(not(feature = "sshauth"))]
+    let ssh_credentials: &[&str] = &[];
+    let looked_for = crate::auth_api_key::API_KEY_CREDENTIALS
+        .iter()
+        .chain(ssh_credentials)
+        .copied();
     for pattern in looked_for {
         assert!(
             imported.contains(&pattern),
@@ -2186,6 +2189,12 @@ fn test_call_mode_from_params() {
             .unwrap_or_default()
     }
 
+    fn oneway(oneway: &str, more: Option<&str>) -> HashMap<String, String> {
+        let mut p = params(more);
+        p.insert("oneway".to_string(), oneway.to_string());
+        p
+    }
+
     assert_eq!(
         CallMode::from_params(&params(None)).unwrap(),
         CallMode::Call
@@ -2202,11 +2211,6 @@ fn test_call_mode_from_params() {
     assert!(CallMode::from_params(&params(Some(""))).is_err());
     assert!(CallMode::from_params(&params(Some("1"))).is_err());
 
-    fn oneway(oneway: &str, more: Option<&str>) -> HashMap<String, String> {
-        let mut p = params(more);
-        p.insert("oneway".to_string(), oneway.to_string());
-        p
-    }
     assert_eq!(
         CallMode::from_params(&oneway("true", None)).unwrap(),
         CallMode::Oneway
@@ -3118,6 +3122,7 @@ method CountItems() -> (count: int)
 ";
 
 #[test]
+#[allow(clippy::too_many_lines)]
 fn test_idl_to_openapi() {
     let iface: zlink::idl::Interface = TEST_IDL.try_into().expect("failed to parse test IDL");
     let doc = openapi::idl_to_openapi("com.example.test", &iface);

src/bin/varlink-httpd/ws_framing.rs

@@ -94,8 +94,8 @@ mod tests {
     #[test]
     fn test_message_split_across_reads() {
         let mut f = VarlinkFramer::new();
-        assert!(f.push_varlink_bytes(b"{\"met").is_empty());
-        assert!(f.push_varlink_bytes(b"hod\":\"x\"}").is_empty());
+        assert_eq!(f.push_varlink_bytes(b"{\"met"), Vec::<Vec<u8>>::new());
+        assert_eq!(f.push_varlink_bytes(b"hod\":\"x\"}"), Vec::<Vec<u8>>::new());
         assert_eq!(
             f.push_varlink_bytes(b"\0{\"next").as_slice(),
             &[b"{\"method\":\"x\"}\0".to_vec()]
@@ -107,7 +107,7 @@ mod tests {
     #[test]
     fn test_empty_push_yields_no_frames() {
         let mut f = VarlinkFramer::new();
-        assert!(f.push_varlink_bytes(b"").is_empty());
+        assert_eq!(f.push_varlink_bytes(b""), Vec::<Vec<u8>>::new());
         assert_eq!(f.finish(), None);
     }
 
@@ -143,7 +143,7 @@ mod tests {
             f.push_varlink_bytes(b"raw\0bytes\0no framing"),
             vec![b"raw\0bytes\0no framing".to_vec()]
         );
-        assert!(f.push_varlink_bytes(b"").is_empty());
+        assert_eq!(f.push_varlink_bytes(b""), Vec::<Vec<u8>>::new());
 
         // post-upgrade client bytes must not be parsed (or warned about)
         f.detect_protocol_upgrade_request(b"\xff\xfe raw upload data");
@@ -153,7 +153,7 @@ mod tests {
     #[test]
     fn test_buffered_partial_flushed_on_upgrade() {
         let mut f = VarlinkFramer::new();
-        assert!(f.push_varlink_bytes(b"{\"reply\"").is_empty());
+        assert_eq!(f.push_varlink_bytes(b"{\"reply\""), Vec::<Vec<u8>>::new());
         f.detect_protocol_upgrade_request(b"{\"upgrade\":true}\0");
         assert_eq!(
             f.push_varlink_bytes(b":42}\0raw"),

src/bin/varlinkctl-http/main.rs

@@ -410,6 +410,7 @@ fn resp_body_text(resp: &tungstenite::http::Response<Option<Vec<u8>>>) -> Option
 /// Schemes are case-insensitive (RFC 3986 section 3.1), so `HTTPS://` has
 /// to count as TLS here too.
 /// <https://www.rfc-editor.org/rfc/rfc3986#section-3.1>
+#[cfg(feature = "sshauth")]
 fn url_is_tls(url: &str) -> bool {
     let scheme = url.split_once("://").map_or("", |(scheme, _)| scheme);
     ["https", "wss", "vsock+tls"]

src/listen.rs

@@ -41,7 +41,7 @@ pub async fn accept_and_configure(
     }
 }
 
-/// Returns a SslAcceptorBuilder from the given {cert,key}_path with
+/// Returns a `SslAcceptorBuilder` from the given {cert,key}_path with
 /// a minimium TLS1.3 version requirement for TLS channel binding.
 ///
 /// # Errors

src/node_id.rs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: LGPL-2.1-or-later
 
 //! Handle the node-id for the varlink relayd tunnel. Uses the
-//! /etc/machine-id and sd_id128_get_machine_app_specific() to get
+//! /etc/machine-id and `sd_id128_get_machine_app_specific()` to get
 //! a per-machine stable node identifier (see `man machine-id`).
 
 use anyhow::{Context, bail};

src/sysconf.rs

@@ -197,15 +197,14 @@ mod tests {
         );
 
         let missing = CredentialsLoader::from_dir(dir.path().join("nonexistent"));
-        assert!(
-            missing.find(PATTERNS).unwrap().is_empty(),
+        assert_eq!(
+            missing.find(PATTERNS).unwrap(),
+            Vec::<PathBuf>::new(),
             "a missing credentials directory means no credentials"
         );
-        assert!(
-            missing
-                .find_with(PATTERNS, str::to_string)
-                .unwrap()
-                .is_empty()
+        assert_eq!(
+            missing.find_with(PATTERNS, str::to_string).unwrap(),
+            Vec::<String>::new()
         );
     }
 

src/ws.rs

@@ -229,7 +229,7 @@ mod tests {
         client.shutdown().await.unwrap();
         let mut got = Vec::new();
         server.read_to_end(&mut got).await.unwrap();
-        assert!(got.is_empty());
+        assert_eq!(got, b"");
         server.shutdown().await.unwrap();
     }