Skip to content

Conversation

@prestwich
Copy link
Member

@prestwich prestwich commented Aug 8, 2025

Motivation

Contrary to the comment, the ring feature does not select ring as the default backend. instead it enables it in rustls, and then if it is the only built-in backend enabled selects it by default. Unfortunately, if both built-ins are enabled there will be runtime errors in other peoples' binaries. When ring is enabled, binaries with the rustls features will crash when TLS is activated for the first time as TLS backend inference is feature based and fails when both are enabled. Rustls @ 0.23.31 enables aws-lc-rs by default, ensuring that anyone using WS with a default-features rustls currently must either deliberately select a provider, or have runtime errors

gcloud incorrectly enabled ring in older 0.27 versions, so this PR explicitly bumps it to 0.27.4

If we need ring for development, we can enable it as a dev-dep.

I wanted to make a Once that checks for provider configuration before entering the WS connection logic for the first time, however, the rustls API makes that impossible :(

PR Checklist

  • Added Tests
  • Added Documentation
  • Breaking changes

Copy link
Member

@mattsse mattsse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i assume this will likely break for a lot of people that don't have any backend in the depgraph then

@prestwich
Copy link
Member Author

i still think this is important, waiting for rustls/rustls#2596 to be in a release

@prestwich
Copy link
Member Author

prestwich commented Oct 20, 2025

when it is released, we can add this to native.rs and force the LazyLock in the PubsubConnect::connect fn

static CRYPTO_BACKEND_CHECK: LazyLock<()> = LazyLock::new(|| {
    use rustls::crypto::CryptoProvider;
    if CryptoProvider::get_default().is_some() || CryptoProvider::from_crate_features().is_none() {
        panic!("No TLS crypto backend enabled. Ensure that your binary enables EXACTLY one of the supported rustls tls backends. E.g. `ring` or `aws-lc-rs`");
    }
});

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

3 participants