remove openssl dependency by drahnr · Pull Request #2325 · mozilla/sccache

drahnr · 2025-02-04T18:43:39Z

Continuation of #1742

OpenSSL is a hinderance of both building and distribution, and has been superseeded by rustls and boringssl as safer and alternatives with sufficient subsets for sccache. We hance should not rely on a dependency when there are easier in alternatives.

Particularly difficult use cases when linking against OpenSSL:

version mismatches
static linkage
cross compilation
certificate store configuration

sylvestre · 2025-02-04T19:03:22Z

In the commit, it would be nice to explicit why we want to remove it :)
Thanks for restarting this

drahnr · 2025-02-05T12:27:22Z

Done

drahnr · 2025-02-05T13:21:55Z

The issue is somewhere in the delta:

# openssl
[
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 17] }), critical: Implicit(false), extn_value: SubjectAltName(OctetStringAsn1Container(Asn1SequenceOf([IpAddress(OctetStringAsn1([127, 0, 0, 1]))]))) },
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 37] }), critical: Implicit(false), extn_value: ExtendedKeyUsage(OctetStringAsn1Container(ExtendedKeyUsage(Asn1SequenceOf([ObjectIdentifierAsn1(ObjectIdentifier { root: Iso, first_node: 3, child_nodes: [6, 1, 5, 5, 7, 3, 1] })])))) }
]
 
# picky
[
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 17] }), critical: Implicit(true), extn_value: SubjectAltName(OctetStringAsn1Container(Asn1SequenceOf([IpAddress(OctetStringAsn1([127, 0, 0, 1]))]))) }
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 37] }), critical: Implicit(true), extn_value: ExtendedKeyUsage(OctetStringAsn1Container(ExtendedKeyUsage(Asn1SequenceOf([ObjectIdentifierAsn1(ObjectIdentifier { root: Iso, first_node: 3, child_nodes: [6, 1, 5, 5, 7, 3, 1] })])))) }
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 19] }), critical: Implicit(false), extn_value: BasicConstraints(OctetStringAsn1Container(BasicConstraints { ca: Implicit(Some(false)), path_len_constraint: Implicit(None) })) }
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 35] }), critical: Implicit(false), extn_value: AuthorityKeyIdentifier(OctetStringAsn1Container(AuthorityKeyIdentifier { key_identifier: Some(ContextTag0(OctetStringAsn1([53, 4, 192, 142, 244, 179, 95, 190, 50, 190, 70, 215, 188, 117, 9, 37, 50, 147, 131, 167, 10, 120, 7, 227, 65, 73, 228, 209, 66, 145, 160, 107]))), authority_cert_issuer: None, authority_cert_serial_number: None })) }
Extension { extn_id: ObjectIdentifierAsn1(ObjectIdentifier { root: JointIsoItuT, first_node: 5, child_nodes: [29, 14] }), critical: Implicit(false), extn_value: SubjectKeyIdentifier(OctetStringAsn1Container(OctetStringAsn1([53, 4, 192, 142, 244, 179, 95, 190, 50, 190, 70, 215, 188, 117, 9, 37, 50, 147, 131, 167, 10, 120, 7, 227, 65, 73, 228, 209, 66, 145, 160, 107]))) }
]

The basic fields differ in Implicit(true) and Implicit(false), but picky adds 3 extra attributes in CertificateBuilder::build extra extended fields and I have yet to read the spec on it

Cargo.toml

drahnr · 2025-02-10T08:52:32Z

The remaining issues originate from briansmith/ring#1167 (comment) and will be mitigated once hickory-dns gets a 0.25.0 release hickory-dns/hickory-dns#2206

drahnr · 2025-02-19T10:52:11Z

hickory-dns 0.24.4 got released

AJIOB · 2025-02-25T08:22:28Z

src/compiler/c.rs

            .map(|f| {
                f.flatten()
-                    .filter(|f| f.path().extension().map_or(false, |ext| ext == "bc"))
+                    .filter(|f| f.path().extension().is_some_and(|ext| ext == "bc"))


What about migrating OpenSSL-unrelated changes to the dedicated PR?
I don't think that changes breaks CI, but this split will minify change set, that is related to failure.

drahnr · 2025-02-25T09:40:57Z

I cannot reproduce test_dist_restartedserver issues CI is encountering. I've seen over PRs where re-trying the CI ultimately succeeded.

drahnr · 2025-03-05T08:44:25Z

I can occassionally repro the issue locally

codecov-commenter · 2025-05-09T12:14:17Z

Codecov Report

Attention: Patch coverage is 0% with 107 lines in your changes missing coverage. Please review.

Project coverage is 67.07%. Comparing base (f162d6e) to head (67b074d).
Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/dist/http.rs	0.00%	89 Missing ⚠️
src/util.rs	0.00%	11 Missing ⚠️
src/bin/sccache-dist/token_check.rs	0.00%	7 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2325      +/-   ##
==========================================
- Coverage   71.42%   67.07%   -4.35%     
==========================================
  Files          65       64       -1     
  Lines       36360    35230    -1130     
==========================================
- Hits        25970    23632    -2338     
- Misses      10390    11598    +1208

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

- Bump rouille from 3.5 => 3.6.2 rouille v3.6.2 fixed a bug: `rouille::Server::new_ssl` is now exposed when only `rustls` is enabled. - Disable default features of `reqwest` which pulls in openssl - Remove `openssl` pulled in `[dev-dependencies]` - Bump reqwest from 0.11.17 => 0.11.18 Signed-off-by: Jiahao XU <[email protected]>

Signed-off-by: Jiahao XU <[email protected]>

Use CRLF on windows and `\n` on Linux. Also fix formatting of `Cargo.toml` Signed-off-by: Jiahao XU <[email protected]>

Signed-off-by: Jiahao XU <[email protected]>

…ns do not contain sha1 support by default

Uses `ring >= 0.7.0` which contains a fix for win on aarch64

It will never work with `picky`, the `openssl` generated certs were invalid in the first place.

