From 19035388e841f4a4d4eb4ae122ddaa6968bac701 Mon Sep 17 00:00:00 2001
From: "dobby-yivi-agent[bot]"
 <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 07:52:57 +0000
Subject: [PATCH 1/2] chore: remove unused irma dependency

The `irma` crate was declared in Cargo.toml but never imported anywhere in
the crate. Attributes reach cryptify already signed inside the
PostGuard-sealed file and are read back through pg-core's Unsealer, so
there is no IRMA client here to migrate.

`irma` stays in Cargo.lock as a transitive dependency of pg-core.

Closes #194

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CLAUDE.md  | 9 +++++++++
 Cargo.lock | 1 -
 Cargo.toml | 1 -
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 44cde76..7fb74d4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -41,6 +41,15 @@ Release-plz automation.
   running". Use `#[rocket::async_test]` and `async fn`, even when the body never
   awaits.
 
+## Dependencies
+- cryptify has no IRMA/Yivi client of its own. Attributes arrive already signed
+  inside the PostGuard-sealed file and are read back through `pg-core`'s Unsealer,
+  so nothing here talks to a Yivi session server.
+- `pg-core` depends on the `irma` crate, so `irma` stays in `Cargo.lock` as a
+  transitive dep even though cryptify does not declare it. A dependency audit that
+  reads the lockfile will still see it; check `Cargo.toml` to tell direct from
+  transitive.
+
 ## Running the binary
 - Needs a reachable PKG server (`pkg_url`) at startup or it panics on
   `/v2/sign/parameters`. For config tests, prefer a serde-roundtrip unit test over
diff --git a/Cargo.lock b/Cargo.lock
index f126748..bd2e377 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -454,7 +454,6 @@ dependencies = [
  "askama",
  "chrono",
  "futures",
- "irma",
  "lettre",
  "log",
  "minreq",
diff --git a/Cargo.toml b/Cargo.toml
index 5979c96..8eadaab 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,6 @@ description = "End-to-end encrypted file sharing service"
 [dependencies]
 askama = "0.16.0"
 chrono = { version = "0.4.45", features = ["unstable-locales"] }
-irma = "0.2.1"
 lettre = "0.11.22"
 log = "0.4.33"
 rand = "0.10.1"

From 57de8c5f71ba95d14510ca35130f51df7eb2e925 Mon Sep 17 00:00:00 2001
From: "dobby-yivi-agent[bot]"
 <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>
Date: Mon, 27 Jul 2026 08:08:13 +0000
Subject: [PATCH 2/2] docs: say irma is still compiled in via pg-core, not just
 in the lockfile

`cargo tree -i irma` shows irma 0.2.1 on the normal dependency edge under
pg-core, so it is built into the binary, not lockfile residue. It also brings
reqwest 0.11.27 alongside cryptify's own reqwest 0.13.4. The old wording could
lead the postguard-e2e knownDrift follow-up to record the pair as resolved.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 CLAUDE.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 7fb74d4..c1e4fef 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -45,10 +45,11 @@ Release-plz automation.
 - cryptify has no IRMA/Yivi client of its own. Attributes arrive already signed
   inside the PostGuard-sealed file and are read back through `pg-core`'s Unsealer,
   so nothing here talks to a Yivi session server.
-- `pg-core` depends on the `irma` crate, so `irma` stays in `Cargo.lock` as a
-  transitive dep even though cryptify does not declare it. A dependency audit that
-  reads the lockfile will still see it; check `Cargo.toml` to tell direct from
-  transitive.
+- `pg-core` depends on the `irma` crate, so `irma` 0.2.1 is still compiled into the
+  binary even though cryptify does not declare it (`cargo tree -i irma`). It drags
+  in `reqwest` 0.11.27 too, alongside cryptify's own `reqwest` 0.13.4. Dropping the
+  direct declaration does not take `irma` out of the build; check `Cargo.toml` to
+  tell direct from transitive.
 
 ## Running the binary
 - Needs a reachable PKG server (`pkg_url`) at startup or it panics on