CVS commit: pkgsrc/net/xfr

["pin" <pin%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   pin
Date:           Thu Oct 22 13:36:06 UTC 2026

Modified Files:
        pkgsrc/net/xfr: Makefile cargo-depends.mk distinfo

Log Message:
net/xfr: update to 0.12.1

[0.12.1] - 2026-10-21
Security

    Distrusted emSign intermediates are rejected — updated webpki-roots and webpki-root-certs to 1.0.10 and rustls-webpki to 0.103.16, closing RUSTSEC-2026-0381, RUSTSEC-2026-0383 and 
RUSTSEC-2026-0382. The private keys of several emSign intermediate CAs are now public. The bundled roots still included emSign ECC Root CA - G3, and certificate verification did not reject the 
compromised intermediates, so a network attacker holding one of those keys could impersonate an HTTPS server xfr talks to: the update check and the Prometheus push gateway. The new roots drop that CA 
and verification rejects paths through those intermediates. QUIC tests are unaffected, since xfr authenticates QUIC peers with the PSK channel binding, not the public CA set. Lockfile-only; no source 
or API changes.

[0.12.0] - 2026-10-17
Security

    Updated rustls to 0.23.46 — closes RUSTSEC-2026-0346 (Debug impls could expose TLS session secrets), RUSTSEC-2026-0349 (a ServerHello could downgrade the handshake to classical key exchange), 
RUSTSEC-2026-0347 (data leak after an ECH rejection; xfr does not use ECH), and RUSTSEC-2026-0348 (brotli certificate decompression; xfr does not enable rustls's brotli feature). rustls backs xfr's 
QUIC transport and its HTTPS clients (update check, Prometheus push gateway). Lockfile-only; no source or API changes.

Added

    xfr::persistence::atomic_write(path, bytes) — the library's crash-safe save routine (used for JSON and CSV results and preferences) is public, so other output paths can share it.

Changed

    Behavior change: client options given with a subcommand are now a usage error — xfr --json -t 5 -P 4 diff a b or xfr -p 9000 serve used to run with those options silently dropped, so xfr -p 9000 
serve listened on the default port instead of 9000. Top-level test, output and connection options typed alongside serve, diff or discover now fail with a usage error (exit 2) naming the option. When 
the subcommand takes the same option, the error's tip shows the corrected command (tip: put serve options after the subcommand: xfr serve --port 9000); otherwise it says the option only applies to 
client tests. Scripts and service units that put options before serve must move them after it (xfr serve -p 9000). --theme, --log-file, --log-level, --no-update-check and --completions still work 
with any subcommand, but as top-level options they go before it: xfr --no-update-check serve works, xfr serve --no-update-check is a usage error. Only --theme is also accepted after the subcommand,
 and serve has its own --log-file and --log-level, which go after it. Options set through environment variables (XFR_DURATION, XFR_PORT, XFR_PSK, ...) are not affected.

Maintenance

    Less allocation in interval aggregation — jitter and RTT averages and the total TCP congestion window are computed without temporary vectors. Missing and measured-zero values, RTT rounding, and 
saturating congestion-window totals retain their existing meaning.
    Less allocation in TUI reporting — help paging counts wrapped rows without building a temporary vector, and server tables format only visible cells while borrowing protocol and direction labels.
    Native Windows tests in CI — the Windows job now runs Clippy on all targets and the all-features test suite, including integration tests, instead of cargo check. The job is informational and does 
not fail the workflow while Windows support is experimental. The two QUIC upload pacing tests are skipped on Windows, where QUIC delivers far below the -b target (see Known Issues).
    Dropped the typos CI check — it mostly flagged false positives (test fixtures, changelog wording); spelling is left to review.
    Less allocation in Push Gateway formatting — Prometheus metric lines are written directly into the payload buffer instead of allocating a temporary string for each line. Metric names, labels, 
ordering, and text formatting are unchanged.
    Less allocation in plain and CSV reporting — formatted report fragments and CSV summary rows are written directly into their output buffer, and plain reports reuse a static separator. Output text 
and CSV column ordering are unchanged.

Documentation

    README restructured — the README is now a short entry point; installation moved to docs/INSTALL.md, a documentation index to docs/README.md, and the detailed reference into docs/FEATURES.md. Old 
README anchors are kept so existing links still land. docs/COMPARISON.md no longer says iperf3 uses a port per stream, describes its authentication as username/password with RSA-encrypted 
credentials, and credits its --json-stream.
    README demo re-recorded — the GIF opens on a populated throughput view in colour at real-time speed, from docs/demo.tape.

Fixed

    QUIC servers no longer hang up to 30 s after a test, and SIGTERM closes QUIC clients — the client closed its connection the moment the result arrived. Quinn holds back a CONNECTION_CLOSE while 
the congestion window is full, which an upload's is, so the client's acknowledgement of the result, carried in that close, often never left. The server waits for that acknowledgement before it lets 
go of a test, so it waited out the 30 s idle timeout instead. serve --one-off exited 30 s late, and other servers held the test's slot for 30 s. The client now waits up to 1 s for the server to close 
before closing itself, the server closes the connection once the result is acknowledged, and xfr serve handles SIGINT and SIGTERM (now exit status 0) by closing its QUIC connections before it exits. 
A client whose server is stopped mid-test fails within a few hundred milliseconds instead of after 30 s. Servers still wait up to 30 s for older clients.
    Every TCP stream carries data at high stream counts — unpaced TCP tests with many streams on a fast link left some streams with zero bytes while the run exited 0 and reported a plausible total: 
about 10 of 64 streams on loopback, and 60–90 of 128. The send loop (since zero-copy sends) waited for socket readiness and wrote with calls that bypass tokio's cooperative scheduling budget, so on a 
socket that stayed writable it never gave up its worker thread. The remaining streams' connects and the server's routing of them, and wakeups for sockets that had filled, then waited until the test 
ended. The send loop now yields to the scheduler regularly. With the fix, -P 4 on loopback also splits throughput evenly across streams and raises the total by about 60% (before, the slowest stream 
ran at a fraction of the others' rate). If a TCP stream still carries nothing in a direction it was meant to use, the client warns (Warning: N of M streams carried no data; the totals cover on
ly the rest, and zero_byte_streams in --json), and the server logs it. -n tests are exempt, since a small budget can leave streams empty by design.
    Prometheus /metrics no longer grows with every test — the server exported each finished test's xfr_stream_* and xfr_tcp_* series (labelled with test_id) forever, so a long-running serve 
--prometheus grew in scrape size and memory with every test: in a 20-minute soak of 120 short tests the series count rose from 14 to 1626. Per-test series are now kept for the 16 most recently 
finished tests, including tests that errored or were cancelled, and removed after that. A test's final values therefore stay visible to the next scrapes. The aggregate xfr_bytes_total, 
xfr_tests_total and xfr_test_duration_seconds still count every test.
    Ctrl-C works throughout both TUIs — client Settings no longer swallows interrupts (Ctrl-C closes it and cancels the test), and the server dashboard now accepts Ctrl-C. Terminals that send a 
literal ETX are supported too. Client cancellation keeps the existing summary wait and second-interrupt force exit.
    Preference, JSON result and CSV result saves are atomic — writes now complete and sync beside the destination before replacing it, preserving the previous save on failure, Unix permission bits, 
and valid symlinks. Read-only files, broken symlinks, and directories are rejected; devices, FIFOs, and pipes (-o /dev/null, -o /dev/stdout) are written in place as before. A writable file in a 
directory that is not writable is still overwritten in place, as before, with a warning that the save is not atomic. Save errors name the destination and the cause (Cannot save to out/x.json: 
directory does not exist) instead of the temporary file's path.
    TUI theme readability — the default theme uses the terminal foreground for light and dark terminals, and RGB themes use brighter secondary text on their intended dark backgrounds. Per-stream bar 
labels and empty tracks now follow the theme's dim text color instead of a fixed dark gray. Secondary text in the default theme (labels, footer key names, stream IDs, empty bar tracks) is a fixed mid 
grey (xterm 244, #808080) rather than a named ANSI grey: Solarized Dark draws ANSI 8 in its background colour, which made all of it invisible, and light palettes put ANSI 7 next to theirs. The 
monochrome theme's borders and secondary text, which had the same ANSI 8 problem, use that grey too. Loss indicators retain their existing styles.
    TUIs stay readable in small terminals — the client prioritizes live throughput and progress on short terminals and never cuts the rate mid-unit (the state label is shortened or dropped first), 
