k-ap 0.5.1; reqwest ring-only, sqlx no tls; bootstrap installs ring provider

This commit is contained in:
2026-10-26 03:52:49 +01:00
parent b9cdb54340
commit 0b80e48622
11 changed files with 75 additions and 282 deletions

306
Cargo.lock generated
View File

@@ -29,7 +29,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "20222f29f14358d3baeb0ffdec08f99bd0f56b6b59504f33556d97db720de748"
dependencies = [
"activitystreams-kinds",
"actix-web",
"async-trait",
"axum",
"base64",
@@ -41,8 +40,7 @@ dependencies = [
"enum_delegate",
"futures",
"futures-core",
"http 0.2.12",
"http 1.4.0",
"http",
"http-signature-normalization",
"http-signature-normalization-reqwest",
"httpdate",
@@ -74,154 +72,6 @@ dependencies = [
"url",
]
[[package]]
name = "actix-codec"
version = "0.5.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5f7b0a21988c1bf877cf4759ef5ddaac04c1c9fe808c9142ecb78ba97d97a28a"
dependencies = [
"bitflags 2.11.1",
"bytes",
"futures-core",
"futures-sink",
"memchr",
"pin-project-lite",
"tokio",
"tokio-util",
"tracing",
]
[[package]]
name = "actix-http"
version = "3.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "93acb4a42f64936f9b8cae4a433b237599dd6eb6ed06124eb67132ef8cc90662"
dependencies = [
"actix-codec",
"actix-rt",
"actix-service",
"actix-utils",
"bitflags 2.11.1",
"bytes",
"bytestring",
"derive_more",
"encoding_rs",
"foldhash 0.1.5",
"futures-core",
"http 0.2.12",
"httparse",
"httpdate",
"itoa",
"language-tags",
"mime",
"percent-encoding",
"pin-project-lite",
"smallvec",
"tokio",
"tokio-util",
"tracing",
]
[[package]]
name = "actix-router"
version = "0.5.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "14f8c75c51892f18d9c46150c5ac7beb81c95f78c8b83a634d49f4ca32551fe7"
dependencies = [
"bytestring",
"cfg-if",
"http 0.2.12",
"regex-lite",
"serde",
"tracing",
]
[[package]]
name = "actix-rt"
version = "2.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92589714878ca59a7626ea19734f0e07a6a875197eec751bb5d3f99e64998c63"
dependencies = [
"futures-core",
"tokio",
]
[[package]]
name = "actix-server"
version = "2.6.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a65064ea4a457eaf07f2fba30b4c695bf43b721790e9530d26cb6f9019ff7502"
dependencies = [
"actix-rt",
"actix-service",
"actix-utils",
"futures-core",
"futures-util",
"mio",
"socket2 0.5.10",
"tokio",
"tracing",
]
[[package]]
name = "actix-service"
version = "2.0.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9e46f36bf0e5af44bdc4bdb36fbbd421aa98c79a9bce724e1edeb3894e10dc7f"
dependencies = [
"futures-core",
"pin-project-lite",
]
[[package]]
name = "actix-utils"
version = "3.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "88a1dcdff1466e3c2488e1cb5c36a71822750ad43839937f85d2f4d9f8b705d8"
dependencies = [
"local-waker",
"pin-project-lite",
]
[[package]]
name = "actix-web"
version = "4.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ff87453bc3b56e9b2b23c1cc0b1be8797184accf51d2abe0f8a33ec275d316bf"
dependencies = [
"actix-codec",
"actix-http",
"actix-router",
"actix-rt",
"actix-server",
"actix-service",
"actix-utils",
"bytes",
"bytestring",
"cfg-if",
"derive_more",
"encoding_rs",
"foldhash 0.1.5",
"futures-core",
"futures-util",
"impl-more",
"itoa",
"language-tags",
"log",
"mime",
"once_cell",
"pin-project-lite",
"regex-lite",
"serde",
"serde_json",
"serde_urlencoded",
"smallvec",
"socket2 0.6.3",
"time",
"tracing",
"url",
]
[[package]]
name = "adler2"
version = "2.0.1"
@@ -701,28 +551,6 @@ dependencies = [
"arrayvec",
]
[[package]]
name = "aws-lc-rs"
version = "1.17.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
dependencies = [
"aws-lc-sys",
"zeroize",
]
[[package]]
name = "aws-lc-sys"
version = "0.41.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
dependencies = [
"cc",
"cmake",
"dunce",
