From c9e1ec8e5bf55bcd52e356e82a6f1b0e4471010b Mon Sep 17 00:00:00 2001 From: jadamcrain Date: Wed, 21 Oct 2026 13:25:39 -0700 Subject: [PATCH 1/3] Remove a debug println from the server's client certificate verifier The authority-based client verifier printed its result to stdout on every handshake. Bump to 0.4.1. --- CHANGELOG.md | 3 +++ lib/Cargo.toml | 2 +- lib/src/server.rs | 8 ++------ 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c94358d..d292bed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,6 @@ +# 0.4.1 +* :bug: Remove a debug `println!` that wrote the client certificate verification result to stdout on every handshake of a server using authority-based client verification. + # 0.4.0 * :wrench: Make `ring` or `aws-lc-rs` configurable via features diff --git a/lib/Cargo.toml b/lib/Cargo.toml index fe64e9f..8156d2f 100644 --- a/lib/Cargo.toml +++ b/lib/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sfio-rustls-config" -version = "0.4.0" +version = "0.4.1" license = "MIT OR Apache-2.0" edition = "2021" description = "Configuration routines for Rustls used in libraries from Step Function I/O" diff --git a/lib/src/server.rs b/lib/src/server.rs index 5b9be07..a59749c 100644 --- a/lib/src/server.rs +++ b/lib/src/server.rs @@ -121,7 +121,7 @@ impl ClientCertVerifier for ClientNameVerifier { .base_verifier .verify_client_cert(end_entity, intermediates, now)?; - let res = match &self.verification { + match &self.verification { ClientNameVerification::None => { // we're done Ok(verified) @@ -130,11 +130,7 @@ impl ClientCertVerifier for ClientNameVerifier { ClientNameVerification::SanOrCommonName(x) => { self.verify_client_name(end_entity, x, true) } - }; - - println!("client result: {res:?}"); - - res + } } fn verify_tls12_signature( From 7dc67afc5bde4dd2788464c2c6455c9b29f8b344 Mon Sep 17 00:00:00 2001 From: jadamcrain Date: Wed, 21 Oct 2026 13:40:04 -0700 Subject: [PATCH 2/3] Add CI and trusted publishing, deny prints and panics, fix rust-version CI checks formatting, clippy and tests with each crypto provider, the verifier tests, the declared rust-version and cargo audit. A release workflow publishes a version tag to crates.io with trusted publishing. The crate denies printing and panicking constructs, declares the rust-version its dependencies need, and builds docs.rs with ring. --- .github/workflows/ci.yml | 68 +++++++++++++++++++++++++++++++++++ .github/workflows/release.yml | 36 +++++++++++++++++++ CHANGELOG.md | 2 ++ clippy.toml | 4 +++ lib/Cargo.toml | 19 ++++++++-- 5 files changed, 127 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/release.yml create mode 100644 clippy.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..e2cb6fa --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,68 @@ +name: CI +on: + pull_request: + push: + branches: [main] +permissions: + contents: read +jobs: + # Format, lint and test the library with each crypto provider + check: + strategy: + fail-fast: false + matrix: + provider: [crypto-ring, crypto-aws-lc] + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + with: + components: rustfmt, clippy + - name: Format + run: cargo fmt --all -- --check + - name: Clippy + run: cargo clippy -p sfio-rustls-config --all-targets --features ${{ matrix.provider }} -- -D warnings + - name: Test + run: cargo test -p sfio-rustls-config --features ${{ matrix.provider }} + # The verifier tests in the tests crate, which use aws-lc + integration: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + with: + components: clippy + - name: Clippy + run: cargo clippy -p tests --all-targets -- -D warnings + - name: Test + run: cargo test -p tests + # Build with the rust-version declared in lib/Cargo.toml + msrv: + strategy: + fail-fast: false + matrix: + provider: [crypto-ring, crypto-aws-lc] + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Install Rust 1.85 + uses: dtolnay/rust-toolchain@1.85 + - name: Check + run: cargo check -p sfio-rustls-config --features ${{ matrix.provider }} + # Fail on any advisory against the dependencies + audit: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + - name: Install