and its footer now leads with the ? help hint so narrow widths drop the other hints first, then the Status: label, then the status itself; the server dashboard omits optional table columns on narrow 
terminals, drops its Blocked / Auth Fail and then Tests / Failed header stats instead of running them into the bandwidth figure, names how many active tests don't fit in the table title (Active Tests 
(3, 2 hidden)), and keeps its header and help hint on short terminals; its footer now lists help first in the client's hint style (?:Help q:Quit, or [?] Help | [q] Quit on wide terminals); both help 
overlays page with PgUp/PgDn and Home/End and show PgDn more in the border when they overflow, and draw their descriptions in the body text colour, aligned in one column past the widest key.
    TUI History reports the UDP loss of each interval — UDP loss: +N packets treated the per-interval loss count as cumulative, so a steady ~700 packets lost per second logged +708 once and then the 
small interval-to-interval differences (+8, +73, ...). Each line now gives the packets newly lost since the previous report, and -u -R runs, whose loss is measured by the client, log it too.
    Update-check overrides stay locked in Settings — builds without the checker, environment opt-outs, --no-update-check, and explicit config values show their reason and cannot overwrite saved 
preferences. A locked row reads dimmed and no longer shows the ◀ ▶ change arrows when selected.
    Bounded Prometheus HTTP connections — request headers have a 5-second total deadline and connections have a 10-second total lifetime, including stalled response writes. HTTP keep-alive is 
disabled; each connection serves one request. At most 64 connections are served at once; further connections wait in the accept backlog. An accept error (e.g. Too many open files during a connection 
flood) no longer stops the metrics server: it is logged and retried after 100 ms. Per-connection errors are logged at debug level instead of being printed to stderr, which corrupted the server TUI.
    --connect-timeout now bounds hostname resolution — the client resolved the target with the blocking system resolver on a runtime thread, so a stuck DNS lookup hung the connect and the timeout 
could never fire; QUIC also resolved outside its connect deadline entirely. Lookups now run on tokio's blocking pool inside the deadline for TCP, UDP and QUIC. Library: xfr::net::resolve_host is now 
async.
    --csv -o FILE saves CSV — the file always received the JSON result, even though --csv -o data.csv is the documented way to save CSV. With --csv the file now holds the same header and summary row 
printed to stdout; every other mode still saves JSON.
    -o destinations are checked before the test starts — -o ro.json, -o somedir/ and -o nodir/x.json failed only after the whole test had run, discarding its result. The client now checks the 
destination before connecting and exits 1 with the save error (Cannot save to nodir/x.json: directory does not exist). The check creates and truncates nothing, and skips devices, FIFOs and pipes such 
as /dev/null and /dev/stdout.
    No terminal no longer breaks the client (LAN-2197) — with stdout piped (xfr <host> | cat) or no controlling terminal (setsid xfr <host> </dev/null) and no --no-tui, the client failed with Error: 
No such device or address (os error 6); with stdout redirected to a file from a terminal, the TUI wrote its escape sequences into the file and hung. The TUI now starts only when stdout and stdin are 
both terminals; otherwise the client prints plain output, as with --no-tui. xfr serve --tui without a terminal likewise runs the plain server and logs a warning that --tui needs a terminal.
    QUIC runs no longer warn about random payloads unless --random is given (LAN-2199) — every -Q run printed Warning: random payloads are ignored with QUIC (payload is already encrypted), because 
random payloads are the default. The warning now appears only with an explicit --random.
    --json-stream and -q are rejected together — -q suppresses interval output, so the combination silently emitted only the final summary line instead of a stream. Use --json for the summary alone.
    UDP streams could lose their traffic to another socket on the same port — every UDP data socket set SO_REUSEADDR, including the ones bound to an ephemeral port. With that option the kernel can 
give a new socket a port another live socket already holds: on Linux, after a few hundred live sockets in one process, and Windows shares ports the same way. The newer socket then receives every 
datagram sent to that port. A server's per-stream UDP socket (on servers that don't support single-port UDP, such as Windows, or with clients that predate it) could count zero packets for an upload, 
or never learn the client's address in a -R or --bidir test. The odds grew with stream count and concurrent tests. Ephemeral UDP sockets no longer set SO_REUSEADDR. Sockets on an explicit port 
(--cport) still set it.