"fs_extra",
]
[[package]]
name = "axum"
version = "0.8.9"
@@ -734,7 +562,7 @@ dependencies = [
"bytes",
"form_urlencoded",
"futures-util",
"http 1.4.0",
"http",
"http-body",
"http-body-util",
"hyper",
@@ -766,7 +594,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
dependencies = [
"bytes",
"futures-core",
"http 1.4.0",
"http",
"http-body",
"http-body-util",
"mime",
@@ -787,7 +615,7 @@ dependencies = [
"dashmap",
"forwarded-header-value",
"governor",
"http 1.4.0",
"http",
"ipnet",
"nonzero_ext",
"pin-project-lite",
@@ -928,7 +756,9 @@ dependencies = [
"nats",
"object-storage",
"poster-fetcher",
"reqwest 0.13.3",
"rss 0.1.0",
"rustls",
"serde_json",
"sqlite",
"sqlite-federation",
@@ -980,15 +810,6 @@ dependencies = [
"serde",
]
[[package]]
name = "bytestring"
version = "1.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "86566c496f2f47d9b8147a4c8b02ffdb69c919fe0c2b2e7195d22cbba0e635c9"
dependencies = [
"bytes",
]
[[package]]
name = "calamine"
version = "0.35.0"
@@ -1114,15 +935,6 @@ dependencies = [
"inout",
]
[[package]]
name = "cmake"
version = "0.1.58"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
dependencies = [
"cc",
]
[[package]]
name = "codepage"
version = "0.1.2"
@@ -1592,7 +1404,6 @@ dependencies = [
"quote",
"rustc_version",
"syn 2.0.117",
"unicode-xid",
]
[[package]]
@@ -1695,12 +1506,6 @@ dependencies = [
"dtoa",
]
[[package]]
name = "dunce"
version = "1.0.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
[[package]]
name = "dyn-clone"
version = "1.0.20"
@@ -2059,12 +1864,6 @@ dependencies = [
"thiserror 1.0.69",
]
[[package]]
name = "fs_extra"
version = "1.3.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
[[package]]
name = "futf"
version = "0.1.5"
@@ -2281,7 +2080,7 @@ dependencies = [
"fnv",
"futures-core",
"futures-sink",
"http 1.4.0",
"http",
"indexmap",
"slab",
"tokio",
@@ -2388,17 +2187,6 @@ dependencies = [
"match_token",
]
[[package]]
name = "http"
version = "0.2.12"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
dependencies = [
"bytes",
"fnv",
"itoa",
]
[[package]]
name = "http"
version = "1.4.0"
@@ -2444,7 +2232,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
dependencies = [
"bytes",
"http 1.4.0",
"http",
]
[[package]]
@@ -2455,7 +2243,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
dependencies = [
"bytes",
"futures-core",
"http 1.4.0",
"http",
"http-body",
"pin-project-lite",
]
@@ -2520,7 +2308,7 @@ dependencies = [
"futures-channel",
"futures-core",
"h2",
"http 1.4.0",
"http",
"http-body",
"httparse",
"httpdate",
@@ -2537,7 +2325,7 @@ version = "0.27.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
dependencies = [
"http 1.4.0",
"http",
"hyper",
"hyper-util",
"rustls",
@@ -2557,14 +2345,14 @@ dependencies = [
"bytes",
"futures-channel",
"futures-util",
"http 1.4.0",
"http",
"http-body",
"hyper",
"ipnet",
"libc",
"percent-encoding",
"pin-project-lite",
"socket2 0.6.3",
"socket2",
"system-configuration",
"tokio",
"tower-service",
@@ -2761,12 +2549,6 @@ version = "1.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "40fac9d56ed6437b198fddba683305e8e2d651aa42647f00f5ae542e7f5c94a2"
[[package]]
name = "impl-more"
version = "0.1.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e8a5a9a0ff0086c7a148acb942baaabeadf9504d10400b5a05645853729b9cd2"
[[package]]
name = "importer"
version = "0.1.0"
@@ -2968,9 +2750,9 @@ dependencies = [
[[package]]
name = "k-ap"
version = "0.5.0"
version = "0.5.1"
source = "sparse+https://git.gabrielkaszewski.dev/api/packages/GKaszewski/cargo/"
checksum = "ab6066cccc6ae8aaa2f6262ac7d471e58930a04be3266a2e367d6bdd8aaaba29"
checksum = "261f5d721fb582f029d892cbcf28de9fc3a39547149bc4b52e734b46842a6d4d"
dependencies = [
"activitypub_federation",
"anyhow",
@@ -2981,6 +2763,7 @@ dependencies = [
"futures",
"paste",
"reqwest 0.13.3",
"rustls",
"serde",
"serde_json",
"thiserror 2.0.18",
@@ -3017,12 +2800,6 @@ version = "0.11.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bf36173d4167ed999940f804952e6b08197cae5ad5d572eb4db150ce8ad5d58f"
[[package]]
name = "language-tags"
version = "0.3.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"
[[package]]
name = "lazy_static"
version = "1.5.0"
@@ -3120,12 +2897,6 @@ version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
[[package]]
name = "local-waker"
version = "0.1.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4d873d7c67ce09b42110d801813efbc9364414e356be9935700d368351657487"
[[package]]
name = "lock_api"
version = "0.4.14"
@@ -3368,7 +3139,7 @@ dependencies = [
"bytes",
"encoding_rs",
"futures-util",
"http 1.4.0",
"http",
"httparse",
"memchr",
"mime",
@@ -4102,7 +3873,7 @@ dependencies = [
"quinn-udp",
"rustc-hash",
"rustls",
"socket2 0.6.3",
"socket2",
"thiserror 2.0.18",
"tokio",
"tracing",
@@ -4115,7 +3886,6 @@ version = "0.11.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
dependencies = [
"aws-lc-rs",
"bytes",
"getrandom 0.3.4",
"lru-slab",
@@ -4140,7 +3910,7 @@ dependencies = [
"cfg_aliases",
"libc",
"once_cell",
"socket2 0.6.3",
"socket2",
"tracing",
"windows-sys 0.60.2",
]
@@ -4428,12 +4198,6 @@ dependencies = [
"regex-syntax",
]
[[package]]
name = "regex-lite"
version = "0.1.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
[[package]]
name = "regex-syntax"
version = "0.8.10"
@@ -4451,7 +4215,7 @@ dependencies = [
"futures-core",
"futures-util",
"h2",
"http 1.4.0",
"http",
"http-body",
"http-body-util",
"hyper",
@@ -4494,7 +4258,7 @@ dependencies = [
"futures-core",
"futures-util",
"h2",
"http 1.4.0",
"http",
"http-body",
"http-body-util",
"hyper",
@@ -4505,7 +4269,6 @@ dependencies = [
"mime",
"percent-encoding",
"pin-project-lite",
"quinn",
"rustls",
"rustls-pki-types",
"rustls-platform-verifier",
@@ -4534,7 +4297,7 @@ checksum = "07bc3f1384cffa4f274dad2d4ddd73aed32fed8f786d96c6be8aa4e5fd3c3b58"
dependencies = [
"anyhow",
"async-trait",
"http 1.4.0",
"http",
"reqwest 0.13.3",
"thiserror 2.0.18",
"tower-service",
@@ -4668,7 +4431,7 @@ version = "0.23.40"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
dependencies = [
"aws-lc-rs",
"log",
"once_cell",
"ring",
"rustls-pki-types",
@@ -4732,7 +4495,6 @@ version = "0.103.13"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
dependencies = [
"aws-lc-rs",
"ring",
"rustls-pki-types",
"untrusted",
@@ -5112,16 +4874,6 @@ dependencies = [
"syn 2.0.117",
]
[[package]]
name = "socket2"
version = "0.5.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
dependencies = [
"libc",
"windows-sys 0.52.0",
]
[[package]]
name = "socket2"
version = "0.6.3"
@@ -5236,7 +4988,6 @@ dependencies = [
"memchr",
"once_cell",
"percent-encoding",
"rustls",
"serde",
"serde_json",
"sha2",
@@ -5247,7 +4998,6 @@ dependencies = [
"tracing",
"url",
"uuid",
"webpki-roots 0.26.11",
]
[[package]]
@@ -5792,10 +5542,9 @@ dependencies = [
"bytes",
"libc",
"mio",
"parking_lot",
"pin-project-lite",
"signal-hook-registry",
"socket2 0.6.3",
"socket2",
"tokio-macros",
"tracing",
"windows-sys 0.61.2",
@@ -5856,7 +5605,7 @@ dependencies = [
"bytes",
"futures-core",
"futures-sink",
"http 1.4.0",
"http",
"httparse",
"rand 0.8.6",
"ring",
@@ -5964,7 +5713,7 @@ dependencies = [
"bytes",
"futures-core",
"futures-util",
"http 1.4.0",
"http",
"http-body",
"http-body-util",
"http-range-header",
@@ -6084,6 +5833,7 @@ dependencies = [
"keyring-core",
"ratatui",
"reqwest 0.13.3",
"rustls",
"serde",
"serde_json",
"thiserror 2.0.18",
@@ -6687,7 +6437,7 @@ version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
dependencies = [
"windows-sys 0.61.2",
"windows-sys 0.48.0",
]
[[package]]

