Prepare 0.15.1 release by djc · Pull Request #634 · rustls/rustls-ffi

djc · 2026-03-13T10:07:18Z

Fixes #632.

debian/build.sh

ctz · 2026-03-13T12:18:01Z

Update CHANGELOG.md/release notes?

djc · 2026-03-13T12:28:54Z

Update CHANGELOG.md/release notes?

Added an edited version of the auto-generated release notes in CHANGELOG.md.

cpu · 2026-03-13T12:34:38Z

CHANGELOG.md

+This is a minor release, updating rustls to 0.23.37 and updating other dependencies.
+
+* update semver compat. deps, fix cbindgen CI diff check by @cpu in https://github.com/rustls/rustls-ffi/pull/559
+* Build artifacts on ubuntu-22 by @ctz in https://github.com/rustls/rustls-ffi/pull/561


I don't love these auto-generated changelog notes compared to the previous ones. For example, changes in CI are not meaningful to end users.

It also doesn't match the format that was used for the previous releases (added, changed, removed, etc)

I'm happy to review more lines. I kept this in because I thought it was relevant (see discussion in the PR about the minimum usable glibc version), but happy to remove it.

I don't think there's anything remaining in this list that's particularly worth calling out or explaining in more detail?

Did you verify main has no breaking changes? I think 0b3478c is breaking for example.

In either case, I think we should maintain the added/changed/removed format that was used previously, with auto-generated changelog in the GitHub release for the full set of commits and the top-level release notes and CHANGELOG.md used for curated highlights.

I don't think there's anything remaining in this list that's particularly worth calling out or explaining in more detail?

There were a few functions added in the diff since last release and we've typically listed those explicitly:

d595fb7

7068342

I think new error variants were also listed explicitly in 0.15.0 and previous, and there were a couple of those.

This change also feels worth an explicit "changed" mention:

1098495

And probably this deprecation:

abb1e40

Did you verify main has no breaking changes? I think 0b3478c is breaking for example.

Why do you think that's breaking? It doesn't look breaking to me.

I'm generally conservative in applying a Rust-like understanding of what is/isn't semver breaking to C code. Especially in a case like this where it isn't an opaque struct, I think we have limited ability to mutate the definition in a semver safe way.

I'm fairly confident this is an ABI break (though we document that we don't care about those). On the API compat side I think it would break positional struct initializers at a minimum, and there might be a case for why that would matter for rustls_client_hello_select_certified_key invocations. I suspect the typical path is to get your rustls_client_hello from the rustls_client_hello_callback.

@ctz What do you think?

Okay, but in the intended usage only the dylib allocates values of this type, right?

Yep I believe that is correct in this instance.

So it feels to me like if we move the new field to the end, it won't be practically breaking although it might be technically breaking. That seems like a decent way to get a 0.15.1 out?

I would be fine with leaving it as-is, calling it 0.15.1, and documenting we made a breaking change in an API that has always been marked experimental. It doesn't feel like we gain much in this case by trying to decide if it's practically breaking or not. Even if we move the field to the end it feels most robust to just document it as a breaking change.

Yep, agree.

ctz · 2026-03-13T12:42:33Z

Here's a claude-assisted changelog:

This is a minor release, updating rustls to 0.23.37 and improving documentation tooling.

Added

Version detection macros in the C header:
- RUSTLS_VERSION_MAJOR, RUSTLS_VERSION_MINOR, RUSTLS_VERSION_PATCH - individual version components as integers.
- RUSTLS_VERSION_NUMBER - a single number encoding the version (major << 16 | minor << 8 | patch), similar to OpenSSL's versioning scheme.
- rustls_version_match() test function verifies the defines match the actual library version.
New error variants:
- RUSTLS_RESULT_CERT_REVOCATION_LIST_UNSUPPORTED_SIGNATURE_ALGORITHM - for CRL signature algorithm errors.
- RUSTLS_RESULT_CERT_UNSUPPORTED_SIGNATURE_ALGORITHM - for certificate signature algorithm errors.
New API functions:
- rustls_platform_server_cert_verifier_try_with_provider() - safer alternative to rustls_platform_server_cert_verifier_with_provider with better error reporting. The older function is now deprecated.
- rustls_connection_get_tls13_tickets_received() - returns the number of TLS 1.3 tickets received by a client connection. This is FFI for ClientConnection::tls13_tickets_received().
- rustls_client_connection_new_alpn() - constructs a client rustls_connection with custom ALPN protocol support that differs from the base rustls_client_config.
Additional fields exposed in rustls_client_hello:
- named_groups - the supported key exchange groups advertised by the client.
Website documentation improvements:
- Deprecated functions are now visually annotated on the documentation website.
- The docgen tool now parses and includes deprecation messages in api.json.

