Probably fix release.yml

The users crate (RUSTSEC-2025-0040) has an unfixable vulnerability.
Replace it with the maintained whoami crate for getting the current
username. Also remove metrics.yml workflow as it provided no value.

.github/workflows/metrics.yml

@@ -1,69 +0,0 @@
-name: Metrics Collection
-
-on:
-  schedule:
-    - cron: '0 0 * * 1'  # Weekly on Monday at midnight
-  workflow_dispatch:
-  push:
-    branches: [main, master]
-    paths:
-      - 'src/**'
-      - 'Cargo.toml'
-      - '.github/workflows/metrics.yml'
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  collect-metrics:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: Swatinem/rust-cache@v2
-      
-      - uses: ./.github/actions/deps
-      
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-      
-
-      
-      - name: Generate test coverage
-        run: |
-          cargo install cargo-tarpaulin
-          cargo tarpaulin --out Html --out Lcov --output-dir ./coverage
-      
-      - name: Upload coverage report
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-report
-          path: ./coverage
-          retention-days: 30
-      
-      - name: Count lines of code
-        run: |
-          cargo install tokei
-          tokei --output json > loc.json
-          echo "Lines of code:"
-          tokei --types=Rust
-      
-      - name: Upload LOC metrics
-        uses: actions/upload-artifact@v4
-        with:
-          name: loc-metrics
-          path: loc.json
-          retention-days: 30
-      
-      - name: Generate dependency graph
-        run: |
-          cargo install cargo-depgraph
-          cargo depgraph --all-features --dedup-transitive --format dot > deps.dot
-          echo "Dependency graph generated: deps.dot"
-          echo "Total dependencies: $(cargo tree --depth 0 | wc -l)"
-      
-      - name: Upload dependency graph
-        uses: actions/upload-artifact@v4
-        with:
-          name: dependency-graph
-          path: deps.dot
-          retention-days: 30

.github/workflows/release.yml

@@ -94,25 +94,20 @@ jobs:
         with:
           path: artifacts
 
-      - name: List artifacts
-        run: ls -la artifacts/
-
       - name: Determine tag
         id: tag
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ github.ref_name }}
           name: RustLock v${{ steps.tag.outputs.VERSION }}
           draft: true
           prerelease: ${{ contains(github.ref_name, 'alpha') || contains(github.ref_name, 'beta') }}
           files: |
-            artifacts/rustlock-default-ubuntu/rustlock
-            artifacts/rustlock-no-networking-ubuntu/rustlock
-            artifacts/rustlock-default-debian/rustlock
-            artifacts/rustlock-default-fedora/rustlock
-            artifacts/rustlock-default-arch/rustlock
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+            artifacts/rustlock-default-ubuntu/rustlock/rustlock:rustlock-default-ubuntu
+            artifacts/rustlock-no-networking-ubuntu/rustlock/rustlock:rustlock-no-networking-ubuntu
+            artifacts/rustlock-default-debian/rustlock/rustlock:rustlock-default-debian
+            artifacts/rustlock-default-fedora/rustlock/rustlock:rustlock-default-fedora
+            artifacts/rustlock-default-arch/rustlock/rustlock:rustlock-default-arch

Cargo.lock

@@ -1571,6 +1571,18 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "libredox"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
+dependencies = [
+ "bitflags 2.11.0",
+ "libc",
+ "plain",
+ "redox_syscall",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.3.8"
@@ -1861,6 +1873,12 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "png"
 version = "0.18.1"
@@ -2041,6 +2059,15 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
+dependencies = [
+ "bitflags 2.11.0",
+]
+
 [[package]]
 name = "regex"
 version = "1.12.3"
@@ -2213,10 +2240,10 @@ dependencies = [
  "tokio",
  "toml 1.0.6+spec-1.1.0",
  "upower_dbus",
- "users",
  "wayland-client",
  "wayland-protocols",
  "wayland-protocols-wlr",
+ "whoami",
  "xkbcommon",
  "zbus",
  "zeroize",
@@ -2874,16 +2901,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "users"
-version = "0.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
-dependencies = [
- "libc",
- "log",
-]
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -2947,6 +2964,12 @@ dependencies = [
  "wit-bindgen",
 ]
 
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.114"
@@ -3148,6 +3171,17 @@ version = "0.25.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
 
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+ "web-sys",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"

Cargo.toml

@@ -21,7 +21,7 @@ zeroize = "1.7"
 log = "0.4"
 env_logger = { version = "0.11", default-features = false, features = ["color", "humantime"] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
-users = "0.11"
+whoami = "1.0"
 zbus = { version = "3.15", default-features = false, features = ["tokio"] }
 mpris = "2.0"
 upower_dbus = "0.3"

deny.toml

@@ -1,70 +1,10 @@
-# Cargo-deny configuration for RustLock
-# See: https://embarkstudios.github.io/cargo-deny/
-
 [advisories]
-# Check for security vulnerabilities
 vulnerability = "deny"
-# Check for unmaintained crates
-unmaintained = "warn"
-# Check for unsound crates
-unsound = "deny"
-# Check for yanked crates
-yanked = "deny"
-# Ignore specific advisories
-ignore = [
-    # Add specific advisory IDs to ignore here if needed
-]
-
-# Sources for advisory database
-[advisories.db]
-# Use GitHub advisory database
-github-data = "https://github.com/rustsec/advisory-db"
-# Update frequency (daily)
-update-frequency = "daily"
+ignore = []
 
