From c382a607bbcb8882582edc33bbb89ed17d1188df Mon Sep 17 00:00:00 2001 From: "Jeong, YunWon" <69878+youknowone@users.noreply.github.com> Date: Fri, 18 Sep 2026 00:18:05 +0900 Subject: [PATCH] host_env: keep rustls off the rustls-free ssl surface (#8727) * host_env: keep rustls off the rustls-free ssl surface ssl is MemoryBIO, constants, OID, and ALPN. ssl-rustls is the rustls engine. Drop the wasm32 rustls-pki-types web dep; the browser crate already enables that feature. Assisted-by: Claude * host_env: drop rustls-pki-types from the lockfile Assisted-by: Claude * host_env: name the rustls engine feature rustls ssl is the rustls-free surface. rustls is the engine. stdlib's ssl-rustls product feature still selects this. Assisted-by: Claude --- Cargo.lock | 1 - crates/host_env/Cargo.toml | 25 ++++++++------ crates/host_env/src/ssl/mod.rs | 53 ++++++++++++++++++++--------- crates/host_env/src/ssl/protocol.rs | 1 + crates/stdlib/Cargo.toml | 2 +- crates/wasm/Cargo.toml | 2 +- 6 files changed, 55 insertions(+), 29 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index fed711f0e..59d5ca9e1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3876,7 +3876,6 @@ dependencies = [ "rustls", "rustls-native-certs", "rustls-pemfile", - "rustls-pki-types", "rustls-webpki 0.103.13", "rustpython-wtf8", "rustyline", diff --git a/crates/host_env/Cargo.toml b/crates/host_env/Cargo.toml index 1ef5cb0c8..407b748c8 100644 --- a/crates/host_env/Cargo.toml +++ b/crates/host_env/Cargo.toml @@ -10,7 +10,20 @@ license.workspace = true [features] native-certs = ["dep:rustls-native-certs"] -ssl = ["dep:rustls", "dep:rustls-pemfile", "dep:rustls-webpki", "dep:x509-parser", "dep:der", "dep:pkcs8", "dep:sha2"] +# rustls-free `_ssl` surface: MemoryBIO, constants, OID, ALPN, hostname. +ssl = [] +# rustls engine. Implies `ssl`. Browser wasm enables this together with +# rustls-pki-types `web` on that crate; wasm-host enables `ssl` only. +rustls = [ + "ssl", + "dep:rustls", + "dep:rustls-pemfile", + "dep:rustls-webpki", + "dep:x509-parser", + "dep:der", + "dep:pkcs8", + "dep:sha2", +] [dependencies] rustpython-wtf8 = { workspace = true } @@ -39,11 +52,6 @@ rustix = { workspace = true } [target.'cfg(any(not(target_arch = "wasm32"), target_os = "wasi"))'.dependencies] num_cpus = "1.17.0" -# rustls-pki-types::UnixTime::now is gated off wasm32-unknown-unknown unless -# the `web` feature is on. Browser rustls and Charon/LLBC both need it. -[target.'cfg(all(target_arch = "wasm32", not(target_os = "wasi")))'.dependencies] -rustls-pki-types = { version = "1", default-features = false, features = ["alloc", "std", "web"] } - [target.'cfg(not(any(target_os = "ios", target_os = "android", target_os = "windows", target_arch = "wasm32", target_os = "redox")))'.dependencies] mac_address = { workspace = true } @@ -114,7 +122,4 @@ cc = "1" [lints] workspace = true -[package.metadata.cargo-shear] -# Feature-unification only: enables rustls-pki-types `web` so UnixTime::now -# exists on wasm32-unknown-unknown. No rust source imports this crate. -ignored = ["rustls-pki-types"] + diff --git a/crates/host_env/src/ssl/mod.rs b/crates/host_env/src/ssl/mod.rs index 64d53d5b2..a2d8f32e5 100644 --- a/crates/host_env/src/ssl/mod.rs +++ b/crates/host_env/src/ssl/mod.rs @@ -1,38 +1,59 @@ //! Shared `_ssl` surface. //! -//! The `ssl` feature compiles this whole module. MemoryBIO, constants, OID, -//! and ALPN do not use rustls. The rustls engine compiles wherever `rustls` -//! is available, including browser wasm via rustls-rustcrypto. +//! `ssl` is the rustls-free surface: MemoryBIO, constants, OID, ALPN, and +//! hostname