ci: use subcommands in helper and stop using jq (#104)

.github/workflows/rust-ci.yaml

@@ -31,6 +31,10 @@ jobs:
         with:
           name: worldcoin
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Check Rust formatting
         run: cargo fmt --check --all
@@ -58,6 +62,10 @@ jobs:
         run: git config --global url."https://${{ secrets.GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
       - name: Cache cargo dependencies
         uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # pin@v2
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Clippy lints
         run: |
@@ -83,6 +91,10 @@ jobs:
         run: git config --global url."https://${{ secrets.GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
       - name: Cache cargo dependencies
         uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # pin@v2
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Cargo Doc
         run: |
@@ -111,10 +123,14 @@ jobs:
         run: git config --global url."https://${{ secrets.GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
       - name: Cache cargo dependencies
         uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # pin@v2
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Configure cargo to exclude platform-specific crates
         run: |
-          tmp=($(scripts/get_excludes.py))
+          tmp=($(scripts/rust_ci_helper.py excludes))
           EXCLUDES=""
           for e in ${tmp[@]}; do
             EXCLUDES+="--exclude ${e} "
@@ -123,8 +139,6 @@ jobs:
           cat ${GITHUB_ENV}
       - name: Cargo Test
         run: |
-          uname -a
-          nix develop -c env
           nix develop -c \
             cargo test --all --all-features --all-targets $EXCLUDES
 
@@ -147,6 +161,10 @@ jobs:
         run: git config --global url."https://${{ secrets.GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
       - name: Cache cargo dependencies
         uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84 # pin@v2
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Choose cargo profile
         run: |
@@ -157,33 +175,32 @@ jobs:
             CI_PROFILE="artifact"
           fi
           echo CI_PROFILE=${CI_PROFILE} >>${GITHUB_ENV}
-      - name: Compile ${{ matrix.target }} Binaries
+      - name: Build linux artifacts
         run: |
-          set -Eeuxo pipefail
-          uname -a
-          nix develop -c env
-          nix develop -c scripts/build_rust_artifacts.py \
-            --out_dir binaries --cargo_profile ${CI_PROFILE}
-          ls -aRsh binaries
+          nix develop -c scripts/rust_ci_helper.py \
+            build_linux_artifacts \
+            --out_dir linux_artifacts \
+            --cargo_profile ${CI_PROFILE}
+          ls -aRsh linux_artifacts
 
       - name: Bundle artifacts
         run: |
           set -Eeuxo pipefail
-          mkdir artifacts
-          for b in binaries/*; do
+          mkdir final_artifacts
+          for b in linux_artifacts/*; do
             b="$(basename ${b})"
             # We make sure that the tarball is idempotent:
             # https://stackoverflow.com/a/54908072
             tar --sort=name --owner=root:0 --group=root:0 --mtime='@0' \
-              -vahcf artifacts/${b}.tar.zst -C binaries/${b} .
+              -vahcf final_artifacts/${b}.tar.zst -C linux_artifacts/${b} .
           done
-          ls -aRsh artifacts
+          ls -aRsh final_artifacts
 
       - name: Upload artifacts
         uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # pin@v3
         with:
           name: artifacts
-          path: artifacts
+          path: final_artifacts
           if-no-files-found: error
 
   cargo-deny:
@@ -203,6 +220,10 @@ jobs:
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
       - name: Authorize private git repos
         run: git config --global url."https://${{ secrets.GIT_HUB_TOKEN }}@github.com".insteadOf https://github.com
+      - name: Print environment
+        run: |
+          uname -a
+          nix develop -c env
 
       - name: Check licenses and security advisories
         run: |

CONTRIBUTING.md

@@ -15,8 +15,11 @@ change things in a backwards-incompatible way at any time!
 - Prefer using cargo [workspace inheritance] when possible.
 - Prefer cross-platform code. Please consult [deps tests](deps-tests) for more
   info.
-- Any binaries that do not run on all platforms must be documented as such in
-  their README.md file and added to the tests in `deps-tests`.
+- All crates and binaries must support at least
+  `{x86_64-aarch64}-unknown-linux-gnu` as a compilation target. Any other targets
+  which are not supported must be specified in
+  `package.metadata.orb.unsupported_targets`. Windows is implicitly not
+  supported as a compilation target.
 - Use `#![forbid(unsafe_code)]` whenever possible. This narrows the surface
   area for debugging memory safety issues.
 - Prefer the [nix crate][nix crate] for safe unix APIs instead of raw unsafe
@@ -28,12 +31,16 @@ change things in a backwards-incompatible way at any time!
 - All first-party crates should start with the `orb-` prefix for the crate name,
   and the crates' directories should omit this prefix. For example, the `attest`
   dir contains the `orb-attest` crate.
+- All binaries intended for deployment to orbs, should have a .deb produced by
+  CI. CI will produce any such .deb for crates with a `package.metadata.deb`
+  section in the Cargo.toml.
 
 ## First time Setup
 
-1. [Install nix][install nix]. This works for both mac and linux, windows is
-only supported via [WSL2][WSL2].
-2. Ensure that you have these lines in your `~/.config/nix/nix.conf`: 
+1. [Install nix][install nix]. This works for both mac and linux, if you are
+   using a windows machine, you must first set up [WSL2][WSL2].
+2. Ensure that you have these lines in your `~/.config/nix/nix.conf`. This is
+  done automatically by the above installer: 
    ```
    experimental-features = nix-command flakes
    max-jobs = auto

mcu-util/Cargo.toml

@@ -30,3 +30,5 @@ unsupported_targets = [
   "aarch64-apple-darwin",
   "x86_64-apple-darwin",
 ]
+
+[package.metadata.deb]

orb-backend-state/Cargo.toml

@@ -30,3 +30,5 @@ zbus.workspace = true
 
 [build-dependencies]
 orb-build-info = { path = "../build-info", features = ["build-script"] }
+
+[package.metadata.deb]

orb-slot-ctrl/Cargo.toml

@@ -21,3 +21,5 @@ thiserror.workspace = true
 
 [build-dependencies]
 orb-build-info = { path = "../build-info", features = ["build-script"] }
+
+[package.metadata.deb]

orb-thermal-cam-ctrl/Cargo.toml

@@ -30,3 +30,5 @@ unsupported_targets = [
   "aarch64-apple-darwin",
   "x86_64-apple-darwin",
 ]
+
+[package.metadata.deb]