View File

@@ -48,13 +48,13 @@ uuid = { version = "1.23.0", features = ["v4", "v5", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
chrono-tz = "0.10"
sqlx = { version = "0.8.6", features = [
"runtime-tokio-rustls",
"runtime-tokio",
"sqlite",
"uuid",
] }
rand = "0.9"
tempfile = "3"
reqwest = { version = "0.13", features = ["json", "query"] }
reqwest = { version = "0.13", default-features = false, features = ["json", "query", "charset", "http2", "system-proxy", "rustls-no-provider"] }
sha2 = "0.10"
hex = "0.4"
object_store = { version = "0.11", features = ["aws"] }

View File

@@ -5,7 +5,7 @@ edition.workspace = true
[dependencies]
config = { workspace = true }
k-ap = { version = "0.5.0", registry = "gitea" }
k-ap = { version = "0.5.1", registry = "gitea" }
domain = { workspace = true }
axum = { workspace = true }
serde = { workspace = true }

View File

@@ -6,7 +6,7 @@ edition.workspace = true
[dependencies]
sqlx = { workspace = true }
activitypub = { workspace = true }
k-ap = { version = "0.5.0", registry = "gitea" }
k-ap = { version = "0.5.1", registry = "gitea" }
sqlite = { workspace = true }
domain = { workspace = true }
anyhow = { workspace = true }

View File

@@ -37,12 +37,14 @@ tokio = { workspace = true }
futures = { workspace = true }
tracing = { workspace = true }
tracing-subscriber = { workspace = true }
rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
nats = { workspace = true, optional = true }
activitypub = { workspace = true, optional = true }
sqlite-federation = { workspace = true, optional = true }
[dev-dependencies]
reqwest = { workspace = true }
chrono = { workspace = true }
uuid = { workspace = true }
serde_json = { workspace = true }

View File

@@ -13,11 +13,13 @@ mod follow_backfill_handler;
pub mod outbox_relay;
pub mod repositories;
mod server;
mod tls;
mod tracing_setup;
mod worker;
pub use build::build_deps;
pub use repositories::Repositories;
pub use server::{ServerApp, build_server, build_server_on};
pub use tls::install_crypto_provider;
pub use tracing_setup::init_tracing;
pub use worker::{WorkerApp, build_worker, build_worker_on};

View File

@@ -54,6 +54,7 @@ async fn assemble(
db: DatabaseOutput,
instance: InstanceIdentity,
) -> anyhow::Result<axum::Router> {
crate::tls::install_crypto_provider();
let app_config = AppSettings::from(config);
let (auth_service, password_hasher) = database::build_auth_adapters(&config.auth)?;

View File

@@ -0,0 +1,34 @@
//! Process-wide rustls crypto provider.
//!
//! Every HTTPS client in the graph (reqwest, object_store, async-nats,
//! k-ap) is built without a bundled provider so the binaries link `ring`
//! only. rustls therefore needs one installed before the first client is
//! built, or client construction panics.
use std::sync::Once;
/// Installs `ring` as the process default. Idempotent; a provider installed
/// earlier by someone else is left in place.
pub fn install_crypto_provider() {
static INSTALL: Once = Once::new();
INSTALL.call_once(|| {
let _ = rustls::crypto::ring::default_provider().install_default();
});
}
#[cfg(test)]
mod tests {
use super::*;
/// Runs alone in the lib test binary, so no other code (k-ap included)
/// has installed a provider first.
#[test]
fn https_client_builds_after_install() {
install_crypto_provider();
install_crypto_provider();
reqwest::Client::builder()
.build()
.expect("reqwest client builds");
assert!(rustls::crypto::CryptoProvider::get_default().is_some());
}
}

View File

@@ -99,6 +99,7 @@ async fn assemble(
db: DatabaseOutput,
#[cfg_attr(not(feature = "federation"), allow(unused_variables))] instance: InstanceIdentity,
) -> anyhow::Result<WorkerApp> {
crate::tls::install_crypto_provider();
let metadata_client = metadata::create(&config.metadata)?;
let poster_fetcher = poster_fetcher::create(&config.metadata)?;
let object_storage = object_storage::create(&config.storage)?;

View File

@@ -26,6 +26,7 @@ windows-native-keyring-store = { version = "1.0.0", optional = true }
api-types = { workspace = true }
reqwest = { workspace = true }
rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
serde = { workspace = true }
serde_json = { workspace = true }
tokio = { workspace = true }

View File

@@ -46,6 +46,8 @@ pub struct ApiClient {
impl ApiClient {
pub fn new(url: &str) -> Self {
// reqwest is built without a bundled TLS provider; install ring first.
let _ = rustls::crypto::ring::default_provider().install_default();
Self {
base_url: std::sync::RwLock::new(url.to_string()),
http: reqwest::Client::new(),