.deps retired: siblings as pinned git dependencies, iroh-relay as a pinned binary

.github/workflows/ci.yml

@@ -38,8 +38,6 @@ jobs:
           deno-version: "2.9.5"
 
       - name: Install dependencies
-        # Before the cargo cache step: the cache keys on the workspaces'
-        # lockfiles, and the .deps/iroh checkout must exist to be keyed.
         run: ./scripts/setup.sh
         # cargo-binstall resolves releases through api.github.com;
         # unauthenticated requests share a 60/hour per-IP limit that pooled
@@ -49,11 +47,11 @@ jobs:
 
       - name: Date sources by their last commit
         # Cargo decides a path dependency is stale when its sources are
-        # newer than its artifact, and a checkout (ours) or a clone
-        # (setup.sh's) stamps every file with the current time — so
-        # restored artifacts always lose to freshly written sources, and
-        # every in-repo crate recompiles however good the cache is.
-        run: ./scripts/restore-mtimes.py . .deps/*
+        # newer than its artifact, and a checkout stamps every file with
+        # the current time — so restored artifacts always lose to
+        # freshly written sources, and every in-repo crate recompiles
+        # however good the cache is.
+        run: ./scripts/restore-mtimes.py .
 
       - name: Cache the cargo home
         uses: Swatinem/rust-cache@v2
@@ -62,11 +60,11 @@ jobs:
           # The build directories are cached below instead. This action
           # saves them only after deleting every package that lives in the
           # repository — which is every crate the gate spends its time on,
-          # ours and the pinned checkouts' — and even for the packages it
-          # keeps it drops artifacts whose file name does not end in a
-          # build hash (cargo emits some, e.g. deps/libiroh_relay.rlib).
-          # A missing output makes cargo rebuild the unit and everything
-          # above it, so what survived rebuilt anyway.
+          # ours — and even for the packages it keeps it drops artifacts
+          # whose file name does not end in a build hash (cargo emits
+          # some, e.g. deps/libiroh_relay.rlib). A missing output makes
+          # cargo rebuild the unit and everything above it, so what
+          # survived rebuilt anyway.
           cache-targets: false
           # The action keys on workspace-MEMBER manifests and lockfiles;
           # the virtual workspace ROOT manifests are never read. But the
@@ -77,17 +75,15 @@ jobs:
           # "up-to-date", discarding everything the change forced it to
           # build, on every run (how #63's target/host tree recompiled
           # cold each time). Hash the roots into the key ourselves.
-          key: gate-inputs-${{ hashFiles('Cargo.toml', '.deps/iroh/Cargo.toml', 'justfile', '.github/justfile', '.github/workflows/ci.yml') }}
+          key: gate-inputs-${{ hashFiles('Cargo.toml', 'justfile', '.github/justfile', '.github/workflows/ci.yml') }}
           # setup.sh has already installed the pinned tools into
           # ~/.cargo/bin when this restore runs; a cached bin/ would roll
           # them back to whatever versions main's cache holds. Excluding
           # bin/ also changes the cache path set, so entries saved with
           # bin/ included no longer match.
           cache-bin: false
-          # The upstream iroh-relay builds into its own checkout's target.
           workspaces: |
             . -> target
-            .deps/iroh -> target
           # Save only on main: PR jobs restore but never save, so PR
           # branches don't churn the cache entries every run depends on.
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -98,14 +94,13 @@ jobs:
         with:
           path: |
             target
-            .deps/iroh/target
           # Everything that invalidates artifacts wholesale is in the key:
           # the toolchain, the profiles, the resolved dependency versions,
           # the gate's cargo invocations, and the mtime policy the restored
           # artifacts were judged fresh against. A key that misses still
           # restores the newest entry under the prefix, so cargo rebuilds
           # what changed instead of everything.
-          key: build-dirs-${{ hashFiles('rust-toolchain.toml', 'Cargo.toml', 'Cargo.lock', '.deps/iroh/Cargo.toml', '.deps/iroh/Cargo.lock', 'justfile', '.github/justfile', '.github/workflows/ci.yml', 'scripts/restore-mtimes.py') }}
+          key: build-dirs-${{ hashFiles('rust-toolchain.toml', 'Cargo.toml', 'Cargo.lock', 'justfile', '.github/justfile', '.github/workflows/ci.yml', 'scripts/restore-mtimes.py') }}
           restore-keys: build-dirs-
 
       - name: Run the gate
@@ -120,5 +115,4 @@ jobs:
         with:
           path: |
             target
-            .deps/iroh/target
           key: ${{ steps.build-dirs.outputs.cache-primary-key }}

.github/workflows/jsr-publish.yml

@@ -1,7 +1,6 @@
 # Publish @polymorph/iroh (host-deltic) to JSR: build the endpoint
-# component from this tree (against the .deps sibling checkouts
-# scripts/setup.sh pins), embed it as the package's base64 asset module,
-# and publish.
+# component from this tree, embed it as the package's base64 asset
+# module, and publish.
 #
 # Auth is GitHub Actions OIDC: the package's GitHub-repository link on
 # jsr.io authorizes runs from this repository — no tokens. Dispatch after
@@ -26,10 +25,6 @@ jobs:
       - uses: denoland/setup-deno@v2
         with:
           deno-version: "2.9.5"
-      - name: Install dependencies (.deps sibling checkouts)
-        run: ./scripts/setup.sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
       - name: Build and embed the endpoint component
         run: |
           cargo build -p iroh-endpoint --target wasm32-wasip2 --release

.gitignore

@@ -1,5 +1,4 @@
 target/
-/.deps
 node_modules
 /experiments/iroh-relay-ws/host/dist
 /experiments/iroh-blobs/host/dist

Cargo.toml

@@ -5,27 +5,32 @@ members = ["core", "endpoint", "endpoint-demo", "host-wasmtime", "experiments/ex
 # set. The wasm-only components build for their target through the
 # justfile recipes.
 default-members = ["core", "host-wasmtime"]
-# The sibling checkouts under .deps are their own workspaces; without the
-# exclusion cargo binds their workspace-inheriting members to this root.
-# experiments/udp-wake is likewise its own workspace: it needs no sibling
-# checkouts and builds with its own RUSTFLAGS (`--cfg tokio_unstable`).
-exclude = [".deps", "experiments/udp-wake"]
+# experiments/udp-wake is its own workspace: it builds with its own
+# RUSTFLAGS (`--cfg tokio_unstable`).
+exclude = ["experiments/udp-wake"]
 
 [workspace.package]
 edition = "2021"
 publish = false
 
-# Sibling host/guest crates come from git worktrees under .deps (created by
-# scripts/setup.sh at pinned commits), so this repository consumes the
-# siblings' current mainline surfaces without forking them in-tree.
+# Sibling crates are consumed as git dependencies pinned at a commit, per
+# the siblings' own release practice; bumped deliberately.
+[workspace.dependencies]
+polymorph-tls-profile = { git = "https://github.com/polymorph-components/polymorph-tls.git", rev = "e6f244c2136a1fdc8bd836aab05572620c3d3df4" }
+polymorph-tls-quic = { git = "https://github.com/polymorph-components/polymorph-tls.git", rev = "e6f244c2136a1fdc8bd836aab05572620c3d3df4" }
+polymorph-webcrypto-guest = { git = "https://github.com/polymorph-components/polymorph-webcrypto.git", rev = "227d075a9f306764029dd6762fdab73c6cfc893f" }
+polymorph-webcrypto-wasmtime = { git = "https://github.com/polymorph-components/polymorph-webcrypto.git", rev = "227d075a9f306764029dd6762fdab73c6cfc893f" }
+wasmtime-webrtc-datachannels = { git = "https://github.com/polymorph-components/polymorph-webrtc-datachannels.git", rev = "0f991407c2698577df3d117789024c14be250bd6" }
+wasmtime-websocket = { git = "https://github.com/polymorph-components/polymorph-websocket.git", rev = "7c364c593d51a977f5f267711b06d0fb18cfc068" }
+
 [profile.release]
 lto = true
 opt-level = "s"
 
 # The native host binaries (test harnesses, not shipped artifacts).
 # Fat LTO buys real size on the guest components but only link time
-# here — and CI relinks the hosts every run, since freshly checked-out
-# path deps are always mtime-dirty. Thin LTO parallelizes the links.
+# here, and the hosts relink on every gate run that touches anything
+# beneath them. Thin LTO parallelizes the links.
 [profile.host]
 inherits = "release"
 lto = "thin"