Library API (pre-1.0 break)

    net::resolve_host is now async — callers must .await it. Lookups run on tokio's blocking pool so a surrounding timeout can abandon a stuck resolver.
    Struct-literal constructors must supply new public fields: tui::server::ServerApp.help_scroll, tui::widgets::StreamBar.dim_color (StreamBar::new sets it; StreamBar::dim_color overrides it), and 
protocol::TestResult.zero_byte_streams (serde-optional, so the wire format stays compatible).
    protocol::TestResult.mtu_probe is now Option<Box<probe::MtuProbeReport>> — boxed to keep ControlMessage small; wrap assignments in Box::new. JSON is unchanged.
    net::create_udp_socket* no longer set SO_REUSEADDR on a port-0 bind — create_udp_socket and create_udp_socket_bound set it only for an explicit port, and create_udp_socket_for_remote, which 
always binds port 0, no longer sets it.
    Additive: tui::ui::help_scroll (help-overlay paging for a key press), tui::ui::draw_help_overlay (now public, with scroll and server parameters), update::check_lock_reason, impl Display for 
tui::app::AppState, persistence::check_destination (validates an -o destination without creating or truncating anything), serve::Server::run_until (stops on a caller's shutdown future and closes QUIC 
connections on the way out), and protocol::TestResult::count_zero_byte_streams / describe_zero_byte_streams.


To generate a diff of this commit:
cvs rdiff -u -r1.19 -r1.20 pkgsrc/net/xfr/Makefile \
    pkgsrc/net/xfr/cargo-depends.mk pkgsrc/net/xfr/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/net/xfr/Makefile
diff -u pkgsrc/net/xfr/Makefile:1.19 pkgsrc/net/xfr/Makefile:1.20
--- pkgsrc/net/xfr/Makefile:1.19        Wed Oct 14 08:34:41 2026
+++ pkgsrc/net/xfr/Makefile     Thu Oct 22 13:36:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.19 2026/10/14 08:34:41 pin Exp $
+# $NetBSD: Makefile,v 1.20 2026/10/22 13:36:06 pin Exp $
 
-DISTNAME=      xfr-0.11.0
+DISTNAME=      xfr-0.12.1
 CATEGORIES=    net
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=lance0/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}
Index: pkgsrc/net/xfr/cargo-depends.mk
diff -u pkgsrc/net/xfr/cargo-depends.mk:1.19 pkgsrc/net/xfr/cargo-depends.mk:1.20
--- pkgsrc/net/xfr/cargo-depends.mk:1.19        Wed Oct 14 08:34:41 2026
+++ pkgsrc/net/xfr/cargo-depends.mk     Thu Oct 22 13:36:06 2026
@@ -1,4 +1,4 @@
-# $NetBSD: cargo-depends.mk,v 1.19 2026/10/14 08:34:41 pin Exp $
+# $NetBSD: cargo-depends.mk,v 1.20 2026/10/22 13:36:06 pin Exp $
 
