Research: does the rustls/aws-lc-sys crypto stack build on illumos, or should the depot use ring?

toasterson commented

2026-09-19 19:59:06 +00:00

Owner

Part of #24

Question

pkg6depotd pulls aws-lc-sys through rustls (via axum-server, tokio-rustls, reqwest) and jsonwebtoken (aws_lc_rs feature). aws-lc-sys has no pregenerated bindings for x86_64-unknown-illumos, so CI now enables its bindgen feature on illumos and installs libclang. Determine whether aws-lc actually compiles and passes tests on OpenIndiana (the Solstice illumos CI job is the first evidence), and if not, what switching to the ring provider across rustls/reqwest/jsonwebtoken costs and whether it changes FIPS or algorithm coverage we need (RS256/ES256 for JWT, TLS 1.3).

Capture as docs/research/illumos-crypto-stack.md with a recommendation. This de-risks the illumos release build.

Links

Informs #8

Part of #24 ## Question `pkg6depotd` pulls `aws-lc-sys` through `rustls` (via axum-server, tokio-rustls, reqwest) and `jsonwebtoken` (`aws_lc_rs` feature). aws-lc-sys has no pregenerated bindings for `x86_64-unknown-illumos`, so CI now enables its `bindgen` feature on illumos and installs libclang. Determine whether aws-lc actually compiles and passes tests on OpenIndiana (the Solstice `illumos` CI job is the first evidence), and if not, what switching to the `ring` provider across rustls/reqwest/jsonwebtoken costs and whether it changes FIPS or algorithm coverage we need (RS256/ES256 for JWT, TLS 1.3). Capture as `docs/research/illumos-crypto-stack.md` with a recommendation. This de-risks the illumos release build. ## Links - Informs #8

toasterson added this to the Release 1 (server only) milestone

2026-09-19 19:59:06 +00:00

toasterson added the

wayfinder:research

label

2026-09-19 19:59:06 +00:00

toasterson referenced this issue

2026-09-19 19:59:46 +00:00

Wayfinder map: Release 1 (server only) #24

forge referenced this issue from a commit

2026-09-19 20:11:25 +00:00

research: rustls crypto provider on illumos (wayfinder #35)

toasterson commented

2026-09-19 20:11:35 +00:00

Author

Owner

Resolution

aws-lc's README lists neither illumos nor Solaris, but upstream merged three illumos/Solaris build fixes (aws-lc #1854 by Oxide, #2035 by Oracle, #2698 on 2025-09-18) and all are in the AWS-LC 1.65.0 snapshot bundled in the locked aws-lc-sys 0.34.0. aws-lc-rs builds x86_64-unknown-illumos in its cross.yml (build-only, --no-run) and lists it under "Other Platforms" in its user guide. No open illumos issues in either repo.
The ticket premise is outdated: aws-lc-rs 1.15.0 (2025-11) introduced universal pre-generated bindings, so bindgen/libclang is not required on illumos. The [target.'cfg(target_os = "illumos")'] aws-lc-sys = { features = ["bindgen"] } line added with the CI migration re-enables aws-lc-sys's default all-bindings feature (aws-lc-rs depends on it with default-features = false), which is precisely what forces the bindgen path. Verified with cargo tree -e features -i aws-lc-sys --target x86_64-unknown-illumos: removing that line leaves only prebuilt-nasm and drops bindgen/clang-sys from the illumos graph; the build then falls back to the CMake builder (gcc + cmake, both in the Solstice illumos image).
Switching to ring is a 4-line change in pkg6depotd/Cargo.toml (rustls/tokio-rustls default-features = false + ring, axum-server tls-rustls-no-provider, jsonwebtoken rust_crypto; reqwest untouched since rustls-tls already enables ring privately). Verified: aws-lc-sys, aws-lc-rs, bindgen, clang-sys and cmake vanish from Cargo.lock; +30 RustCrypto crates. All JWT algorithms (HS/RS/PS/ES256/384/EdDSA) and TLS 1.3 remain; only X25519MLKEM768 post-quantum KX and FIPS are lost. ring 0.17.14 already builds on illumos (it is in today's graph).
developer/clang-20@20.1.8 is in OI hipster and delivers /usr/clang/20/lib/libclang.so, so the CI step was correct but unnecessary; it costs a cold LLVM install per VM plus compiling bindgen/clang-sys.

Recommendation: keep aws-lc, delete the illumos aws-lc-sys override and the libclang CI step (done on main right after this resolution); keep the ring diff as fallback if the universal bindings fail on OpenIndiana. The Solstice illumos CI job is the confirming evidence; see the CI ticket #8 for its outcome.

Full findings: docs/research/illumos-crypto-stack.md on branch research/illumos-crypto-stack (research branch, not merged; cherry-pick the file when the decision it feeds is recorded).

## Resolution 1. aws-lc's README lists neither illumos nor Solaris, but upstream merged three illumos/Solaris build fixes (aws-lc #1854 by Oxide, #2035 by Oracle, #2698 on 2025-09-18) and all are in the AWS-LC 1.65.0 snapshot bundled in the locked aws-lc-sys 0.34.0. aws-lc-rs builds `x86_64-unknown-illumos` in its cross.yml (build-only, `--no-run`) and lists it under "Other Platforms" in its user guide. No open illumos issues in either repo. 2. The ticket premise is outdated: aws-lc-rs 1.15.0 (2025-11) introduced universal pre-generated bindings, so bindgen/libclang is not required on illumos. The `[target.'cfg(target_os = "illumos")'] aws-lc-sys = { features = ["bindgen"] }` line added with the CI migration re-enables aws-lc-sys's default `all-bindings` feature (aws-lc-rs depends on it with `default-features = false`), which is precisely what forces the bindgen path. Verified with `cargo tree -e features -i aws-lc-sys --target x86_64-unknown-illumos`: removing that line leaves only `prebuilt-nasm` and drops bindgen/clang-sys from the illumos graph; the build then falls back to the CMake builder (gcc + cmake, both in the Solstice illumos image). 3. Switching to ring is a 4-line change in pkg6depotd/Cargo.toml (rustls/tokio-rustls `default-features = false` + `ring`, axum-server `tls-rustls-no-provider`, jsonwebtoken `rust_crypto`; reqwest untouched since `rustls-tls` already enables ring privately). Verified: aws-lc-sys, aws-lc-rs, bindgen, clang-sys and cmake vanish from Cargo.lock; +30 RustCrypto crates. All JWT algorithms (HS/RS/PS/ES256/384/EdDSA) and TLS 1.3 remain; only X25519MLKEM768 post-quantum KX and FIPS are lost. ring 0.17.14 already builds on illumos (it is in today's graph). 4. `developer/clang-20@20.1.8` is in OI hipster and delivers `/usr/clang/20/lib/libclang.so`, so the CI step was correct but unnecessary; it costs a cold LLVM install per VM plus compiling bindgen/clang-sys. **Recommendation:** keep aws-lc, delete the illumos aws-lc-sys override and the libclang CI step (done on `main` right after this resolution); keep the ring diff as fallback if the universal bindings fail on OpenIndiana. The Solstice illumos CI job is the confirming evidence; see the CI ticket #8 for its outcome. **Full findings:** [docs/research/illumos-crypto-stack.md](https://code.aopc.cloud/OpenIndiana/ips/src/branch/research/illumos-crypto-stack/docs/research/illumos-crypto-stack.md) on branch `research/illumos-crypto-stack` (research branch, not merged; cherry-pick the file when the decision it feeds is recorded).

toasterson closed this issue

2026-09-19 20:11:37 +00:00

forge referenced this issue from a commit

2026-09-19 20:12:15 +00:00

ci: Drop the illumos bindgen override for aws-lc-sys

toasterson referenced this issue

2026-09-19 21:29:38 +00:00

Migrate CI to Solstice CI #8

toasterson referenced this issue

2026-09-27 13:14:15 +00:00

Wayfinder map: Release 1 (server only) #24