From cca7acae339acab7a3bc75ca3b00ea8ec4c3ef8b Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Mon, 7 Sep 2026 19:02:06 +0200 Subject: [PATCH 1/4] Revert "reintroduce full rustls dependency in garage_rpc (fix #1526) (#1527)" This reverts commit 229ec977d5b1e0756285d7be9b3dace7da959a04. --- Cargo.lock | 179 -------------------------------------- Cargo.toml | 6 +- src/k2v-client/Cargo.toml | 1 - src/rpc/Cargo.toml | 2 +- 4 files changed, 6 insertions(+), 182 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 75c784ad..a13535f3 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -272,29 +272,6 @@ dependencies = [ "zeroize", ] -[[package]] -name = "aws-lc-rs" -version = "1.18.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e" -dependencies = [ - "aws-lc-sys", - "zeroize", -] - -[[package]] -name = "aws-lc-sys" -version = "0.44.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483" -dependencies = [ - "cc", - "cmake", - "dunce", - "fs_extra", - "pkg-config", -] - [[package]] name = "aws-runtime" version = "1.7.3" @@ -785,17 +762,6 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724" -[[package]] -name = "chacha20" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06" -dependencies = [ - "cfg-if", - "cpufeatures 0.3.0", - "rand_core 0.10.1", -] - [[package]] name = "chrono" version = "0.4.44" @@ -871,15 +837,6 @@ version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" -[[package]] -name = "cmake" -version = "0.1.58" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678" -dependencies = [ - "cc", -] - [[package]] name = "cmov" version = "0.5.3" @@ -1249,12 +1206,6 @@ dependencies = [ "phf", ] -[[package]] -name = "dunce" -version = "1.0.5" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813" - [[package]] name = "dyn-clone" version = "1.0.20" @@ -1448,12 +1399,6 @@ dependencies = [ name = "format_table" version = "0.1.1" -[[package]] -name = "fs_extra" -version = "1.3.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c" - [[package]] name = "fundu" version = "2.0.1" @@ -1999,10 +1944,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0" dependencies = [ "cfg-if", - "js-sys", "libc", "wasi", - "wasm-bindgen", ] [[package]] @@ -2024,13 +1967,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555" dependencies = [ "cfg-if", - "js-sys", "libc", "r-efi 6.0.0", - "rand_core 0.10.1", "wasip2", "wasip3", - "wasm-bindgen", ] [[package]] @@ -2893,7 +2833,6 @@ dependencies = [ "hyper-util", "log", "percent-encoding", - "reqwest", "serde", "serde_json", "sha2 0.10.9", @@ -3150,12 +3089,6 @@ dependencies = [ "hashbrown 0.16.1", ] -[[package]] -name = "lru-slab" -version = "0.1.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" - [[package]] name = "lsm-tree" version = "2.10.4" @@ -3912,63 +3845,6 @@ dependencies = [ "hashbrown 0.16.1", ] -[[package]] -name = "quinn" -version = "0.11.11" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8" -dependencies = [ - "bytes", - "cfg_aliases 0.2.1", - "pin-project-lite", - "quinn-proto", - "quinn-udp", - "rustc-hash", - "rustls 0.23.39", - "socket2 0.5.10", - "thiserror 2.0.18", - "tokio", - "tracing", - "web-time", -] - -[[package]] -name = "quinn-proto" -version = "0.11.17" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "04759210543be93709136e28212294a659ef5001836ff4eab4d663e4529bba83" -dependencies = [ - "aws-lc-rs", - "bytes", - "getrandom 0.4.2", - "lru-slab", - "rand 0.10.2", - "rand_pcg", - "ring", - "rustc-hash", - "rustls 0.23.39", - "rustls-pki-types", - "slab", - "thiserror 2.0.18", - "tinyvec", - "tracing", - "web-time", -] - -[[package]] -name = "quinn-udp" -version = "0.5.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "35a133f956daabe89a61a685c2649f13d82d5aa4bd5d12d1277e1072a21c0694" -dependencies = [ - "cfg_aliases 0.2.1", - "libc", - "once_cell", - "socket2 0.5.10", - "tracing", - "windows-sys 0.52.0", -] - [[package]] name = "quote" version = "1.0.45" @@ -4033,17 +3909,6 @@ dependencies = [ "rand_core 0.9.5", ] -[[package]] -name = "rand" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80" -dependencies = [ - "chacha20", - "getrandom 0.4.2", - "rand_core 0.10.1", -] - [[package]] name = "rand_chacha" version = "0.3.1" @@ -4082,21 +3947,6 @@ dependencies = [ "getrandom 0.3.4", ] -[[package]] -name = "rand_core" -version = "0.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69" - -[[package]] -name = "rand_pcg" -version = "0.10.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a" -dependencies = [ - "rand_core 0.10.1", -] - [[package]] name = "redox_syscall" version = "0.5.18" @@ -4180,7 +4030,6 @@ dependencies = [ "log", "percent-encoding", "pin-project-lite", - "quinn", "rustls 0.23.39", "rustls-pki-types", "rustls-platform-verifier", @@ -4330,7 +4179,6 @@ version = "0.23.39" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c2c118cb077cca2822033836dfb1b975355dfb784b5e8da48f7b6c5db74e60e" dependencies = [ - "aws-lc-rs", "log", "once_cell", "ring", @@ -4358,7 +4206,6 @@ version = "1.14.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd" dependencies = [ - "web-time", "zeroize", ] @@ -4405,7 +4252,6 @@ version = "0.103.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" dependencies = [ - "aws-lc-rs", "ring", "rustls-pki-types", "untrusted", @@ -5047,21 +4893,6 @@ dependencies = [ "zerovec", ] -[[package]] -name = "tinyvec" -version = "1.10.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa" -dependencies = [ - "tinyvec_macros", -] - -[[package]] -name = "tinyvec_macros" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20" - [[package]] name = "tokio" version = "1.52.1" @@ -5703,16 +5534,6 @@ dependencies = [ "wasm-bindgen", ] -[[package]] -name = "web-time" -version = "1.1.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb" -dependencies = [ - "js-sys", - "wasm-bindgen", -] - [[package]] name = "webpki-root-certs" version = "1.0.7" diff --git a/Cargo.toml b/Cargo.toml index 75306e4f..740e4db7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -117,7 +117,11 @@ kube = { version = "3.0", default-features = false, features = [ "rustls-tls", ] } schemars = "1.2" -reqwest = { version = "0.13", default-features = false } +reqwest = { version = "0.13", default-features = false, features = [ + "rustls-no-provider", + "json", +] } + form_urlencoded = "1.2" http = "1.4" httpdate = "1.0" diff --git a/src/k2v-client/Cargo.toml b/src/k2v-client/Cargo.toml index 9f02c2ef..00e7606e 100644 --- a/src/k2v-client/Cargo.toml +++ b/src/k2v-client/Cargo.toml @@ -24,7 +24,6 @@ percent-encoding.workspace = true hyper = { workspace = true, default-features = false, features = ["http1", "http2"] } hyper-util.workspace = true hyper-rustls.workspace = true -reqwest = { workspace = true, default-features = false, features = ["json", "rustls-no-provider"] } serde = { workspace = true, default-features = false, features = ["derive", "std"] } serde_json.workspace = true thiserror.workspace = true diff --git a/src/rpc/Cargo.toml b/src/rpc/Cargo.toml index 8e2ee0c7..e8e8e4b6 100644 --- a/src/rpc/Cargo.toml +++ b/src/rpc/Cargo.toml @@ -40,7 +40,7 @@ thiserror = { workspace = true, optional = true } kube = { workspace = true, optional = true } k8s-openapi = { workspace = true, optional = true } schemars = { workspace = true, optional = true } -reqwest = { workspace = true, optional = true, features = ["json", "rustls"] } +reqwest = { workspace = true, optional = true } pnet_datalink.workspace = true From 3dbcad9ddaf08de9d284e170c41fe895c8c7f96f Mon Sep 17 00:00:00 2001 From: Matt Moriarity Date: Tue, 9 Jun 2026 22:02:43 -0600 Subject: [PATCH 2/4] set rustls crypto provider when using consul discovery --- Cargo.lock | 4 ++++ Cargo.toml | 1 + src/rpc/Cargo.toml | 6 +++++- src/rpc/consul.rs | 1 + 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/Cargo.lock b/Cargo.lock index a13535f3..3eba5b8e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1821,6 +1821,9 @@ dependencies = [ "garage_util", "gethostname", "hex", + "hyper 1.9.0", + "hyper-rustls 0.27.9", + "hyper-util", "ipnet", "itertools 0.14.0", "k8s-openapi", @@ -1831,6 +1834,7 @@ dependencies = [ "pnet_datalink", "rand 0.9.4", "reqwest", + "rustls 0.23.39", "schemars", "serde", "serde_bytes", diff --git a/Cargo.toml b/Cargo.toml index 740e4db7..3d0a25eb 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -121,6 +121,7 @@ reqwest = { version = "0.13", default-features = false, features = [ "rustls-no-provider", "json", ] } +rustls = { version = "0.23", default-features = false, features = ["std", "ring"] } form_urlencoded = "1.2" http = "1.4" diff --git a/src/rpc/Cargo.toml b/src/rpc/Cargo.toml index e8e8e4b6..2e7d4bd3 100644 --- a/src/rpc/Cargo.toml +++ b/src/rpc/Cargo.toml @@ -41,6 +41,10 @@ kube = { workspace = true, optional = true } k8s-openapi = { workspace = true, optional = true } schemars = { workspace = true, optional = true } reqwest = { workspace = true, optional = true } +hyper = { workspace = true, optional = true } +hyper-rustls = { workspace = true, optional = true } +hyper-util = { workspace = true, optional = true } +rustls = { workspace = true, optional = true } pnet_datalink.workspace = true @@ -50,7 +54,7 @@ opentelemetry.workspace = true [features] kubernetes-discovery = ["kube", "k8s-openapi", "schemars"] -consul-discovery = ["reqwest", "thiserror"] +consul-discovery = ["hyper", "hyper-rustls", "hyper-util", "reqwest", "rustls", "thiserror"] system-libs = ["sodiumoxide/use-pkg-config"] [lints] diff --git a/src/rpc/consul.rs b/src/rpc/consul.rs index dea49995..53e92f42 100644 --- a/src/rpc/consul.rs +++ b/src/rpc/consul.rs @@ -80,6 +80,7 @@ pub struct ConsulDiscovery { impl ConsulDiscovery { pub fn new(config: ConsulDiscoveryConfig) -> Result { + _ = rustls::crypto::ring::default_provider().install_default(); let mut builder: reqwest::ClientBuilder = reqwest::Client::builder().use_rustls_tls(); if config.tls_skip_verify { builder = builder.danger_accept_invalid_certs(true); From ae29f7f73f7d58c3f23f528c19d574707fa65eae Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Mon, 7 Sep 2026 19:16:10 +0200 Subject: [PATCH 3/4] k2v-client: use ring tls provider --- Cargo.lock | 1 + src/k2v-client/Cargo.toml | 1 + src/k2v-client/lib.rs | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Cargo.lock b/Cargo.lock index 3eba5b8e..85138a85 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2837,6 +2837,7 @@ dependencies = [ "hyper-util", "log", "percent-encoding", + "rustls 0.23.39", "serde", "serde_json", "sha2 0.10.9", diff --git a/src/k2v-client/Cargo.toml b/src/k2v-client/Cargo.toml index 00e7606e..423ed7eb 100644 --- a/src/k2v-client/Cargo.toml +++ b/src/k2v-client/Cargo.toml @@ -24,6 +24,7 @@ percent-encoding.workspace = true hyper = { workspace = true, default-features = false, features = ["http1", "http2"] } hyper-util.workspace = true hyper-rustls.workspace = true +rustls.workspace = true serde = { workspace = true, default-features = false, features = ["derive", "std"] } serde_json.workspace = true thiserror.workspace = true diff --git a/src/k2v-client/lib.rs b/src/k2v-client/lib.rs index c4c2ef65..21b1e15b 100644 --- a/src/k2v-client/lib.rs +++ b/src/k2v-client/lib.rs @@ -72,7 +72,7 @@ impl K2vClient { /// Create a new K2V client. pub fn new(config: K2vClientConfig) -> Result { let connector = hyper_rustls::HttpsConnectorBuilder::new() - .with_native_roots()? + .with_provider_and_native_roots(rustls::crypto::ring::default_provider())? .https_or_http() .enable_http1() .enable_http2() From c22b7499b8cd84c661a5f71232eec8e9c15104d2 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Mon, 7 Sep 2026 19:34:22 +0200 Subject: [PATCH 4/4] kubernetes discovery: install ring crypto provider if missing --- src/rpc/consul.rs | 5 ++++- src/rpc/kubernetes.rs | 13 ++++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/rpc/consul.rs b/src/rpc/consul.rs index 53e92f42..cf5ae2dd 100644 --- a/src/rpc/consul.rs +++ b/src/rpc/consul.rs @@ -80,7 +80,10 @@ pub struct ConsulDiscovery { impl ConsulDiscovery { pub fn new(config: ConsulDiscoveryConfig) -> Result { - _ = rustls::crypto::ring::default_provider().install_default(); + if rustls::crypto::CryptoProvider::get_default().is_none() { + _ = rustls::crypto::ring::default_provider().install_default(); + } + let mut builder: reqwest::ClientBuilder = reqwest::Client::builder().use_rustls_tls(); if config.tls_skip_verify { builder = builder.danger_accept_invalid_certs(true); diff --git a/src/rpc/kubernetes.rs b/src/rpc/kubernetes.rs index f15afae0..75856fc5 100644 --- a/src/rpc/kubernetes.rs +++ b/src/rpc/kubernetes.rs @@ -29,8 +29,15 @@ pub struct Node { port: u16, } +pub async fn get_client() -> Result { + if rustls::crypto::CryptoProvider::get_default().is_none() { + _ = rustls::crypto::ring::default_provider().install_default(); + } + Client::try_default().await +} + pub async fn create_kubernetes_crd() -> Result<(), kube::Error> { - let client = Client::try_default().await?; + let client = get_client().await?; let crds: Api = Api::all(client.clone()); let params = PatchParams::apply(&format!("garage.{}", K8S_GROUP)); @@ -45,7 +52,7 @@ pub async fn create_kubernetes_crd() -> Result<(), kube::Error> { pub async fn get_kubernetes_nodes( kubernetes_config: &KubernetesDiscoveryConfig, ) -> Result, kube::Error> { - let client = Client::try_default().await?; + let client = get_client().await?; let nodes: Api = Api::namespaced(client.clone(), &kubernetes_config.namespace); let lp = ListParams::default().labels(&format!( @@ -98,7 +105,7 @@ pub async fn publish_kubernetes_node( debug!("Node object to be applied: {:#?}", node); - let client = Client::try_default().await?; + let client = get_client().await?; let nodes: Api = Api::namespaced(client.clone(), &kubernetes_config.namespace); if let Ok(old_node) = nodes.get(&node_pubkey).await {