checks. `rustls` compiles the rustls engine. Browser wasm +//! enables `rustls` together with rustls-pki-types `web` on that crate; +//! wasm-host enables `ssl` only. pub mod bio; -pub mod cert; -pub mod chain; -pub mod cipher; -pub mod config; -pub mod connection; pub mod constants; -pub mod error; -pub mod handshake; -pub mod keylog; -pub mod msg; pub mod oid; pub mod protocol; + +#[cfg(feature = "rustls")] +pub mod cert; +#[cfg(feature = "rustls")] +pub mod chain; +#[cfg(feature = "rustls")] +pub mod cipher; +#[cfg(feature = "rustls")] +pub mod config; +#[cfg(feature = "rustls")] +pub mod connection; +#[cfg(feature = "rustls")] +pub mod error; +#[cfg(feature = "rustls")] +pub mod handshake; +#[cfg(feature = "rustls")] +pub mod keylog; +#[cfg(feature = "rustls")] +pub mod msg; +#[cfg(feature = "rustls")] pub mod providers; +#[cfg(feature = "rustls")] pub mod session; +#[cfg(feature = "rustls")] pub mod verify; +#[cfg(feature = "rustls")] pub mod x509; pub use bio::{MemoryBio, MemoryBioError}; +pub use constants::*; +pub use protocol::{AlpnError, HostnameError, parse_length_prefixed_alpn, validate_hostname}; + +#[cfg(feature = "rustls")] pub use cert::{DecodedCertificate, decode_certificate, is_ca_certificate}; +#[cfg(feature = "rustls")] pub use connection::{ RecordCursor, SSL3_RT_MAX_PACKET_SIZE, TLS_RECORD_HEADER_SIZE, TlsConnection, }; -pub use constants::*; +#[cfg(feature = "rustls")] pub use error::TlsError; -pub use protocol::{ - AlpnError, HostnameError, parse_length_prefixed_alpn, rustls_versions, validate_hostname, -}; +#[cfg(feature = "rustls")] +pub use protocol::rustls_versions; +#[cfg(feature = "rustls")] pub use providers::CryptoExt; +#[cfg(feature = "rustls")] pub use session::{ CapturingClientSessionStore, ClientSessionKind, SESSION_CACHE_SIZE, SessionCache, SessionData, }; diff --git a/crates/host_env/src/ssl/protocol.rs b/crates/host_env/src/ssl/protocol.rs index 25bab6755..fa0c95ff3 100644 --- a/crates/host_env/src/ssl/protocol.rs +++ b/crates/host_env/src/ssl/protocol.rs @@ -39,6 +39,7 @@ pub fn validate_hostname(hostname: &str) -> Result<(), HostnameError> { } /// Convert PROTO/OP bits into the rustls version slice. +#[cfg(feature = "rustls")] #[must_use] pub fn rustls_versions( minimum: i32, diff --git a/crates/stdlib/Cargo.toml b/crates/stdlib/Cargo.toml index 4955b99a0..3e459f71e 100644 --- a/crates/stdlib/Cargo.toml +++ b/crates/stdlib/Cargo.toml @@ -24,7 +24,7 @@ ssl-openssl-vendor = ["ssl-openssl", "openssl/vendored"] tkinter = ["dep:tk-sys", "dep:tcl-sys", "dep:widestring"] flame-it = ["flame"] -__ssl-rustls = ["ssl", "rustpython-host_env/ssl", "rustpython-host_env/native-certs", "rustls", "rustls-pemfile", "x509-parser", "pem-rfc7468", "webpki-roots"] +__ssl-rustls = ["ssl", "rustpython-host_env/ssl", "rustpython-host_env/rustls", "rustpython-host_env/native-certs", "rustls", "rustls-pemfile", "x509-parser", "pem-rfc7468", "webpki-roots"] [dependencies] # rustpython crates diff --git a/crates/wasm/Cargo.toml b/crates/wasm/Cargo.toml index ab34320af..c63d820d5 100644 --- a/crates/wasm/Cargo.toml +++ b/crates/wasm/Cargo.toml @@ -48,7 +48,7 @@ getrandom_02 = { package = "getrandom", version = "0.2", features = ["js"] } rustls = { workspace = true, default-features = false, features = ["std", "tls12", "custom-provider"] } rustls-pki-types = { version = "1", default-features = false, features = ["alloc", "std", "web"] } rustls-rustcrypto = "0.0.2-alpha" -rustpython-host_env = { workspace = true, features = ["ssl"] } +rustpython-host_env = { workspace = true, features = ["rustls"] } [package.metadata.wasm-pack.profile.release] wasm-opt = false#["-O1"]