Make it possible to use it as rust dependency for a crate that builds a bundled version of a c-lib depending on openssl

[weiznich]

This is rather a long shot feature request. I maintain pq-src, which is a crate bundling the libpq C source code and building + linking it as part of your cargo build process. libpq depends on openssl for TLS encrypted connections. I currently solve that by letting pq-src depend on openssl-src (which statically links openssl) and extracting the relevant information about the include directory from the environment variables they set like this. I would like to be able to do the same thing with rustls-openssl-compant to eliminate the usage of openssl in my dependency tree.

As far as I see that would require:

• Having rustls-openssl-compat be published on crates.io, so that other crates can depend on it. This would then build + link the crate into the final binary, which should export the "right" symbols as far as I can tell
• Make sure that rustls-openssl-compat provides a header file + exposes the location of that header file via an environment variable to other build scripts (See the cargo documentation on this feature here (search for DEP_)
• Likely add support for functions that are used by libpq and that are currently missing from rustls-openssl-compat, but that's secondary, as I would like to get your opinion on this idea first

[cpu]

I think we do something similar with rustls-ffi to allow it to be used by curl-rust with the rustls cargo feature.

It sounds reasonable to me provided it doesn't add too much maintenance burden. Are you interested in prototyping it out?

[weiznich]

Conceptual I'm interested in working on this, but practically speaking I'm currently more than over capacity with what needs to be done in Diesel, so I won't have time to do that. I'm sorry for that.

[cpu]

Understood, thanks for replying. We can leave this open and perhaps someone with time can take the idea and run with it.

[ctz]

I think this is an interesting future avenue. FWIW I have tried this library against libpq quite a while ago and it seemed to work:

$ LD_LIBRARY_PATH=target/debug /usr/bin/psql -h localhost 
psql (14.11 (Ubuntu 14.11-0ubuntu0.22.04.1))
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.

jbp=> ^C

(but that early testing hasn't been defended, so today the situation may be different.)

[ctz]

I would like to be able to do the same thing with rustls-openssl-compant to eliminate the usage of openssl in my dependency tree.

Just on this specific point, I am not sure that is feasible for this project:

• rustls-libssl will always depend on OpenSSL libcrypto to some extent, and
• a typical program that uses libssl for SSL/TLS inevitably also uses quite a bit of libcrypto's API too,

Both of those dependencies have to come from somewhere.

To give an indication of how much work this is -- my /usr/bin/psql uses 38 functions from OpenSSL libssl, but 577 from libcrypto.