fix: replace vulnerable users crate with whoami

The users crate (RUSTSEC-2025-0040) has an unfixable vulnerability.
Replace it with the maintained whoami crate for getting the current
username. Also remove metrics.yml workflow as it provided no value.

.github/workflows/metrics.yml

@@ -1,69 +0,0 @@
-name: Metrics Collection
-
-on:
-  schedule:
-    - cron: '0 0 * * 1'  # Weekly on Monday at midnight
-  workflow_dispatch:
-  push:
-    branches: [main, master]
-    paths:
-      - 'src/**'
-      - 'Cargo.toml'
-      - '.github/workflows/metrics.yml'
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  collect-metrics:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
-      
-      - uses: ./.github/actions/deps
-      
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-      
-
-      
-      - name: Generate test coverage
-        run: |
-          cargo install cargo-tarpaulin
-          cargo tarpaulin --out Html --out Lcov --output-dir ./coverage
-      
-      - name: Upload coverage report
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-report
-          path: ./coverage
-          retention-days: 30
-      
-      - name: Count lines of code
-        run: |
-          cargo install tokei
-          tokei --output json > loc.json
-          echo "Lines of code:"
-          tokei --types=Rust
-      
-      - name: Upload LOC metrics
-        uses: actions/upload-artifact@v4
-        with:
-          name: loc-metrics
-          path: loc.json
-          retention-days: 30
-      
-      - name: Generate dependency graph
-        run: |
-          cargo install cargo-depgraph
-          cargo depgraph --all-features --dedup-transitive-deps --format dot > deps.dot
-          echo "Dependency graph generated: deps.dot"
-          echo "Total dependencies: $(cargo tree --depth 0 | wc -l)"
-      
-      - name: Upload dependency graph
-        uses: actions/upload-artifact@v4
-        with:
-          name: dependency-graph
-          path: deps.dot
-          retention-days: 30

Cargo.lock

@@ -1571,6 +1571,18 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "libredox"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+dependencies = [
+ "bitflags 2.11.0",
+ "libc",
+ "plain",
+ "redox_syscall",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.8"
@@ -1861,6 +1873,12 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -2041,6 +2059,15 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.3"
@@ -2213,10 +2240,10 @@ dependencies = [
  "tokio",
  "toml 1.0.6+spec-1.1.0",
  "upower_dbus",
- "users",
  "wayland-client",
  "wayland-protocols",
  "wayland-protocols-wlr",
+ "whoami",
  "xkbcommon",
  "zbus",
  "zeroize",
@@ -2874,16 +2901,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "users"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
-dependencies = [
- "libc",
- "log",
-]
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -2947,6 +2964,12 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.114"
@@ -3148,6 +3171,17 @@ version = "0.25.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+ "web-sys",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"

Cargo.toml

@@ -21,7 +21,7 @@ zeroize = "1.7"
 log = "0.4"
 env_logger = { version = "0.11", default-features = false, features = ["color", "humantime"] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
-users = "0.11"
+whoami = "1.0"
 zbus = { version = "3.15", default-features = false, features = ["tokio"] }
 mpris = "2.0"
 upower_dbus = "0.3"

src/auth.rs

@@ -4,7 +4,7 @@ use std::thread;
 use log::{debug, error};
 use pam_client::{Context, ErrorCode, Flag};
 use smithay_client_toolkit::reexports::{calloop::channel, calloop::EventLoop};
-use users::get_current_username;
+use whoami::username;
 use zeroize::Zeroizing;
 
 const SERVICE_NAME: &str = "rustlock";
@@ -37,11 +37,7 @@ impl pam_client::ConversationHandler for LockConversation {
 
 pub fn create_and_run_auth_loop(
 ) -> Option<(channel::Sender<Zeroizing<String>>, channel::Channel<bool>)> {
-    let username = get_current_username()
+    let username = username();
-        .expect("Failed to get username")
-        .to_str()
-        .expect("Failed to get non-unicode username")
-        .to_string();
 
     let conversation = LockConversation { password: None };
     match Context::new(SERVICE_NAME, Some(username.as_str()), conversation) {