host_env: keep rustls off the rustls-free ssl surface (#8727)

* host_env: keep rustls off the rustls-free ssl surface

ssl is MemoryBIO, constants, OID, and ALPN. ssl-rustls is
the rustls engine. Drop the wasm32 rustls-pki-types web
dep; the browser crate already enables that feature.

Assisted-by: Claude

* host_env: drop rustls-pki-types from the lockfile

Assisted-by: Claude

* host_env: name the rustls engine feature rustls

ssl is the rustls-free surface. rustls is the engine.
stdlib's ssl-rustls product feature still selects this.

Assisted-by: Claude

Cargo.lock

@@ -3876,7 +3876,6 @@ dependencies = [
  "rustls",
  "rustls-native-certs",
  "rustls-pemfile",
- "rustls-pki-types",
  "rustls-webpki 0.103.13",
  "rustpython-wtf8",
  "rustyline",

crates/host_env/Cargo.toml

@@ -10,7 +10,20 @@ license.workspace = true
 
 [features]
 native-certs = ["dep:rustls-native-certs"]
-ssl = ["dep:rustls", "dep:rustls-pemfile", "dep:rustls-webpki", "dep:x509-parser", "dep:der", "dep:pkcs8", "dep:sha2"]
+# rustls-free `_ssl` surface: MemoryBIO, constants, OID, ALPN, hostname.
+ssl = []
+# rustls engine. Implies `ssl`. Browser wasm enables this together with
+# rustls-pki-types `web` on that crate; wasm-host enables `ssl` only.
+rustls = [
+    "ssl",
+    "dep:rustls",
+    "dep:rustls-pemfile",
+    "dep:rustls-webpki",
+    "dep:x509-parser",
+    "dep:der",
+    "dep:pkcs8",
+    "dep:sha2",
+]
 
 [dependencies]
 rustpython-wtf8 = { workspace = true }
@@ -39,11 +52,6 @@ rustix = { workspace = true }
 [target.'cfg(any(not(target_arch = "wasm32"), target_os = "wasi"))'.dependencies]
 num_cpus = "1.17.0"
 
-# rustls-pki-types::UnixTime::now is gated off wasm32-unknown-unknown unless
-# the `web` feature is on. Browser rustls and Charon/LLBC both need it.
-[target.'cfg(all(target_arch = "wasm32", not(target_os = "wasi")))'.dependencies]
-rustls-pki-types = { version = "1", default-features = false, features = ["alloc", "std", "web"] }
-
 [target.'cfg(not(any(target_os = "ios", target_os = "android", target_os = "windows", target_arch = "wasm32", target_os = "redox")))'.dependencies]
 mac_address = { workspace = true }
 
@@ -114,7 +122,4 @@ cc = "1"
 [lints]
 workspace = true
 
-[package.metadata.cargo-shear]
-# Feature-unification only: enables rustls-pki-types `web` so UnixTime::now
-# exists on wasm32-unknown-unknown. No rust source imports this crate.
-ignored = ["rustls-pki-types"]
+

crates/host_env/src/ssl/mod.rs

@@ -1,38 +1,59 @@
 //! Shared `_ssl` surface.
 //!
-//! The `ssl` feature compiles this whole module. MemoryBIO, constants, OID,
-//! and ALPN do not use rustls. The rustls engine compiles wherever `rustls`
-//! is available, including browser wasm via rustls-rustcrypto.
+//! `ssl` is the rustls-free surface: MemoryBIO, constants, OID, ALPN, and
+//! hostname checks. `rustls` compiles the rustls engine. Browser wasm
+//! enables `rustls` together with rustls-pki-types `web` on that crate;
+//! wasm-host enables `ssl` only.
 
 pub mod bio;
-pub mod cert;
-pub mod chain;
-pub mod cipher;
-pub mod config;
-pub mod connection;
 pub mod constants;
-pub mod error;
-pub mod handshake;
-pub mod keylog;
-pub mod msg;
 pub mod oid;
 pub mod protocol;
+
+#[cfg(feature = "rustls")]
+pub mod cert;
+#[cfg(feature = "rustls")]
+pub mod chain;
+#[cfg(feature = "rustls")]
+pub mod cipher;
+#[cfg(feature = "rustls")]
+pub mod config;
+#[cfg(feature = "rustls")]
+pub mod connection;
+#[cfg(feature = "rustls")]
+pub mod error;
+#[cfg(feature = "rustls")]
+pub mod handshake;
+#[cfg(feature = "rustls")]
+pub mod keylog;
+#[cfg(feature = "rustls")]
+pub mod msg;
+#[cfg(feature = "rustls")]
 pub mod providers;
+#[cfg(feature = "rustls")]
 pub mod session;
+#[cfg(feature = "rustls")]
 pub mod verify;
+#[cfg(feature = "rustls")]
 pub mod x509;
 
 pub use bio::{MemoryBio, MemoryBioError};
+pub use constants::*;
+pub use protocol::{AlpnError, HostnameError, parse_length_prefixed_alpn, validate_hostname};
+
+#[cfg(feature = "rustls")]
 pub use cert::{DecodedCertificate, decode_certificate, is_ca_certificate};
+#[cfg(feature = "rustls")]
 pub use connection::{
     RecordCursor, SSL3_RT_MAX_PACKET_SIZE, TLS_RECORD_HEADER_SIZE, TlsConnection,
 };
-pub use constants::*;
+#[cfg(feature = "rustls")]
 pub use error::TlsError;
-pub use protocol::{
-    AlpnError, HostnameError, parse_length_prefixed_alpn, rustls_versions, validate_hostname,
-};
+#[cfg(feature = "rustls")]
+pub use protocol::rustls_versions;
+#[cfg(feature = "rustls")]
 pub use providers::CryptoExt;
+#[cfg(feature = "rustls")]
 pub use session::{
     CapturingClientSessionStore, ClientSessionKind, SESSION_CACHE_SIZE, SessionCache, SessionData,
 };

crates/host_env/src/ssl/protocol.rs

@@ -39,6 +39,7 @@ pub fn validate_hostname(hostname: &str) -> Result<(), HostnameError> {
 }
 
 /// Convert PROTO/OP bits into the rustls version slice.
+#[cfg(feature = "rustls")]
 #[must_use]
 pub fn rustls_versions(
     minimum: i32,

crates/stdlib/Cargo.toml

@@ -24,7 +24,7 @@ ssl-openssl-vendor = ["ssl-openssl", "openssl/vendored"]
 tkinter = ["dep:tk-sys", "dep:tcl-sys", "dep:widestring"]
 flame-it = ["flame"]
 
-__ssl-rustls = ["ssl", "rustpython-host_env/ssl", "rustpython-host_env/native-certs", "rustls", "rustls-pemfile", "x509-parser", "pem-rfc7468", "webpki-roots"]
+__ssl-rustls = ["ssl", "rustpython-host_env/ssl", "rustpython-host_env/rustls", "rustpython-host_env/native-certs", "rustls", "rustls-pemfile", "x509-parser", "pem-rfc7468", "webpki-roots"]
 
 [dependencies]
 # rustpython crates

crates/wasm/Cargo.toml

@@ -48,7 +48,7 @@ getrandom_02 = { package = "getrandom", version = "0.2", features = ["js"] }
 rustls = { workspace = true, default-features = false, features = ["std", "tls12", "custom-provider"] }
 rustls-pki-types = { version = "1", default-features = false, features = ["alloc", "std", "web"] }
 rustls-rustcrypto = "0.0.2-alpha"
-rustpython-host_env = { workspace = true, features = ["ssl"] }
+rustpython-host_env = { workspace = true, features = ["rustls"] }
 
 [package.metadata.wasm-pack.profile.release]
 wasm-opt = false#["-O1"]