 CARGO_CRATE_DEPENDS+=  adler2-2.0.1
 CARGO_CRATE_DEPENDS+=  aead-0.6.1
@@ -271,12 +271,12 @@ CARGO_CRATE_DEPENDS+=     rustc-hash-2.1.3
 CARGO_CRATE_DEPENDS+=  rustc_version-0.4.1
 CARGO_CRATE_DEPENDS+=  rusticata-macros-4.1.0
 CARGO_CRATE_DEPENDS+=  rustix-1.1.4
-CARGO_CRATE_DEPENDS+=  rustls-0.23.45
+CARGO_CRATE_DEPENDS+=  rustls-0.23.46
 CARGO_CRATE_DEPENDS+=  rustls-native-certs-0.8.4
 CARGO_CRATE_DEPENDS+=  rustls-pki-types-1.15.1
 CARGO_CRATE_DEPENDS+=  rustls-platform-verifier-0.7.0
 CARGO_CRATE_DEPENDS+=  rustls-platform-verifier-android-0.1.1
-CARGO_CRATE_DEPENDS+=  rustls-webpki-0.103.15
+CARGO_CRATE_DEPENDS+=  rustls-webpki-0.103.16
 CARGO_CRATE_DEPENDS+=  rustversion-1.0.23
 CARGO_CRATE_DEPENDS+=  ryu-1.0.23
 CARGO_CRATE_DEPENDS+=  same-file-1.0.6
@@ -384,8 +384,8 @@ CARGO_CRATE_DEPENDS+=       wasm-bindgen-macro
 CARGO_CRATE_DEPENDS+=  wasm-bindgen-shared-0.2.127
 CARGO_CRATE_DEPENDS+=  web-sys-0.3.104
 CARGO_CRATE_DEPENDS+=  web-time-1.1.0
-CARGO_CRATE_DEPENDS+=  webpki-root-certs-1.0.9
-CARGO_CRATE_DEPENDS+=  webpki-roots-1.0.9
+CARGO_CRATE_DEPENDS+=  webpki-root-certs-1.0.10
+CARGO_CRATE_DEPENDS+=  webpki-roots-1.0.10
 CARGO_CRATE_DEPENDS+=  wezterm-bidi-0.2.3
 CARGO_CRATE_DEPENDS+=  wezterm-blob-leases-0.1.1
 CARGO_CRATE_DEPENDS+=  wezterm-color-types-0.3.0
Index: pkgsrc/net/xfr/distinfo
diff -u pkgsrc/net/xfr/distinfo:1.19 pkgsrc/net/xfr/distinfo:1.20
--- pkgsrc/net/xfr/distinfo:1.19        Wed Oct 14 08:34:41 2026
+++ pkgsrc/net/xfr/distinfo     Thu Oct 22 13:36:06 2026
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.19 2026/10/14 08:34:41 pin Exp $
+$NetBSD: distinfo,v 1.20 2026/10/22 13:36:06 pin Exp $
 
 BLAKE2s (adler2-2.0.1.crate) = 4d391e0fcde91c7435ee9a5503fee4a5346f549f1b45e482ce3e1e151d90f8f5
 SHA512 (adler2-2.0.1.crate) = 555b2b7ba6f8116acccd0bcd16ed34cc78162c81023cff31a8566ffcd456c03832089fca2d5b668ceaac4fe8f922d31aa9c487f226a36cace294ff4a219bd91d
@@ -813,9 +813,9 @@ Size (rusticata-macros-4.1.0.crate) = 11
 BLAKE2s (rustix-1.1.4.crate) = 47b462406ba74a3225cf16b2e8b75855857edd58915f4033d7387b67cc694948
 SHA512 (rustix-1.1.4.crate) = 33619ed2434963a98b0846414656bcc4945ca0e9b883821869fe0cc86db4a74c6961ce1375963ae49c6b5044ad0536eda807dac1320209739c9d669bd80fd75c
 Size (rustix-1.1.4.crate) = 425241 bytes
-BLAKE2s (rustls-0.23.45.crate) = 80611a082d6f595e031a9d0cc5dbec9a2c0ff47b46fd693b473e9fb29d0dd557
-SHA512 (rustls-0.23.45.crate) = d129106d690b620090c58c34ab9216e4ad697e5343865886411731e77a746eafb524770072653f16b4489f66696d366fc7b84cbdb5b65951c5f4f14832449389
-Size (rustls-0.23.45.crate) = 378933 bytes
+BLAKE2s (rustls-0.23.46.crate) = ac5b2e618ea78a918da8f78cf635dbb97187ac0cbd552f179b58936f56f07d97
+SHA512 (rustls-0.23.46.crate) = 9697677cce4999211bcf2e5c05c3dc468eba1947f586d2402a06cfb75663242fe0a1c2c8cd67f41d29fadc4892b7fcb47dc5db50b57a05cd72e74e1fc6f409d2
+Size (rustls-0.23.46.crate) = 386227 bytes
 BLAKE2s (rustls-native-certs-0.8.4.crate) = 7db0dcfed2ff37ec592eb2a7921a52cafa8cf4cb67bc64e6dbb9f173157888e0
 SHA512 (rustls-native-certs-0.8.4.crate) = 6a0633bb7c8e937a0c161d8d4bde955a7af141c6e7df42d00199236eb8baf1b69af9624de570769a16c60fb94604cec4ade9020992ac38a8d3da1662d56107c6
 Size (rustls-native-certs-0.8.4.crate) = 22129 bytes
@@ -828,9 +828,9 @@ Size (rustls-platform-verifier-0.7.0.cra
 BLAKE2s (rustls-platform-verifier-android-0.1.1.crate) = c8d0240ebc3809d2fbfd7805badb53674ced7d89a17a1cd06880a158d2227cb6
 SHA512 (rustls-platform-verifier-android-0.1.1.crate) = f3f21b88b448f46e08da4303d225f10765d21f2397d4fbe44d5f9cf9da5ced84fa5adc5881f1db66a324cef818537e4a79bad2260b8027894029ba7e6ec16533
 Size (rustls-platform-verifier-android-0.1.1.crate) = 13919 bytes
-BLAKE2s (rustls-webpki-0.103.15.crate) = 7798c89cd466bfc2dcef2c2c7be614ae77cbb76e2772a9890bb5ecc1d1dd3185
-SHA512 (rustls-webpki-0.103.15.crate) = adeb7c379e9b691e044d497768959bab9c8f291c21f93e9f5373ab0639e9070258945e2bd0be4e8eb8fca98c3824e942033d6430d15134f8fe8ff3a1c4d98382
-Size (rustls-webpki-0.103.15.crate) = 87465 bytes
+BLAKE2s (rustls-webpki-0.103.16.crate) = 752cd6f7b2ea420c76d7891a38783c33fdb77471ea4286f27ce3fb0a78ab8087
+SHA512 (rustls-webpki-0.103.16.crate) = eee403a2e2a57b598ad01662995db2bd2fe79d2405e3e3ff98442fa37e6ff8f8a267a46476303fe74691c3399d618c41cc8ffa733ddebe4d8759fd466fc7ce6a
+Size (rustls-webpki-0.103.16.crate) = 89984 bytes
 BLAKE2s (rustversion-1.0.23.crate) = 34b032c76b54216071144f3bad4e20da1bbee1cd59abbd3e5c33d3513e2a88dc
 SHA512 (rustversion-1.0.23.crate) = 95baec2c1d8475661677ea35a724c392ed10b1151a1f4522b44133c6d691824bf4a42327ebc9d631a1f64f944dc721843e0aa0e19354fc4fab89aa048f1c68f5
 Size (rustversion-1.0.23.crate) = 21013 bytes
@@ -1152,12 +1152,12 @@ Size (web-sys-0.3.104.crate) = 682013 by
 BLAKE2s (web-time-1.1.0.crate) = 9c36644abce7ba1ddc0bdc98622e1ef801daa6ae7f862e033f2c446162686892