cargo-audit + run: cargo install cargo-audit --locked + - name: Audit + run: cargo generate-lockfile && cargo audit diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..499a9d2 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,36 @@ +name: Release +# Pushing a tag equal to the crate version (e.g. 0.4.1) publishes it to crates.io using trusted +# publishing: crates.io trusts this workflow, so no API token is stored in the repository +on: + push: + tags: ["*"] +permissions: + contents: read +jobs: + publish: + runs-on: ubuntu-latest + environment: crates-io + permissions: + contents: read + id-token: write + steps: + - name: Checkout + uses: actions/checkout@v6 + - name: Install Rust + uses: dtolnay/rust-toolchain@stable + - name: Check the tag matches the crate version + run: | + version=$(cargo metadata --no-deps --format-version 1 | jq -r '.packages[] | select(.name == "sfio-rustls-config") | .version') + if [ "$version" != "$GITHUB_REF_NAME" ]; then + echo "tag $GITHUB_REF_NAME doesn't match the crate version $version" + exit 1 + fi + - name: Test + run: cargo test -p sfio-rustls-config --features crypto-ring + - name: Authenticate with crates.io + id: auth + uses: rust-lang/crates-io-auth-action@v1 + - name: Publish + run: cargo publish -p sfio-rustls-config --features crypto-ring + env: + CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} diff --git a/CHANGELOG.md b/CHANGELOG.md index d292bed..f246ffa 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,7 @@ # 0.4.1 * :bug: Remove a debug `println!` that wrote the client certificate verification result to stdout on every handshake of a server using authority-based client verification. +* :wrench: Set `rust-version` to 1.85, the minimum the current dependencies require. +* :wrench: Build the docs.rs documentation with the `crypto-ring` provider, since the crate requires one. # 0.4.0 * :wrench: Make `ring` or `aws-lc-rs` configurable via features diff --git a/clippy.toml b/clippy.toml new file mode 100644 index 0000000..4b6c79f --- /dev/null +++ b/clippy.toml @@ -0,0 +1,4 @@ +allow-unwrap-in-tests = true +allow-expect-in-tests = true +allow-panic-in-tests = true +allow-indexing-slicing-in-tests = true diff --git a/lib/Cargo.toml b/lib/Cargo.toml index 8156d2f..7533d4e 100644 --- a/lib/Cargo.toml +++ b/lib/Cargo.toml @@ -7,7 +7,7 @@ description = "Configuration routines for Rustls used in libraries from Step Fun repository = "https://github.com/stepfunc/rustls-config" readme = "README.md" authors = ["Step Function I/O LLC "] -rust-version = "1.74" +rust-version = "1.85" [dependencies] pem = { version = "^3.0" } @@ -17,6 +17,10 @@ rustls = { version = "0.23", default-features = false, features = ["std", "loggi rustls-pki-types = { version = "1.11.0" } rustls-webpki = { version = "0.103.1", default-features = false, features = ["std"] } +[package.metadata.docs.rs] +# the crate requires exactly one crypto provider +features = ["crypto-ring"] + [features] default = [] crypto-ring = ["rustls/ring", "rustls-webpki/ring"] @@ -34,7 +38,18 @@ unused_crate_dependencies = "deny" missing_copy_implementations = "deny" [lints.clippy] -all = "deny" +all = { level = "deny", priority = -1 } +# no output except through the caller, and no panics in library code; clippy.toml allows +# unwrap, expect, panic and indexing in tests +print_stdout = "deny" +print_stderr = "deny" +dbg_macro = "deny" +unwrap_used = "deny" +expect_used = "deny" +panic = "deny" +indexing_slicing = "deny" +arithmetic_side_effects = "deny" +as_conversions = "deny" [lints.rustdoc] broken_intra_doc_links = "deny" \ No newline at end of file From 8e78be771aba63285648072b718ba53961580689 Mon Sep 17 00:00:00 2001 From: jadamcrain Date: Wed, 21 Oct 2026 13:41:57 -0700 Subject: [PATCH 3/3] Run the release through full CI, test both providers, document usage The release workflow runs the CI workflow on the tagged commit before publishing. The verifier tests run with each crypto provider, and the README says how to select one and the minimum Rust version. --- .github/workflows/ci.yml | 12 +++++++++--- .github/workflows/release.yml | 6 ++++-- CHANGELOG.md | 1 + lib/README.md | 13 ++++++++++++- tests/Cargo.toml | 10 ++++++++-- 5 files changed, 34 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e2cb6fa..4aafe85 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,6 +3,8 @@ on: pull_request: push: branches: [main] + # release.yml runs this on the tagged commit before publishing + workflow_call: permissions: contents: read jobs: @@ -26,8 +28,12 @@ jobs: run: cargo clippy -p sfio-rustls-config --all-targets --features ${{ matrix.provider }} -- -D warnings - name: Test run: cargo test -p sfio-rustls-config --features ${{ matrix.provider }} - # The verifier tests in the tests crate, which use aws-lc + # The verifier tests in the tests crate, with each crypto provider integration: + strategy: + fail-fast: false + matrix: + provider: [crypto-ring, crypto-aws-lc] runs-on: ubuntu-latest steps: - name: Checkout @@ -37,9 +43,9 @@ jobs: with: components: clippy - name: Clippy - run: cargo clippy -p tests --all-targets -- -D warnings + run: cargo clippy -p tests --all-targets --no-default-features --features ${{ matrix.provider }} -- -D warnings - name: Test - run: cargo test -p tests + run: cargo test -p tests --no-default-features --features ${{ matrix.provider }} # Build with the rust-version declared in lib/Cargo.toml msrv: strategy: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 499a9d2..f91ecf7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,11 @@ on: permissions: contents: read jobs: + # every CI check must pass on the tagged commit + ci: + uses: ./.github/workflows/ci.yml publish: + needs: ci runs-on: ubuntu-latest environment: crates-io permissions: @@ -25,8 +29,6 @@ jobs: echo "tag $GITHUB_REF_NAME doesn't match the crate version $version" exit 1 fi - - name: Test - run: cargo test -p sfio-rustls-config --features crypto-ring - name: Authenticate with crates.io id: auth uses: rust-lang/crates-io-auth-action@v1 diff --git a/CHANGELOG.md b/CHANGELOG.md index f246ffa..34049a1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ * :bug: Remove a debug `println!` that wrote the client certificate verification result to stdout on every handshake of a server using authority-based client verification. * :wrench: Set `rust-version` to 1.85, the minimum the current dependencies require. * :wrench: Build the docs.rs documentation with the `crypto-ring` provider, since the crate requires one. +* :wrench: Run CI on every change, and publish releases from CI with crates.io trusted publishing. # 0.4.0 * :wrench: Make `ring` or `aws-lc-rs` configurable via features diff --git a/lib/README.md b/lib/README.md index c092e86..d5dd48c 100644 --- a/lib/README.md +++ b/lib/README.md @@ -1,4 +1,15 @@ # Description Configuration routines for [rustls](https://github.com/rustls/rustls) used by Step Function's commercial [DNP3](https://github.com/stepfunc/dnp3) -and [Modbus](https://github.com/stepfunc/rodbus) libraries. \ No newline at end of file +and [Modbus](https://github.com/stepfunc/rodbus) libraries. + +# Usage + +Enable exactly one crypto provider, `crypto-ring` or `crypto-aws-lc`: + +```toml +[dependencies] +sfio-rustls-config = { version = "0.4", features = ["crypto-ring"] } +``` + +Requires Rust 1.85 or later. \ No newline at end of file diff --git a/tests/Cargo.toml b/tests/Cargo.toml index b0c0033..548e4fa 100644 --- a/tests/Cargo.toml +++ b/tests/Cargo.toml @@ -5,10 +5,16 @@ edition = "2021" publish = false [dependencies] -sfio-rustls-config = { path = "../lib", default-features = false, features = ["crypto-aws-lc"] } -tokio-rustls = { version = "0.26", default-features = false, features = ["aws-lc-rs"] } +sfio-rustls-config = { path = "../lib", default-features = false } +tokio-rustls = { version = "0.26", default-features = false } tokio = { version = "1.44", features = ["test-util", "net", "rt", "macros"] } +# exactly one provider, as for the library +[features] +default = ["crypto-aws-lc"] +crypto-aws-lc = ["sfio-rustls-config/crypto-aws-lc", "tokio-rustls/aws-lc-rs"] +crypto-ring = ["sfio-rustls-config/crypto-ring", "tokio-rustls/ring"] + [[test]] name = "test_verifiers" path = "src/test_verifiers.rs"