Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: start using rustls instead of openssl #255

Closed
wants to merge 4 commits into from
Closed

feat: start using rustls instead of openssl #255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4597a02
feat: switch to rustls to avoid compiling OpenSSL and relying on loca…
Angelmmiguel Nov 24, 2023
ae79109
chore: compile artifacts in the PR temporarily
Angelmmiguel Nov 24, 2023
ecd1b90
feat: use the rustls feature on dev-dependencies too
Angelmmiguel Nov 24, 2023
bfc256e
chore: add clarification about ring license
Angelmmiguel Nov 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions .github/workflows/artifacts.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,9 @@ on:
push:
tags:
- "v[0-9]+.[0-9]+.[0-9]+"
# TODO: Remove it
pull_request:
branches: [ "main", "v[0-9]+.[0-9]+" ]

jobs:
build:
Expand All @@ -18,14 +21,14 @@ jobs:
platform: unknown-linux-musl
cross: false
name: linux-musl
features: --features vendored-openssl
features:
- build: linux
arch: aarch64
os: ubuntu-latest
platform: unknown-linux-musl
cross: true
name: linux-musl
features: --features vendored-openssl
features:
- build: windows
arch: x86_64
os: windows-latest
Expand Down Expand Up @@ -53,7 +56,7 @@ jobs:
platform: apple-darwin
cross: false
name: macos-darwin
features: --features vendored-openssl
features:
runs-on: ${{ matrix.os }}
env:
# This variable can be overriden with `cross` for builds that
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/container-preview.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
sudo apt-get update
sudo apt-get install musl-tools
- name: Build
run: ${{env.CARGO}} build --release --target=${{ matrix.arch }}-${{ matrix.platform }} --features vendored-openssl
run: ${{env.CARGO}} build --release --target=${{ matrix.arch }}-${{ matrix.platform }}
- name: Upload artifact
uses: actions/upload-artifact@v3
with:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/container-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@ jobs:
sudo apt-get update
sudo apt-get install musl-tools
- name: Build
run: ${{env.CARGO}} build --release --target=${{ matrix.arch }}-${{ matrix.platform }} --features vendored-openssl
run: ${{env.CARGO}} build --release --target=${{ matrix.arch }}-${{ matrix.platform }}
- name: Upload artifact
uses: actions/upload-artifact@v3
with:
Expand Down
70 changes: 59 additions & 11 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

7 changes: 2 additions & 5 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ wws-server = { workspace = true }
wws-project = { workspace = true }

[dev-dependencies]
reqwest = { version = "0.11", features = ["blocking"] }
reqwest = { version = "0.11", features = ["rustls", "blocking"] }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
reqwest = { version = "0.11", features = ["rustls", "blocking"] }
reqwest = { version = "0.11", features = ["rustls-tls", "blocking"] }

As per https://github.com/seanmonstar/reqwest/blob/master/Cargo.toml#L41

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We might want to use rustls-tls-webpki-roots as well, so that we can provide a static binary that contains the root certificates bundled in the binary itself, without the need for the host system running wws to have ca-certificates or similar installed.

This has its problems of course, as for example, root certificate revocation, but I think it should be fine for now.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch! Unfortunately, I'm going to close this PR due to #256. We still need to find an alternative that works for git2-rs :/

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ouch, right.


[features]
default = ["all"]
Expand All @@ -43,8 +43,6 @@ wws_config = []
wws_router = []
wws_server = []

vendored-openssl = ["wws-project/vendored-openssl"]

[workspace]
members = [
"crates/api-manage",
Expand Down Expand Up @@ -77,7 +75,7 @@ exclude = [
[workspace.dependencies]
actix-web = "4"
lazy_static = "1.4.0"
reqwest = "0.11"
reqwest = { version = "0.11", features = ["rustls"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0.85"
tokio = "1.28"
Expand All @@ -99,4 +97,3 @@ wasmtime-wasi = "13.0.0"
wasmtime-wasi-nn = "13.0.0"
wasi-common = "13.0.0"
path-slash = "0.2.1"
openssl = { version = "=0.10.55" }
5 changes: 0 additions & 5 deletions crates/project/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,6 @@ wws-store = { workspace = true }
url = "2.3.1"
sha256 = "1.1.1"
git2 = "0.17.2"
# Not all platforms require OpenSSL
openssl = { workspace = true, optional = true }

[features]
vendored-openssl = ["openssl/vendored"]

[dev-dependencies]
path-slash = { workspace = true }
11 changes: 9 additions & 2 deletions deny.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ exclude = [
"wit-bindgen-wasmtime",
"wit-bindgen-gen-wasmtime",
"wit-bindgen-gen-rust",
"wit-bindgen-gen-core"
"wit-bindgen-gen-core",
]

# More documentation for the advisories section can be found here:
Expand Down Expand Up @@ -63,10 +63,17 @@ allow = [
"ISC",
"MIT",
"MPL-2.0",
"OpenSSL",
"Unicode-DFS-2016",
"Zlib"
"Zlib",
]

# Special case for Ring, which includes multiple licenses
[[licenses.clarify]]
name = "ring"
expression = "MIT AND ISC AND OpenSSL"
license-files = [{ path = "LICENSE", hash = 0xbd0eed23 }]

# More documentation about the 'bans' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
Expand Down
8 changes: 2 additions & 6 deletions image/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,4 @@
# Build wasm_runtime in release mode


FROM --platform=$TARGETPLATFORM rust:1.71.0-slim as build-wws
ARG WWS_BUILD_DIR=/usr/src/wws
ARG TARGETPLATFORM
Expand All @@ -19,15 +17,13 @@ RUN set -eux; \
*) echo >&2 "unsupported architecture: $BUILDPLATFORM"; exit 1 ;; \
esac; \
rustup target add $bldArch; \
cargo build --release --features vendored-openssl --target=$bldArch; \
cargo build --release --target=$bldArch; \
mkdir ./build; \
cp ./target/$bldArch/release/wws ./build/wws


# Build the image
FROM --platform=$TARGETPLATFORM debian:bullseye-slim
ARG WWS_BUILD_DIR=/usr/src/wws
RUN apt-get update && \
apt-get install -y --no-install-recommends ca-certificates
RUN mkdir -p /app
RUN mkdir -p /opt
COPY --from=build-wws ${WWS_BUILD_DIR}/build/wws /opt
Expand Down
4 changes: 1 addition & 3 deletions image/Prebuilt.dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,9 @@
# is mainly used to build the preview / release container images in
# GitHub actions

# Retrieve the certificates to install runtimes later on.
# Create the folders for the main container
FROM --platform=$TARGETPLATFORM bitnami/minideb:latest AS sysroot
RUN mkdir -p /target/app /target/opt
RUN install_packages ca-certificates

# Build the final image
FROM --platform=$TARGETPLATFORM scratch
Expand All @@ -17,7 +16,6 @@ LABEL org.opencontainers.image.licenses="Apache-2.0"

COPY --from=sysroot /target/app /app
COPY --from=sysroot /target/opt /opt
COPY --from=sysroot /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --chmod=755 ./wws-$TARGETARCH /opt/wws

ENTRYPOINT ["/opt/wws"]
Expand Down
Loading