README.md

@@ -216,10 +216,9 @@ hand the server's printed endpoint ID to the client
 wire):
 
 ```sh
-./scripts/setup.sh   # sibling + iroh checkouts under .deps, npm installs
+./scripts/setup.sh   # pinned tools + the iroh-relay binary, npm installs
 just build           # components + host binaries
-just relay-build
-.deps/iroh/target/release/iroh-relay --dev &   # ws on 127.0.0.1:3340
+iroh-relay --dev &   # ws on 127.0.0.1:3340
 WEBRTC_INCLUDE_LOOPBACK=1 target/host/endpoint-demo \
   target/components/iroh-demo.wasm \
   --role server --relay http://127.0.0.1:3340 --webrtc &

core/Cargo.toml

@@ -8,8 +8,8 @@ description = "Shared endpoint core: the webcrypto-held identity, RPK TLS config
 [dependencies]
 # The TLS 1.3 crypto core: the polymorph:tls sibling's wasm-safe profile with
 # QUIC packet protection and quinn session glue, all in-guest RustCrypto.
-polymorph-tls-profile = { path = "../.deps/tls/rust/profile" }
-polymorph-tls-quic = { path = "../.deps/tls/rust/quic" }
+polymorph-tls-profile.workspace = true
+polymorph-tls-quic.workspace = true
 rustls = { version = "=0.23.43", default-features = false, features = ["std", "custom-provider"] }
 rustls-pki-types = "1"
 hex = "0.4"
@@ -21,6 +21,6 @@ serde = { version = "1", default-features = false, features = ["derive"] }
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 blake3 = { version = "1", default-features = false }
 wit-bindgen = { version = "0.59", features = ["async"] }
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
 
 [dev-dependencies]

endpoint-demo/Cargo.toml

@@ -12,4 +12,4 @@ crate-type = ["cdylib"]
 wit-bindgen = { version = "0.59", features = ["async"] }
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
 hex = "0.4"
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true

endpoint/Cargo.toml

@@ -10,7 +10,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 iroh-endpoint-core = { path = "../core" }
-polymorph-tls-quic = { path = "../.deps/tls/rust/quic" }
+polymorph-tls-quic.workspace = true
 noq-proto = { version = "=1.1.0", default-features = false }
 rustls = { version = "=0.23.43", default-features = false, features = ["std", "custom-provider"] }
 getrandom = "0.4"
@@ -20,4 +20,4 @@ wit-bindgen = { version = "0.59", features = ["async", "async-spawn", "inter-tas
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true

experiments/exec-model/guest/Cargo.toml

@@ -11,5 +11,5 @@ crate-type = ["cdylib"]
 [dependencies]
 wit-bindgen = { version = "0.59", features = ["async", "async-spawn"] }
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
-polymorph-webcrypto-guest = { path = "../../../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
 hex = "0.4"

experiments/iroh-blobs/host/browser-test.mjs

@@ -31,7 +31,7 @@ const GUEST_WASM = join(
   HOST_DIR,
   "../guest/target/wasm32-wasip2/release/iroh-blobs-guest.wasm",
 );
-const RELAY_BIN = join(ROOT, ".deps/iroh/target/release/iroh-relay");
+const RELAY_BIN = "iroh-relay";
 const TIMEOUT_MS = 90_000;
 
 const MIME = {

experiments/iroh-blobs/run.sh

@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Runs the iroh-blobs spike end to end: a stock iroh-relay server (from
-# .deps/iroh, built by the just recipe), then the deltic host on stock
-# Deno driving the wasip2 guest — runtime-linked, no transpile step; the
-# translator ships inside the pinned @deltic/translator package.
+# Runs the iroh-blobs spike end to end: the pinned iroh-relay binary
+# (scripts/setup.sh), then the deltic host on stock Deno driving the
+# wasip2 guest — runtime-linked, no transpile step; the translator ships
+# in the pinned @deltic/translator package.
 # Reuses an already-running relay on 127.0.0.1:3340; kills only what it
 # started.
 set -euo pipefail
 cd "$(dirname "$0")"
 
-RELAY_BIN=../../.deps/iroh/target/release/iroh-relay
+RELAY_BIN=iroh-relay
 RELAY_PID=""
 
 if ! curl -s -m 2 http://127.0.0.1:3340 >/dev/null 2>&1; then

experiments/iroh-relay-ws/host/browser-test.mjs

@@ -30,7 +30,7 @@ const GUEST_WASM = join(
   HOST_DIR,
   "../guest/target/wasm32-wasip2/release/iroh-relay-ws-guest.wasm",
 );
-const RELAY_BIN = join(ROOT, ".deps/iroh/target/release/iroh-relay");
+const RELAY_BIN = "iroh-relay";
 const TIMEOUT_MS = 90_000;
 
 const MIME = {

experiments/iroh-relay-ws/run.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
-# Runs the iroh-relay-ws spike end to end: a stock iroh-relay server (from
-# .deps/iroh, built by the just recipe), then the deltic host on stock
-# Deno driving the wasip2 guest — runtime-linked, no transpile step; the
-# translator ships inside the pinned @deltic/translator package. Reuses an
-# already-running relay on 127.0.0.1:3340; kills only what it started.
+# Runs the iroh-relay-ws spike end to end: the pinned iroh-relay binary
+# (scripts/setup.sh), then the deltic host on stock Deno driving the
+# wasip2 guest — runtime-linked, no transpile step; the translator ships
+# inside the pinned @deltic/translator package. Reuses an already-running
+# relay on 127.0.0.1:3340; kills only what it started.
 set -euo pipefail
 cd "$(dirname "$0")"
 
-RELAY_BIN=../../.deps/iroh/target/release/iroh-relay
+RELAY_BIN=iroh-relay
 RELAY_PID=""
 
 if ! curl -s -m 2 http://127.0.0.1:3340 >/dev/null 2>&1; then

experiments/ping-demo/web/test.mjs

@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 import { chromium } from "playwright";
 
 const SITE = fileURLToPath(new URL("./site", import.meta.url));
-const RELAY_BIN = fileURLToPath(new URL("../../../.deps/iroh/target/release/iroh-relay", import.meta.url));
+const RELAY_BIN = "iroh-relay";
 const RELAY_URL = "http://127.0.0.1:3340";
 const TIMEOUT = 60_000;