 [bans]
-# Multiple versions of the same crate
 multiple-versions = "allow"
-# Wildcard dependencies (e.g., "1.*")
-wildcards = "deny"
-
-# Skip specific crates from checks
-skip = [
-    # Add crate names to skip here if needed
-]
-
-[licenses]
-# Default license policy
-default = "deny"
-# Allow these licenses
-allow = [
-    "MIT",
-    "Apache-2.0",
-    "BSD-2-Clause",
-    "BSD-3-Clause",
-    "ISC",
-    "Zlib",
-    "Unlicense",
-    "CC0-1.0",
-    "MPL-2.0",
-    "AGPL-3.0-or-later",  # Our own license
-]
-# Copyleft licenses that require special attention
-copyleft = "warn"
-# Unknown licenses
-unlicensed = "deny"
-
-# Skip specific crates from license checks
-skip = [
-    # Add crate names to skip here if needed
-]
 
 [sources]
-# Allow only these registries
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-# Deny git repositories (except for specific cases)
 allow-git = []
-
-[metadata]
-# Minimum severity level to display
-severity-threshold = "low"

src/auth.rs

@@ -4,7 +4,7 @@ use std::thread;
 use log::{debug, error};
 use pam_client::{Context, ErrorCode, Flag};
 use smithay_client_toolkit::reexports::{calloop::channel, calloop::EventLoop};
-use users::get_current_username;
+use whoami::username;
 use zeroize::Zeroizing;
 
 const SERVICE_NAME: &str = "rustlock";
@@ -37,11 +37,7 @@ impl pam_client::ConversationHandler for LockConversation {
 
 pub fn create_and_run_auth_loop(
 ) -> Option<(channel::Sender<Zeroizing<String>>, channel::Channel<bool>)> {
-    let username = get_current_username()
-        .expect("Failed to get username")
-        .to_str()
-        .expect("Failed to get non-unicode username")
-        .to_string();
+    let username = username();
 
     let conversation = LockConversation { password: None };
     match Context::new(SERVICE_NAME, Some(username.as_str()), conversation) {

src/render.rs

@@ -499,33 +499,32 @@ impl Renderer {
             let art_size = 56.0;
             let spacing = 80.0;
 
-            if self.config.show_album_art
-                && self.system_status.media_art_url != self.last_art_url {
-                    self.last_art_url = self.system_status.media_art_url.clone();
-                    self.media_art_surface = None;
-                    if let Some(ref data) = self.system_status.media_art_data {
-                        if let Ok(img) = image::load_from_memory(data) {
-                            let img = img.to_rgba8();
-                            let (w, h) = img.dimensions();
-                            let mut surface =
-                                ImageSurface::create(Format::ARgb32, w as i32, h as i32).unwrap();
-                            {
-                                let mut surface_data = surface.data().unwrap();
-                                for y in 0..h {
-                                    for x in 0..w {
-                                        let pixel = img.get_pixel(x, y);
-                                        let idx = ((y * w + x) * 4) as usize;
-                                        surface_data[idx] = pixel[2];
-                                        surface_data[idx + 1] = pixel[1];
-                                        surface_data[idx + 2] = pixel[0];
-                                        surface_data[idx + 3] = pixel[3];
-                                    }
+            if self.config.show_album_art && self.system_status.media_art_url != self.last_art_url {
+                self.last_art_url = self.system_status.media_art_url.clone();
+                self.media_art_surface = None;
+                if let Some(ref data) = self.system_status.media_art_data {
+                    if let Ok(img) = image::load_from_memory(data) {
+                        let img = img.to_rgba8();
+                        let (w, h) = img.dimensions();
+                        let mut surface =
+                            ImageSurface::create(Format::ARgb32, w as i32, h as i32).unwrap();
+                        {
+                            let mut surface_data = surface.data().unwrap();
+                            for y in 0..h {
+                                for x in 0..w {
+                                    let pixel = img.get_pixel(x, y);
+                                    let idx = ((y * w + x) * 4) as usize;
+                                    surface_data[idx] = pixel[2];
+                                    surface_data[idx + 1] = pixel[1];
+                                    surface_data[idx + 2] = pixel[0];
+                                    surface_data[idx + 3] = pixel[3];
                                 }
                             }
-                            self.media_art_surface = Some(surface);
                         }
+                        self.media_art_surface = Some(surface);
                     }
                 }
+            }
 
             let has_art = self.config.show_album_art && self.media_art_surface.is_some();
             let text_x = if has_art {