 SHA512 (web-time-1.1.0.crate) = 73e4ef9851de089fde9381a595cb9e37a434f563f1fd350e345f2617b701caf57a9aef739b922b5b10cda131cdf2fd0af42c55603f8973a623a8b6ae70f6cc9f
 Size (web-time-1.1.0.crate) = 18026 bytes
-BLAKE2s (webpki-root-certs-1.0.9.crate) = c0ddf22eebb506dd898ead38b077e26df58c5541a860269a9c9ce54c946d15b9
-SHA512 (webpki-root-certs-1.0.9.crate) = 77a64cc129bae28d2d274d8c0240eea5c2824cc12a3ebcda890b7f43e2d159fd52f7bb294075c471963397221fb27ee4d8777d283f42440c98eabfc042c5d110
-Size (webpki-root-certs-1.0.9.crate) = 149167 bytes
-BLAKE2s (webpki-roots-1.0.9.crate) = 8d3fbefa7ee83729f8c00bafad8c1fe9c305c8170cc46643509f0f4c792f3bf7
-SHA512 (webpki-roots-1.0.9.crate) = 4e518fb376704cee9f9691d3abf23bd19d181c018063996d6d83bcb5c05ab80967ee995a5a21eccac4b1765a6f7f7005f9f584d66029c3d17284f7156af48d0f
-Size (webpki-roots-1.0.9.crate) = 217462 bytes
+BLAKE2s (webpki-root-certs-1.0.10.crate) = f7c9b7bd8a6b6e9b0272fee95c90bd85495783481c2af035d8f4e1f905d20720
+SHA512 (webpki-root-certs-1.0.10.crate) = b861defc7c1dab088e4fabc1fbe7f1db5c3e9e28c4b8fdd92e1635dbd2ceaa2ba397bafff984792317fba39802827c80c33b408726f79985382721fd01e16135
+Size (webpki-root-certs-1.0.10.crate) = 148663 bytes
+BLAKE2s (webpki-roots-1.0.10.crate) = f337149f2878c45343438984d80bf67eab56ac8c9fca7af3ca3c138b65d0791d
+SHA512 (webpki-roots-1.0.10.crate) = aee28de146157169c036ef180bf83529303f83f90998021932f830334190cadc46afd53a9d91dba1520fb05152ac1146fce650ed164ea1138768cd7d286b4882
+Size (webpki-roots-1.0.10.crate) = 216631 bytes
 BLAKE2s (wezterm-bidi-0.2.3.crate) = 21cb5448b48f1368a3eed911fe3eb827ee237c32592d567aa61f613aadb6f9d9
 SHA512 (wezterm-bidi-0.2.3.crate) = 37950db06980a60ce7a5cf2a2ac55aafb3d16d02b650dbb938f28d60217f4c51e1fbfe21d53898078336f68538e97f8a061e7b6c7eb238427651ff8673d6c45f
 Size (wezterm-bidi-0.2.3.crate) = 73214 bytes
@@ -1254,9 +1254,9 @@ Size (writeable-0.6.4.crate) = 31222 byt
 BLAKE2s (x509-parser-0.18.1.crate) = a5f2838a9880a6e075ead6b25c4078314403bbd5f9d59df631663b87ee4edee4
 SHA512 (x509-parser-0.18.1.crate) = a30af92885d157b837832b7a3242fc8dbe5eacbce97ce5cb92a8c5e948324ec38150ca709734eb191a914f4f34d4d521ba313b72a57541a62cb254e8808535ef
 Size (x509-parser-0.18.1.crate) = 102625 bytes
-BLAKE2s (xfr-0.11.0.tar.gz) = 7c80f6cdcc46257baa6b0c31572bdb62ff9b7fa76b4a45c4f15f5550e6dabcfe
-SHA512 (xfr-0.11.0.tar.gz) = 82717e05b291431f80cd8fa8894199c5bef3068a0c5f2c56706a38a8de3b1d4b15c70f30c02a4f4fbe23366a4b42e8a13c47b2c70114014c83ba9bfe26f3d0a9
-Size (xfr-0.11.0.tar.gz) = 2853381 bytes
+BLAKE2s (xfr-0.12.1.tar.gz) = 0384dcf47a13150e73f4da4bb1fcceebfd176ff6c5d59d32c5505ec61c58f4a3
+SHA512 (xfr-0.12.1.tar.gz) = ee7271f3f935fe7d20d1d7ee0adcc7888d307814e0dae260de7622d99145eea153873571455ca48aed0152f0797041ca2629ede2f9927b850783a0131fc18488
+Size (xfr-0.12.1.tar.gz) = 2562366 bytes
 BLAKE2s (yasna-0.6.0.crate) = 591c8e37bd6f6a71763c470031399e5b09b787a541994f5fc78b95a226aba11a
 SHA512 (yasna-0.6.0.crate) = 63aa1399a2f24d60981612dde74ebaf4868caff4cac4e06117985925efdb7e06411630a86dcf0731f36d97c7131343113b56f3a104db8f2a2f80be72c0a40ef9
 Size (yasna-0.6.0.crate) = 40598 bytes