search

mozilla-services / syncstorage-rs

Sync Storage server in Rust
Mozilla Public License 2.0
894 stars 49 forks source link

chore: Cleans up TLS dependencies #1519

Closed tarikeshaq closed 7 months ago

tarikeshaq commented 7 months ago

Description

We had a few places where we were importing native-tls (which pulls openssl in linux boxes) unintentionally. First was reqwest, where we enable the rustls-tls feature in a couple of places, but it was a no-op in one but since we did call use_rustls_tls in our tokenserver browserid verifier that used rustls properly. The second place was sentry, where even though we were using the curl feature, the transport feature is enabled by default, which pulls in request again, with the native-tls feature

Regardless, having both rustls and native-tls in our dependency tree could be a future foot gun, so this PR removes native-tls (alternatively, we can go the route of removing rustls but we seem to have consciously chose that, where native-tls snuck in with reqwest and sentry)

What this PR does not touch, is boring-ssl that is pulled in using grpc-io.

One possible improvement we can make to this, that fits well with https://mozilla-hub.atlassian.net/browse/SYNC-4127 is to setup rust features, where we can support multiple tls backends... but I'm struggling to see the value from that (i.e why do we need to support multiple backends in a binary?)

jrconlin commented 7 months ago

Looks good so far. Thanks for untangling some of that.