Repository navigation
ci: build the release tarballs with rustls - #38
Merged
Merged
Conversation
BKPepe
force-pushed
the
release-rustls
branch
3 times, most recently
from
November 5, 2026 19:35
b21c71e to
b1e02b9
Compare
The tarballs compiled in OpenSSL through openssl-src, which is stuck on 3.6.3 because openssl-sys only accepts its 300.x series. OpenSSL lists 24 CVEs fixed since, and the advisory databases this project scans do not cover them. rustls is the default feature, static as well, and the aarch64 binary goes from 6.67 MB to 3.15 MB. vendored-openssl goes. OpenWrt keeps linking its own libopenssl. A tag now also stops on a known advisory in its lock file, because advisories in rustls reach the tarballs from now on. CI starts each cross-built binary with --help under the QEMU runner of its image, without network, and the cross job gets a cache per matrix entry, because entries restoring each other's build fail with E0463.
BKPepe
force-pushed
the
release-rustls
branch
from
November 5, 2026 19:56
b1e02b9 to
492bbe0
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The tarballs compiled in OpenSSL through
openssl-src, which is stuck on 3.6.3 becauseopenssl-sysonly accepts its 300.x series. OpenSSL lists 24 CVEs fixed since, and the advisory databases this project scans do not cover them.Tarballs now use rustls, the default feature. They stay static and the aarch64 one goes from 6.67 MB to 3.15 MB.
vendored-opensslgoes away, and--features native-tls,native-tls/vendoredstill builds the same thing. OpenWrt keeps linking its own libopenssl.What changes for tarball users:
--ca-cert.--skip-cert-verifyremains.A tag now also stops on a known advisory in its
Cargo.lock, because advisories in rustls reach the tarballs from now on. v1.2.1 therefore needs the rustls and rustls-webpki updates first.Checked: aarch64, armv7 and arm musl builds run
--listover HTTPS, the ARM ones under qemu, and aarch64 ran a download test against the same server as v1.2.0. cross 0.2.5 builds the OpenSSL backend with this lock file. CI starts every cross-built binary with--helpunder the image's QEMU runner, without network. The cross job gets a cache per matrix entry, because entries restoring each other's build fail with E0463. #22 has the same fix.release.ymlitself has not run.