Yubikey-only build fails to compile and still pulls in the full HTTP(S)/SFTP stack #35

The yubikey and file compile-time features exist in all three workspace manifests, but they do not currently work as intended. This follows on from the TODO in #24.

Problem 1: the build does not compile

$ cargo build --no-default-features --features yubikey

error[E0004]: non-exhaustive patterns: `&TwoFactorMode::File { .. }` not covered
   --> shavee-bin/src/main.rs:96:15

error[E0004]: non-exhaustive patterns: `TwoFactorMode::File { .. }` not covered
   --> shavee-bin/src/main.rs:259:28

error: could not compile `shavee` (bin "shavee") due to 2 previous errors

Root cause: shavee-bin and shavee-pam declare file = [] and yubikey = [] as empty stubs that never forward to shavee_core. Disabling file on the binary switches off its #[cfg(feature = "file")] match arms, but shavee_core still builds with its own defaults, so TwoFactorMode::File still exists in the enum. The match is then non-exhaustive.

Problem 2: curl is not actually gated

curl is an unconditional dependency of shavee_core:

# shavee-core/Cargo.toml:23
curl = "0.4"

It is not tied to the file feature, so disabling file does not remove it. cargo tree shows an identical dependency graph with and without the feature.

The HTTP(S)/SFTP stack is therefore compiled into every build, including one that explicitly asks for Yubikey support only.

Why this matters

The project description and README both lead with Yubikey as the primary method, and that is what many users install shavee for. Those users currently cannot build without the network retrieval code, which is the audit-surface concern originally raised in #24.

Proposed fix

1. Make curl optional in shavee-core and bind it to the feature: file = ["dep:curl"]
2. Forward features from shavee-bin and shavee-pam to shavee_core, with default-features = false
3. Gate the filehash module, the Error::Curl variant, its Display arm and From<curl::Error> on the file feature
4. Gate the per-property match arms in zfs.rs

Default features would remain unchanged, so existing build behavior is unaffected.

Result of the fix

With file disabled, the following are no longer built: curl, curl-sys, openssl-sys, openssl-probe, libz-sys, socket2, cc and schannel.

For clarity, this does not remove every Windows-related crate. The windows-sys / windows-targets family is pulled independently by clap and tokio, and remains after this change.

Suggested follow-up: CI

A cargo check --no-default-features --features yubikey job would prevent this from regressing. It needs no ZFS pool, no hardware and no Yubikey since it is a compile-only check, so it runs on any standard runner. There is currently no .github directory in the repo.

I might propose this separately later.

Verification

See changes on my branch:

https://github.com/cmosetick/shavee/tree/feat/gate-curl-behind-file-feature

Locally verified: shavee_core, shavee and shavee_pam all build under default, yubikey-only and file-only feature sets, and the full workspace test suite passes (24 tests).

Refs #24