ci: build the release tarballs with rustls

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -32,7 +32,6 @@ body:
       options:
         - rustls-tls (default)
         - native-tls (system OpenSSL)
-        - vendored-openssl
         - not sure
     validations:
       required: true

.github/workflows/ci.yml

@@ -160,14 +160,14 @@ jobs:
           - aarch64-unknown-linux-musl
           - armv7-unknown-linux-musleabihf
           - x86_64-unknown-linux-musl
+          - arm-unknown-linux-musleabi
         tls: [rustls-tls]
         include:
-          # Proves the OpenSSL backend cross-builds, the configuration targets
-          # without ring support (such as PowerPC) have to use. Vendored here
-          # because the cross image has no OpenSSL for the target; OpenWrt
-          # builds use plain `native-tls` against the SDK's libopenssl.
+          # Proves the OpenSSL backend cross-builds, the configuration OpenWrt
+          # uses. OpenSSL is compiled in here only because the cross image has
+          # none for the target; OpenWrt builds link the SDK's libopenssl.
           - target: aarch64-unknown-linux-musl
-            tls: vendored-openssl
+            tls: native-tls
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -176,8 +176,18 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          # One cache per matrix entry. The key otherwise names only the job,
+          # so an entry restores whatever another one built.
+          key: ${{ matrix.target }}-${{ matrix.tls }}
       - run: cargo install cross@0.2.5 --locked
-      - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}
+      - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }}
+      # A binary that links can still fail to start, so run it under the image's
+      # QEMU runner. --help because cross keeps --version for itself, and without
+      # network so that a dropped argument cannot start a real speed test.
+      - run: cross run --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }} -- --help | grep '^Usage:'
+        env:
+          CROSS_CONTAINER_OPTS: --network=none
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: librespeed-cli-${{ matrix.target }}-${{ matrix.tls }}

.github/workflows/release.yml

@@ -60,12 +60,26 @@ jobs:
     with:
       ref: ${{ needs.resolve.outputs.source }}
 
+  # What a tag publishes cannot be taken back, so a known advisory in its lock
+  # file stops it here. README's release policy says how to decide on one.
+  advisories:
+    name: Advisories
+    needs: resolve
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.resolve.outputs.source }}
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check advisories
+
   # The canonical crate is assembled once, here, and this job also fixes
   # which commit the rest of the run is about. The publish job reproduces
   # the crate and compares the bytes before uploading anything.
   prepare:
     name: Package the crate
-    needs: [resolve, validate]
+    needs: [resolve, validate, advisories]
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.guard.outputs.version }}
@@ -137,10 +151,11 @@ jobs:
       # this installs, and cross is part of what builds the binaries.
       - run: cargo install cross@0.2.5 --locked
 
-      # OpenSSL is vendored so the published binaries are self-contained;
-      # OpenWrt packages build against the SDK's libopenssl instead.
+      # rustls, so the published binaries are self-contained and carry no OpenSSL
+      # of their own to keep up to date. OpenWrt packages build against the SDK's
+      # libopenssl instead.
       - name: Build
-        run: cross build --release --target ${{ matrix.target }} --no-default-features --features vendored-openssl
+        run: cross build --release --locked --target ${{ matrix.target }}
 
       - name: Package
         run: |

Cargo.toml

@@ -55,9 +55,6 @@ rustls-tls = [
 # support, such as the 32-bit PowerPC e500v2 in Turris 1.x routers. This is what
 # OpenWrt packaging wants: it reuses the libopenssl already in the image.
 native-tls = ["dep:hyper-tls", "dep:native-tls", "dep:tokio-native-tls"]
-# As above, but builds OpenSSL from source and links it statically, for
-# cross-compiling without the target's OpenSSL headers at hand.
-vendored-openssl = ["native-tls", "native-tls/vendored"]
 
 [dependencies]
 anyhow = "1"

README.md

@@ -52,7 +52,6 @@ a reproducible build date in `--version`.
 | --- | --- | --- | --- |
 | `rustls-tls` (default) | rustls + ring | none, statically linked | anything |
 | `native-tls` | system OpenSSL | libopenssl | anything OpenSSL builds for |
-| `vendored-openssl` | OpenSSL built from source | none, statically linked | anything OpenSSL builds for |
 
 `ring` builds everywhere, falling back to portable C where it has no
 hand-written assembly, which is everything outside x86, x86_64, aarch64 and
@@ -291,8 +290,8 @@ one chain and stops at the first step that fails:
 2. **Checks** run [ci.yml](.github/workflows/ci.yml) against that commit:
    tests on three platforms, both TLS backends, the minimum supported Rust
    version, lint, the fuzz targets, the differential test against the Go
-   client and `cargo package`. Nothing is built or published until they
-   pass.
+   client and `cargo package`, and a tag with a known advisory in its
+   `Cargo.lock` stops too. Nothing is built or published until they pass.
 3. **Package the crate** verifies the tag against `version` in `Cargo.toml`
    and builds the `.crate` once, recording its SHA-256. A tag that disagrees
    stops the run here, before a release exists to leave behind.

deny.toml

@@ -5,6 +5,7 @@ targets = [
     "x86_64-unknown-linux-musl",
     "aarch64-unknown-linux-musl",
     "armv7-unknown-linux-musleabihf",
+    "arm-unknown-linux-musleabi",
     "powerpc-unknown-linux-musl",
     "x86_64-apple-darwin",
     "x86_64-pc-windows-msvc",