async-rs / async-rs/async-tls

Support for rustls-native-certs

Open
#52 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
172
Forks
49
PR merge metrics
No merged PRs in 30d

Description

Hi, I'm one of the Debian rust maintainers.

In Debian we try very hard to avoid having multiple copies of the root certificate store. As such we really want to avoid packaging the webpki-roots crate since webpki-roots not only contains a duplicate root certificate store, but causes said root certificate store to become hard-coded into all applications built against it. The result of this is that right now the rust-async-tls package in Debian is patched such that it is only usable for server applications.

To fix this I would propose restructuring the "client" feature upstream into four features.

* "client-base" would enable the client functionality in the package, but would not load any root certificates by default.
* "client-webpki-roots" would enable the client functionality and load root certificates from webpki-roots
* "client-native-roots" would enable the client functionality and load root certificates from rustls-native-certs
* "client" would be an alias for "client-webpki-roots"

Then in Debian, rather than disabling the client functionality completely as we do now, we would disable "client-webpki-roots" and change "client" to be an alias for "client-native-roots".

What do you think of this proposal?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by inspecting the package's existing `client` feature and how it currently uses `webpki-roots`. Compare that setup with the proposed `client-base`, `client-webpki-roots`, and `client-native-roots` features using `rustls-native-certs`; done means native certificate loading is available without packaging a duplicate root store while `client` retains its stated alias behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.