From ee4c10729e57ca7db15cdee156fe25c3eec50d44 Mon Sep 17 00:00:00 2001
From: nevaforget <>
Date: Tue, 31 Mar 2026 11:08:43 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20audit=20fixes=20=E2=80=94=20release=20pr?=
 =?UTF-8?q?ofile,=20GResource=20compression,=20lock=20stderr,=20sync=20mar?=
 =?UTF-8?q?kers=20(v0.8.1)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add [profile.release] with LTO, codegen-units=1, strip
- Add compressed="true" to GResource CSS/SVG entries
- Inherit moonlock stderr instead of /dev/null (errors visible in journal)
- Add SYNC comments to duplicated blur/background functions
---
 Cargo.toml                        | 7 ++++++-
 DECISIONS.md                      | 7 +++++++
 resources/resources.gresource.xml | 4 ++--
 src/panel.rs                      | 4 ++++
 src/power.rs                      | 2 +-
 5 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index c4ba407..be1204d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "moonset"
-version = "0.8.0"
+version = "0.8.1"
 edition = "2024"
 description = "Wayland session power menu with GTK4 and Layer Shell"
 license = "MIT"
@@ -22,5 +22,10 @@ systemd-journal-logger = "2.2"
 [dev-dependencies]
 tempfile = "3"
 
+[profile.release]
+lto = "thin"
+codegen-units = 1
+strip = true
+
 [build-dependencies]
 glib-build-tools = "0.22"
diff --git a/DECISIONS.md b/DECISIONS.md
index d243630..5a6f762 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -2,6 +2,13 @@
 
 Architectural and design decisions for Moonset, in reverse chronological order.
 
+## 2026-03-31 – Fourth audit: release profile, GResource compression, lock stderr, sync markers
+
+- **Who**: Ragnar, Dom
+- **Why**: Fourth triple audit found missing release profile (LTO/strip), uncompressed GResource assets, moonlock stderr suppressed (errors invisible), and duplicated code without sync markers.
+- **Tradeoffs**: moonlock stderr now inherited instead of null — errors appear in moonset's journal context. Acceptable for debugging, no security leak since moonlock logs to its own journal identifier.
+- **How**: (1) `[profile.release]` with LTO, codegen-units=1, strip. (2) `compressed="true"` on GResource entries. (3) `Stdio::inherit()` for moonlock stderr in lock(). (4) SYNC comments on duplicated blur/background functions.
+
 ## 2026-03-28 – Remove wallpaper from GResource bundle
 
 - **Who**: Ragnar, Dom
diff --git a/resources/resources.gresource.xml b/resources/resources.gresource.xml
index 89b362c..5562d3b 100644
--- a/resources/resources.gresource.xml
+++ b/resources/resources.gresource.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <gresources>
   <gresource prefix="/dev/moonarch/moonset">
-    <file>style.css</file>
-    <file>default-avatar.svg</file>
+    <file compressed="true">style.css</file>
+    <file compressed="true">default-avatar.svg</file>
   </gresource>
 </gresources>
diff --git a/src/panel.rs b/src/panel.rs
index 0f108c2..e8956d4 100644
--- a/src/panel.rs
+++ b/src/panel.rs
@@ -103,6 +103,10 @@ pub fn load_background_texture(bg_path: Option<&Path>) -> Option<gdk::Texture> {
 
 // -- GPU blur via GskBlurNode -------------------------------------------------
 
+// SYNC: MAX_BLUR_DIMENSION, render_blurred_texture, and create_background_picture
+// are duplicated in moonlock/src/lockscreen.rs and moongreet/src/greeter.rs.
+// Changes here must be mirrored to the other two projects.
+
 /// Maximum texture dimension before downscaling for blur.
 /// Keeps GPU work reasonable on 4K+ displays.
 const MAX_BLUR_DIMENSION: f32 = 1920.0;
diff --git a/src/power.rs b/src/power.rs
index fc24116..06732bb 100644
--- a/src/power.rs
+++ b/src/power.rs
@@ -107,7 +107,7 @@ pub fn lock() -> Result<(), PowerError> {
     Command::new("/usr/bin/moonlock")
         .stdin(Stdio::null())
         .stdout(Stdio::null())
-        .stderr(Stdio::null())
+        .stderr(Stdio::inherit())
         .spawn()
         .map_err(|e| PowerError::CommandFailed {
             action: "lock",