Skip to content

deny.toml: Ban direct dependecies on r-efi outside the SDK crate [Rebase & FF] - #1745

Merged
makubacki merged 2 commits into
OpenDevicePartnership:mainfrom
makubacki:ban_non_sdk_dep_on_r_efi_directly
Aug 14, 2026
Merged

deny.toml: Ban direct dependecies on r-efi outside the SDK crate [Rebase & FF]#1745
makubacki merged 2 commits into
OpenDevicePartnership:mainfrom
makubacki:ban_non_sdk_dep_on_r_efi_directly

Conversation

@makubacki

@makubacki makubacki commented Aug 14, 2026

Copy link
Copy Markdown
Collaborator

Description

r_efi::efi is re-exported from patina::standard::efi, with the guidance that code should depend on the re-export.

While r-efi is only an explicit crate dependency of the patina crate today, it could inadvertently be added as a direct dependency of other crates in the repo in the future.

This change adds a deny rule to the deny.toml file to prevent direct dependencies on r-efi outside of the SDK crate.

This also allows tracking of transitive dependencies on r-efi.

Both patina and getrandom are allowed to depend on r-efi as getrandom does so today used as follows by patina_internal_core:

warning[unmatched-wrapper]: direct parent 'getrandom = 0.4.3' of
banned crate 'r-efi = 6.0.0' was not marked as a wrapper
    ┌─ deny.toml:146:16
    │
146 │     { crate = "r-efi", reason = "Depend on `patina` and use `patina::standard::efi` instead of r-efi directly.", wrappers = ["patina"] }
    │                ━━━━━             ───────────────────────────────────────────────────────────────────────────── reason
    │                │
    │                banned here
    │
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── rand v0.10.2
              └── (dev) patina_internal_core v23.0.2
                  └── patina_dxe_core v23.0.2
                      ├── (dev) patina_adv_logger v23.0.2

A small touchup to arch.rs is made to use the re-exported path.


Also includes a commit to remove a file referencing r_efi that is not included in the crate:

patina_internal_cpu: Delete orphaned file (cpu.rs)

This file is an orphaned version of:

patina_dxe_core\src\cpu\efi_cpu\x64\cpu.rs

That was accidentally left in place during earlier refactors of the
CPU code. It also follows some practices like directly referencing
r-efi that we want to avoid in favor of using patina::standard::efi
so it is being removed to avoid confusion.

Refactor references:

  • Moved to patina_dxe_core in 3d59861
  • Accidentally added back in ac11069

  • Impacts functionality?
  • Impacts security?
  • Breaking change?
  • Includes tests?
  • Includes documentation?

How This Was Tested

  • cargo make deny before and after the deny.toml change

Integration Instructions

  • N/A

@makubacki makubacki self-assigned this Aug 14, 2026
@patina-automation

patina-automation Bot commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

✅ QEMU Validation Passed

All QEMU validation jobs completed successfully.

Note: Q35 is only built on Windows hosts (QEMU boot is disabled due to a QEMU vfat issue).

Workflow run: https://github.com/OpenDevicePartnership/patina/actions/runs/31841805938

Boot Time to EFI Shell

Platform Elapsed
ArmVirt (Linux Host) 25.8s
Q35 (Linux Host) 29.1s

Dependencies

Repository Ref
patina e82b6d6
patina-dxe-core-qemu d8e9540
patina-fw-patcher d06ba7e
patina-qemu firmware v4.0.5
patina-qemu build script 716e869

This comment was automatically generated by the Patina QEMU PR Validation Post workflow.

@github-actions github-actions Bot added the impact:non-functional Does not have a functional impact label Aug 14, 2026
@codecov

codecov Bot commented Aug 14, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

This file is an orphaned version of:

`patina_dxe_core\src\cpu\efi_cpu\x64\cpu.rs`

That was accidentally left in place during earlier refactors of the
CPU code. It also follows some practices like directly referencing
`r-efi` that we want to avoid in favor of using `patina::standard::efi`
so it is being removed to avoid confusion.

Refactor references:

- Moved to patina_dxe_core in 3d59861
- Accidentally added back in ac11069

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
`r_efi::efi` is re-exported from `patina::standard::efi`, with the
guidance that code should depend on the re-export.

While r-efi is only an explicit crate dependency of the `patina`
crate today, it could inadvertently be added as a direct dependency
of other crates in the repo in the future.

This change adds a deny rule to the `deny.toml` file to prevent direct
dependencies on `r-efi` outside of the SDK crate.

This also allows tracking of transitive dependencies on `r-efi`.

Both `patina` and `getrandom` are allowed to depend on `r-efi` as
`getrandom` does so today used as follows by `patina_internal_core`:

```
warning[unmatched-wrapper]: direct parent 'getrandom = 0.4.3' of
banned crate 'r-efi = 6.0.0' was not marked as a wrapper
    ┌─ deny.toml:146:16
    │
146 │     { crate = "r-efi", reason = "Depend on `patina` and use `patina::standard::efi` instead of r-efi directly.", wrappers = ["patina"] }
    │                ━━━━━             ───────────────────────────────────────────────────────────────────────────── reason
    │                │
    │                banned here
    │
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          └── rand v0.10.2
              └── (dev) patina_internal_core v23.0.2
                  └── patina_dxe_core v23.0.2
                      ├── (dev) patina_adv_logger v23.0.2
```

A small touchup to arch.rs is made to use the re-exported path.

Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
@makubacki
makubacki force-pushed the ban_non_sdk_dep_on_r_efi_directly branch from c6ac45f to e82b6d6 Compare August 14, 2026 21:04
@makubacki makubacki changed the title deny.toml: Ban direct dependecies on r-efi outside the SDK crate deny.toml: Ban direct dependecies on r-efi outside the SDK crate [Rebase & FF] Aug 14, 2026
@makubacki

Copy link
Copy Markdown
Collaborator Author

Pushed 4891cac to remove a file that is not caught by cargo-deny because it is orphaned. Included in this PR because it imports r_efi.

@makubacki
makubacki enabled auto-merge (rebase) August 14, 2026 21:09
@makubacki
makubacki merged commit f097fb1 into OpenDevicePartnership:main Aug 14, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

impact:non-functional Does not have a functional impact

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants