Skip to content

Conversation

xyzzyz
Copy link

@xyzzyz xyzzyz commented Oct 2, 2025

This changes allows you to select which algorithms are supported using Cargo features. By default, the newly added features are all selected, so there should be no functional/API changes.

The motivating factor was that I wanted to use rustls-webpki crate for X.509 Certificate Path Validation algorithm in a context other than TLS. For that, I don't need any of the AES/ChaCha20 etc support, and I don't want to pull these libraries into my SBOM.

In addition, to support the above, the change also exposes SignatureVerificationAlgorithms from verify::{rsa,ecdsa,eddsa} modules through public API.

One change I made was to remove SignatureScheme::ECDSA_NISTP521_SHA512 from TLS12_ECDSA_SCHEMES list: this is not actually supported by this provider, and correct me if I'm wrong, but I think it got there by mistake.

Two questions:

  • Should I squash, or do you squash on PR merge?
  • When some features are not selected (e.g. when no symmetric cipher is selected, so that the library can only be used for signature verification, or when no key exchange algorithms are selected), the compiler generates some "unused import" warnings. There is a number of ways of dealing with these: 1) ignoring them 2) silencing them on a module level, 3) using fully qualified names as needed, and 4) adding extra #[cfg(...)] to remove them. I currently went with 1), because 2) is bad, 3) makes the code unreadable because almost all of the symbols need to be qualified, and 4) requires a lot of extra cfg flags. Please let me know if you'd like me to implement 3 or 4.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant