feat(build): add system CA root mode - #2051
Conversation
97dd40d to
94bb1af
Compare
Allow distro builds to use native trust stores for supervisor upstream TLS while keeping bundled Mozilla roots as the default. Avoid bundled root crates in system-ca-roots builds by using native-root TLS features and z3 0.20. Signed-off-by: Adam Miller <admiller@redhat.com>
94bb1af to
60d7644
Compare
|
This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity. |
github-actions
Bot
added
the
state:stale
| let native_certs = rustls_native_certs::load_native_certs(); | ||
| let cert_count = native_certs.certs.len(); | ||
| let (added, ignored) = root_store.add_parsable_certificates(native_certs.certs); | ||
| let ignored = ignored + native_certs.errors.len(); |
There was a problem hiding this comment.
ignored here combines parse failures from add_parsable_certificates with disk-level load errors from native_certs.errors, while cert_count only reflects certs that successfully loaded from disk. In the error message this means ignored can exceed cert_count, which looks odd. Consider reporting the two failure modes separately, or just reporting added in the message.
politerealism
left a comment
politerealism
left a comment
There was a problem hiding this comment.
One comment left for add_native_roots which is only a minor suggestion and only applies if debuggin a distro packaging issue on a stripped container with no system certs. Not typical I think, but worth a thought.
|
closing, fixed with #2324 |
3 participants
Summary
Add feature-controlled TLS root selection so upstream builds keep bundled Mozilla roots while Linux distro builds can use system/native trust stores only.
Related Issue
N/A
Changes
bundled-ca-rootsandsystem-ca-rootsCargo features.z3-syslocally to avoid pullingwebpki-rootsin system-root builds.architecture/build.md.Testing
mise run pre-commitpassescargo check --workspace --all-targetspassescargo check --workspace --all-targets --no-default-features --features system-ca-rootspassescargo test --workspacepassescargo test --workspace --no-default-features --features system-ca-rootspassescargo tree -i webpki-roots --no-default-features --features system-ca-rootsshows no packagecargo tree -i webpki-root-certs --no-default-features --features system-ca-rootsshows no packageChecklist