[Rust Frontend] Switch rustls to native-tls/OpenSSL

[BugenZhao]

Signed-off-by: Bugen Zhao i@bugenzhao.com

Purpose

Related discussions:

• [Frontend] Add opt-in native-tls crypto backend for the Rust frontend #46052 @wseaton
• [Rust Frontend] Add static HTTPS and mTLS support for HTTP and gRPC #45890 (comment) @tahsintunan

Eliminate rustls from the Rust frontend dependency tree and keep the HTTP/TLS stack on native-tls / OpenSSL, which is friendlier for compliance-sensitive deployments.

Also adds a cargo-deny bans check for the crypto provider crates we want to keep out of the Rust frontend dependency graph into CI to avoid future regression.

The deny-list approach follows the same style as TiKV's dependency policy checks, with a small atomic provider list instead of banning every wrapper crate:

• rustls
• ring
• aws-lc-rs
• aws-lc-sys
• s2n-tls
• s2n-tls-sys
• boring
• boring-sys

Reference: tikv/tikv#16352

Test Plan

./.buildkite/scripts/run-rust-frontend-cargo-ci.sh style-clippy
cargo deny --manifest-path rust/Cargo.toml check --config rust/deny.toml bans

for crate in rustls ring aws-lc-rs aws-lc-sys s2n-tls s2n-tls-sys boring boring-sys; do
  cargo tree --manifest-path rust/Cargo.toml --target all -e all -i "$crate"
done

Test Result

./.buildkite/scripts/run-rust-frontend-cargo-ci.sh style-clippy passes locally, including:

--- Checking Rust dependency bans
bans ok
--- Running clippy
Finished `dev` profile [unoptimized + debuginfo] target(s)

cargo deny --manifest-path rust/Cargo.toml check --config rust/deny.toml bans passes:

bans ok

The denied provider crates are absent from the dependency tree:

rustls: nothing to print
ring: nothing to print
aws-lc-rs: package ID specification did not match any packages
aws-lc-sys: package ID specification did not match any packages
s2n-tls: package ID specification did not match any packages
s2n-tls-sys: package ID specification did not match any packages
boring: package ID specification did not match any packages
boring-sys: package ID specification did not match any packages

---

Essential Elements of an Effective PR Description Checklist

• The purpose of the PR, such as "Fix some issue (link existing issues this PR will resolve)".
• The test plan, such as providing test command.
• The test results, such as pasting the results comparison before and after, or e2e results
• (Optional) The necessary documentation update, such as updating supported_models.md and examples for a new model.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[Harry-Chen]

IIUC this creates a dependency on libssl.so.X for all of our wheels? We may need to handle this carefully since many Linux distros are in the transition from libssl3 to libssl4.

[BugenZhao]

IIUC this creates a dependency on libssl.so.X for all of our wheels? We may need to handle this carefully since many Linux distros are in the transition from libssl3 to libssl4.

Good point. OpenSSL already exists in the dependency tree before this PR, so this PR is just a clean-up to avoid both crypto backends appear simultaneously. Regarding wheels/images, for portability, we always enable the native-tls-vendored feature. So I think there's no runtime dependency on libssl.so.X.

vllm/tools/build_rust.py

Lines 20 to 27 in 1ab5950

	RustExtension(
	target="vllm.vllm-rs",
	path="rust/src/cmd/Cargo.toml",
	args=["--bin", "vllm-rs"],
	features=["native-tls-vendored"],
	binding=Binding.Exec,
	optional=optional,
	),

nit: native-tls-vendored should probably be disabled for FIPS-compliance builds, but that’s fine since we provide it as an option.

[BugenZhao]

@codex review

[wseaton]

Yep, totally fine to vendor by default so long as there is the option to link against the system OpenSSL. Thanks for this @BugenZhao!

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c53774d466

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".