Changed

Updated rustls from 0.23.31 to 0.23.37.
Updated rustls-platform-verifier from 0.5.3 to 0.6.2.
- Platform server cert verifier creation is now fallible and must be handled appropriately.
- Note: rustls_platform_server_cert_verifier_with_provider() is now deprecated in favor of rustls_platform_server_cert_verifier_try_with_provider().
Post-quantum key exchange (X25519MLKEM768) is now preferred by default (matches upstream rustls 0.23.27).
Bumped minimum supported Rust version (MSRV) to 1.73.
Updated to toml 0.9.
Various dependency updates (libc, serde, serde_json, hickory-resolver, etc.).
CI improvements:
- Removed dependency on nightly Rust toolchain for cbindgen. The u32_enum_builder and castable macros were replaced with simpler implementations that don't require macro expansion.
- Better handling of PowerShell errors in Windows CI.
- macOS artifact builds now use macos-15-intel and updated ARM64 runners.
- Added check for uncommitted website/static/api.json diffs to ensure generated documentation is up-to-date.
Internal improvements:
- Replaced macros with declarative + procedural macro approach for error enum u32 mapping.
- Simplified various internal implementations.

djc · 2026-03-13T12:44:31Z

That looks pretty nice -- can you get it to add references to the relevant PRs?

cpu · 2026-03-13T12:46:46Z

Those Claude auto-gen'd changelog notes look reasonable 👍 I still suspect we either need to call this 0.16 (I think I'd prefer not to do that) or to make a rel-0.15 branch and use that instead because of 0b3478c

djc · 2026-03-13T12:49:02Z

Those auto-gen'd changelog notes look reasonable 👍 I still suspect we either need to call this 0.16 (I think I'd prefer not to do that) or to make a rel-0.15 branch and use that instead because of 0b3478c

Yeah, I don't think we should release a 0.16.0 (now) that's still based on rustls 0.23.

ctz · 2026-03-13T12:50:05Z

Those auto-gen'd changelog notes look reasonable 👍 I still suspect we either need to call this 0.16 (I think I'd prefer not to do that) or to make a rel-0.15 branch and use that instead because of 0b3478c

Oh, yes, that's dead-on breaking. Hmm

cpu · 2026-03-13T12:56:39Z

Oh, yes, that's dead-on breaking. Hmm

It's in a part of the API we've called experimental, so I suppose we could just say it's fine...

EXPERIMENTAL: this feature of rustls-ffi is likely to change in the future, as the rustls library is re-evaluating their current approach to client hello handling.

djc · 2026-03-16T08:40:29Z

That looks pretty nice -- can you get it to add references to the relevant PRs?

And/or share the prompt?

djc requested a review from ctz March 13, 2026 10:07

djc force-pushed the bump-0.15.1 branch from c01accd to 148604b Compare March 13, 2026 10:32

djc added 5 commits March 13, 2026 11:46

Bump version to 0.15.1

ed86541

Take rustls 0.23.37

15510ee

Move const to the bottom

acf9695

Avoid parsing TOML with sed

b545855

Avoid hardcoding version in deb testing workflow

087a0c0

djc force-pushed the bump-0.15.1 branch from 148604b to 087a0c0 Compare March 13, 2026 10:47

ctz reviewed Mar 13, 2026

View reviewed changes

debian/build.sh Show resolved Hide resolved

ctz approved these changes Mar 13, 2026

View reviewed changes

djc force-pushed the bump-0.15.1 branch from bd612ac to fd4bab0 Compare March 13, 2026 12:31

cpu reviewed Mar 13, 2026

View reviewed changes

Update changelog

d73ea86

djc force-pushed the bump-0.15.1 branch from fd4bab0 to d73ea86 Compare March 13, 2026 12:39

Conversation

djc commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

ctz commented Mar 13, 2026

Uh oh!

djc commented Mar 13, 2026

Uh oh!

cpu Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cpu Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ctz commented Mar 13, 2026

Added

Changed

Uh oh!

djc commented Mar 13, 2026

Uh oh!

cpu commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

djc commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ctz commented Mar 13, 2026

Uh oh!

cpu commented Mar 13, 2026

Uh oh!

djc commented Mar 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

djc commented Mar 13, 2026 •

edited

Loading

cpu Mar 13, 2026 •

edited

Loading

cpu Mar 13, 2026 •

edited

Loading

cpu commented Mar 13, 2026 •

edited

Loading

djc commented Mar 13, 2026 •

edited

Loading