Simplifies CI

…aemon

drahnr changed the title ~~remove openssl~~ remove openssl dependency Feb 4, 2025

drahnr force-pushed the bernhard-remove-openssl branch from 0f3f94f to bca3500 Compare February 5, 2025 12:46

AJIOB reviewed Feb 6, 2025

View reviewed changes

Cargo.toml Outdated Show resolved Hide resolved

drahnr force-pushed the bernhard-remove-openssl branch from c39828a to bee63dc Compare February 9, 2025 18:40

drahnr mentioned this pull request Feb 10, 2025

[0.24] bump ring to 0.17.8 hickory-dns/hickory-dns#2759

Merged

drahnr force-pushed the bernhard-remove-openssl branch from 9518a7e to 6777c63 Compare February 19, 2025 10:47

drahnr force-pushed the bernhard-remove-openssl branch from 2d6e57e to 6ed6bee Compare February 25, 2025 08:12

AJIOB reviewed Feb 25, 2025

View reviewed changes

drahnr mentioned this pull request Feb 25, 2025

Apply clippy fixes and bump ghac from v2 to v4 bump #2341

Merged

drahnr force-pushed the bernhard-remove-openssl branch from 238343b to 40f3eac Compare March 3, 2025 13:49

drahnr force-pushed the bernhard-remove-openssl branch 2 times, most recently from 91efbbf to c8811ad Compare May 9, 2025 12:10

drahnr and others added 10 commits May 12, 2025 13:38

dep: Upgrade trust-dns-resolver v0.22 to hickory-resolver v0.24

3b0f25f

Signed-off-by: Jiahao XU <[email protected]>

Fix line ending of dynamic key generated

2d897e3

Use CRLF on windows and `\n` on Linux. Also fix formatting of `Cargo.toml` Signed-off-by: Jiahao XU <[email protected]>

Fix typo: Default() => default()

2f9fe61

Signed-off-by: Jiahao XU <[email protected]>

fix: toml formating

cb7bc92

add certificate equiv test, move to sha256, newer openssl distributio…

19bca7c

…ns do not contain sha1 support by default

clippy

22af95c

fmt again

c98e77d

remvoe flipper RNG + guard test module to dist-{client,server}

de58e2b

don't add mask to ip address authority

b7b7f8a

drahnr added 10 commits May 12, 2025 13:38

use vendored openssl for tests

3372ad6

toml fmt

aa2961c

clippy was wrong

edfdad0

dep: force hickory-dns >= 0.24.4 or higher

4a59140

Uses `ring >= 0.7.0` which contains a fix for win on aarch64

ignore openssl cert congruence test

0e13198

It will never work with `picky`, the `openssl` generated certs were invalid in the first place.

fmt

34225ce

lock

4a2107e

remove openssl integrity test, we can't ensure it

da7945a

Simplifies CI

ensure dist tests are run serially and don't kill each others local d…

c8c914d

…aemon

lock

70fac0a

drahnr force-pushed the bernhard-remove-openssl branch from c8811ad to 70fac0a Compare May 12, 2025 11:40

drahnr added 2 commits May 13, 2025 10:33

lock again

c5791ed

fix/ci: grcov should be installed with locked to avoid unstable features

67b074d

tottoto added a commit to tottoto/sccache that referenced this pull request Feb 6, 2026

chore(test): Use tempfile crate to handle temporary file (mozilla#2325)

23d136e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

remove openssl dependency#2325

remove openssl dependency#2325
drahnr wants to merge 22 commits intomainfrom
bernhard-remove-openssl

drahnr commented Feb 4, 2025 •

edited

Loading

Uh oh!

sylvestre commented Feb 4, 2025

Uh oh!

drahnr commented Feb 5, 2025

Uh oh!

drahnr commented Feb 5, 2025

Uh oh!

Uh oh!

drahnr commented Feb 10, 2025

Uh oh!

drahnr commented Feb 19, 2025

Uh oh!

AJIOB Feb 25, 2025

Uh oh!

drahnr Feb 25, 2025

Uh oh!

drahnr commented Feb 25, 2025

Uh oh!

drahnr commented Mar 5, 2025

Uh oh!

codecov-commenter commented May 9, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

Conversation

drahnr commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sylvestre commented Feb 4, 2025

Uh oh!

drahnr commented Feb 5, 2025

Uh oh!

drahnr commented Feb 5, 2025

Uh oh!

Uh oh!

drahnr commented Feb 10, 2025

Uh oh!

drahnr commented Feb 19, 2025

Uh oh!

AJIOB Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

drahnr Feb 25, 2025

Choose a reason for hiding this comment

Uh oh!

drahnr commented Feb 25, 2025

Uh oh!

drahnr commented Mar 5, 2025

Uh oh!

codecov-commenter commented May 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

drahnr commented Feb 4, 2025 •

edited

Loading

codecov-commenter commented May 9, 2025 •

edited

Loading