Skip to content

Conversation

@jdrouet
Copy link

@jdrouet jdrouet commented Sep 25, 2025

Changes

ring is not maintained anymore and could lead to compilation issues. We need a way to use the tonic exporter with https without relying on ring. This PR replicates the way tonic handles TLS by separating the ring feature from the others.
This PR also introduces a tls-aws-lc feature so that users can rely on it.

Merge requirement checklist

  • CONTRIBUTING guidelines followed
  • Unit tests added/updated (if applicable)
  • Appropriate CHANGELOG.md files updated for non-trivial, user-facing changes
  • Changes in public API reviewed (if applicable)

@jdrouet jdrouet requested a review from a team as a code owner September 25, 2025 07:48
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Sep 25, 2025

CLA Signed

The committers listed above are authorized under a signed CLA.

@codecov
Copy link

codecov bot commented Sep 25, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.5%. Comparing base (285dc92) to head (af00d1d).

Additional details and impacted files
@@          Coverage Diff          @@
##            main   #3180   +/-   ##
=====================================
  Coverage   80.5%   80.5%           
=====================================
  Files        126     126           
  Lines      22238   22238           
=====================================
  Hits       17921   17921           
  Misses      4317    4317           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@jdrouet jdrouet force-pushed the jdrouet/replicate-tonic-features-for-tls branch from d55af6e to af00d1d Compare September 26, 2025 06:50
Copy link
Member

@scottgerring scottgerring left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @jdrouet thanks for raising this!
Have put a couple comments inline; perhaps we can do this in a non-breaking way without it getting too messy

gzip-http = ["flate2"]
zstd-http = ["zstd"]
tls = ["tonic/tls-ring"]
tls = []
Copy link
Member

@scottgerring scottgerring Oct 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tonic feature flags impl referenced:

_tls-any = ["dep:tokio", "tokio?/rt", "tokio?/macros", "tls-connect-info"] # Internal. Please choose one of `tls-ring` or `tls-aws-lc`
tls-ring = ["_tls-any", "tokio-rustls/ring"]
tls-aws-lc = ["_tls-any", "tokio-rustls/aws-lc-rs"]

I believe the intention is that "_tls-any" is an "internal" feature, not something the user is intended to rely on, and is what's then used to guard the backend-independent TLS code.

With this in mind, and with an eye to maintaining backward compatibility, how about:

_tls-any = []  # Internal feature for TLS guards
tls-ring = ["_tls-any", "tonic/tls-ring"]    # User opts into ring
tls-aws-lc = ["_tls-any", "tonic/tls-aws-lc"] # User opts into aws-lc
tls = ["tls-ring"]  # Default to existing behaviour 

This would need code changes too to move from tls to _tls-any in the feature guards - e.g. a bunch of stuff in exporter/tonic/mod:

#[cfg(feature = "tls")]
use tonic::transport::ClientTlsConfig;

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As this suggestion stretches the scope a little here, it would be great if one of the others piped in - @lalitb @bantonsson , does this seem reasonable to you?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants