Skip to content

Prepare 0.15.1 release #634

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
djc wants to merge 6 commits into
base: main
Choose a base branch
from
+60 −33
Open

Prepare 0.15.1 release #634

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ed86541
Bump version to 0.15.1
djc Mar 13, 2026
15510ee
Take rustls 0.23.37
djc Mar 13, 2026
acf9695
Move const to the bottom
djc Mar 13, 2026
b545855
Avoid parsing TOML with sed
djc Mar 13, 2026
087a0c0
Avoid hardcoding version in deb testing workflow
djc Mar 13, 2026
d73ea86
Update changelog
djc Mar 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions .github/workflows/artifacts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,8 @@ jobs:
linux-deb:
name: Linux (x86-64 GNU Deb)
runs-on: ubuntu-22.04 # x86_64.
outputs:
version: ${{ steps.version.outputs.version }}
steps:
- uses: actions/checkout@v6
with:
Expand All @@ -95,14 +97,20 @@ jobs:
run: |
curl -L $LINK/$CARGO_C_FILE | tar xz -C ~/.cargo/bin

- name: Extract version
id: version
run: |
VERSION=$(cargo pkgid -p rustls-ffi | sed 's/.*@//')
echo "version=$VERSION" >> "$GITHUB_OUTPUT"

- name: Build deb
run: ./debian/build.sh

- name: Upload deb
uses: actions/upload-artifact@v7
with:
name: librustls_0.15.0_amd64.deb
path: librustls_0.15.0_amd64.deb
name: librustls_${{ steps.version.outputs.version }}_amd64.deb
path: librustls_${{ steps.version.outputs.version }}_amd64.deb

macos-binaries:
name: MacOS (Arm64 and x86_64)
Expand Down Expand Up @@ -281,9 +289,9 @@ jobs:
- name: Download rustls-ffi deb artifact
uses: actions/download-artifact@v8
with:
name: librustls_0.15.0_amd64.deb
name: librustls_${{ needs.linux-deb.outputs.version }}_amd64.deb
- name: Install deb
run: sudo dpkg --install ./librustls_0.15.0_amd64.deb
run: sudo dpkg --install ./librustls_${{ needs.linux-deb.outputs.version }}_amd64.deb
- name: Check copyright exists
run: test -f /usr/share/doc/librustls/COPYRIGHT
# Dump out what pkg-config says about the rustls package.
Expand Down
41 changes: 30 additions & 11 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,24 @@
# Changelog

## 0.15.1 (2026-03-13)

This is a minor release, updating rustls to 0.23.37 and updating other dependencies.

* Build artifacts on ubuntu-22 by @ctz in https://github.com/rustls/rustls-ffi/pull/561
Copy link
Member

@cpu cpu Mar 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't love these auto-generated changelog notes compared to the previous ones. For example, changes in CI are not meaningful to end users.

It also doesn't match the format that was used for the previous releases (added, changed, removed, etc)

Copy link
Member Author

@djc djc Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy to review more lines. I kept this in because I thought it was relevant (see discussion in the PR about the minimum usable glibc version), but happy to remove it.

I don't think there's anything remaining in this list that's particularly worth calling out or explaining in more detail?

Copy link
Member

@cpu cpu Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you verify main has no breaking changes? I think 0b3478c is breaking for example.

In either case, I think we should maintain the added/changed/removed format that was used previously, with auto-generated changelog in the GitHub release for the full set of commits and the top-level release notes and CHANGELOG.md used for curated highlights.

I don't think there's anything remaining in this list that's particularly worth calling out or explaining in more detail?

There were a few functions added in the diff since last release and we've typically listed those explicitly:

I think new error variants were also listed explicitly in 0.15.0 and previous, and there were a couple of those.

This change also feels worth an explicit "changed" mention:

And probably this deprecation:

Copy link
Member Author

@djc djc Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did you verify main has no breaking changes? I think 0b3478c is breaking for example.

Why do you think that's breaking? It doesn't look breaking to me.

Copy link
Member

@cpu cpu Mar 13, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm generally conservative in applying a Rust-like understanding of what is/isn't semver breaking to C code. Especially in a case like this where it isn't an opaque struct, I think we have limited ability to mutate the definition in a semver safe way.

I'm fairly confident this is an ABI break (though we document that we don't care about those). On the API compat side I think it would break positional struct initializers at a minimum, and there might be a case for why that would matter for rustls_client_hello_select_certified_key invocations. I suspect the typical path is to get your rustls_client_hello from the rustls_client_hello_callback.

@ctz What do you think?

Copy link
Member Author

@djc djc Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, but in the intended usage only the dylib allocates values of this type, right?

Copy link
Member

@ctz ctz Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep I believe that is correct in this instance.

Copy link
Member Author

@djc djc Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So it feels to me like if we move the new field to the end, it won't be practically breaking although it might be technically breaking. That seems like a decent way to get a 0.15.1 out?

Copy link
Member

@cpu cpu Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would be fine with leaving it as-is, calling it 0.15.1, and documenting we made a breaking change in an API that has always been marked experimental. It doesn't feel like we gain much in this case by trying to decide if it's practically breaking or not. Even if we move the field to the end it feels most robust to just document it as a breaking change.

Copy link
Member

@ctz ctz Mar 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, agree.

* rustls 0.23.25 -> 0.23.27 by @cpu in https://github.com/rustls/rustls-ffi/pull/566
* Update rustls 0.23.27 -> 0.23.28, expose new API surface & errors by @cpu in https://github.com/rustls/rustls-ffi/pull/574
* website: Remove backdrop-filter: blur from items by @yedayak in https://github.com/rustls/rustls-ffi/pull/577
* docgen: skip over cpp attributes before decl by @ctz in https://github.com/rustls/rustls-ffi/pull/581
* cbindgen: Add version defines by @yedayak in https://github.com/rustls/rustls-ffi/pull/576
* librustls: rustls 0.23.28 -> 0.23.29 by @cpu in https://github.com/rustls/rustls-ffi/pull/583
* librustls: update rustls 0.23.29 -> 0.23.31 by @cpu in https://github.com/rustls/rustls-ffi/pull/589
* Bump rust-version to 1.73 by @djc in https://github.com/rustls/rustls-ffi/pull/607
* upgrade rustls 0.23.31 -> 0.23.33 by @cpu in https://github.com/rustls/rustls-ffi/pull/614
* error: use decl+proc macro to generate u32 mapping by @ctz in https://github.com/rustls/rustls-ffi/pull/618
* librustls: fix typo in server cert verifier builder docs by @cpu in https://github.com/rustls/rustls-ffi/pull/620
* Bump macos versions for artifacts by @ctz in https://github.com/rustls/rustls-ffi/pull/623
* docgen/website: show deprecated function warnings on docs website by @cpu in https://github.com/rustls/rustls-ffi/pull/584

## 0.15.0 (2025-03-25)

This release updates to [Rustls 0.23.25][] and increases the project minimum
Expand Down Expand Up @@ -184,7 +203,7 @@ requirements.
* Ciphersuites supported by a specific `rustls_crypto_provider` can be retrieved with
`rustls_crypto_provider_ciphersuites_len()` and `rustls_crypto_provider_ciphersuites_get()`.
* Ciphersuites supported by the current process-wide default crypto provider (if any) can
be retrieved with `rustls_default_crypto_provider_ciphersuites_len()` and
be retrieved with `rustls_default_crypto_provider_ciphersuites_len()` and
`rustls_default_crypto_provider_ciphersuites_get()`.
* A buffer can be filled with cryptographically secure random data from
a specific `rustls_crypto_provider` using `rustls_crypto_provider_random()`,
Expand All @@ -201,7 +220,7 @@ requirements.
based on the current process-wide default.
* `rustls_crypto_provider_builder_new_with_base` will construct a builder
based on a specified `rustls_crypto_provider`.
* Customization of supported ciphersuites can be achieved with
* Customization of supported ciphersuites can be achieved with
`rustls_crypto_provider_builder_set_cipher_suites()`.
* The default process-wide provider can be installed from a builder using
`rustls_crypto_provider_builder_build_as_default()`, if it has not already
Expand Down Expand Up @@ -231,7 +250,7 @@ requirements.
more information on supported platforms.
* Use `rustls_platform_server_cert_verifier()` to construct a platform verifier
that uses the default crypto provider.
* Use `rustls_platform_server_cert_verifier_with_provider()` to construct a
* Use `rustls_platform_server_cert_verifier_with_provider()` to construct a
platform verifier that uses the specified `rustls_crypto_provider`.
* The returned `rustls_server_cert_verifier` can be used with
a `rustls_client_config_builder` with
Expand Down Expand Up @@ -264,7 +283,7 @@ requirements.

* `rustls_server_config_builder_build()` and
`rustls_client_config_builder_build()` now use out-parameters for the
`rustls_server_config` or `rustls_client_config`, and return a `rustls_result`.
`rustls_server_config` or `rustls_client_config`, and return a `rustls_result`.
This allows returning an error if the build operation fails because a suitable
crypto provider was not available.

Expand All @@ -286,7 +305,7 @@ requirements.
functions (`rustls_all_ciphersuites_len()`,
`rustls_all_ciphersuites_get_entry()`, `rustls_default_ciphersuites_len()` and
`rustls_default_ciphersuites_get_entry()`) have been
removed. Ciphersuite support is dictated by the `rustls_crypto_provider`.
removed. Ciphersuite support is dictated by the `rustls_crypto_provider`.
* Use `rustls_default_supported_ciphersuites()` to retrieve
a `rustls_supported_ciphersuites` for the default `rustls_crypto_provider`.
* Use `rustls_crypto_provider_ciphersuites()` to retrieve a
Expand All @@ -307,7 +326,7 @@ only cryptographic provider.
* A new `rustls_accepted_alert` type is added. Calling
`rustls_accepted_alert_bytes` on this type produces TLS data to write
in the case where a server acceptor encountered an error accepting a client.
The returned TLS data should be written to the connection before freeing
The returned TLS data should be written to the connection before freeing
the `rustls_accepted_alert` by calling `rustls_accepted_alert_write_tls` with
a `rustls_write_callback` implementation.

Expand Down Expand Up @@ -367,19 +386,19 @@ and 0.12.0 continues to use `*ring*` as the only cryptographic provider.
`rustls_root_cert_store_builder_add_pem` and
`rustls_root_cert_store_builder_load_roots_from_file`.
* The client verifier builders (
`rustls_allow_any_anonymous_or_authenticated_client_builder`, and
`rustls_allow_any_anonymous_or_authenticated_client_builder`, and
`rustls_allow_any_authenticated_client_builder`) as well as the client
verifier types (`rustls_allow_any_anonymous_or_authenticated_client_verifier`,
verifier types (`rustls_allow_any_anonymous_or_authenticated_client_verifier`,
`rustls_allow_any_authenticated_client_verifier`) have been replaced with
`rustls_web_pki_client_cert_verifier_builder` and `rustls_client_cert_verifier`.
* The server config client verifier setters
* The server config client verifier setters
(`rustls_server_config_builder_set_client_verifier` and
`rustls_server_config_builder_set_client_verifier_optional`) have been
replaced with `rustls_server_config_builder_set_client_verifier`.
* The client config builder functions for specifying root trust anchors
* The client config builder functions for specifying root trust anchors
(`rustls_client_config_builder_use_roots` and
`rustls_client_config_builder_load_roots_from_file`) have been replaced
with a server certificate verifier builder
with a server certificate verifier builder
(`rustls_web_pki_server_cert_verifier_builder`) constructed with
`rustls_web_pki_server_cert_verifier_builder_new` and
a `rustls_root_cert_store`. The built `rustls_web_pki_server_cert_verifier`
Expand Down
10 changes: 5 additions & 5 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion debian/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ set -x

cd "$(dirname "$0")"

VERSION=$(sed -n 's/^version = "\(.*\)"$/\1/p' ../librustls/Cargo.toml)
VERSION=$(cargo pkgid -p rustls-ffi | sed 's/.*@//')
if [ -z "$VERSION" ]; then
echo "Failed to extract version from Cargo.toml" >&2
exit 1
Expand Down
4 changes: 2 additions & 2 deletions librustls/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
[package]
name = "rustls-ffi"
# Keep in sync with defines in cbindgen.toml
version = "0.15.0"
version = "0.15.1"
license = "Apache-2.0 OR ISC OR MIT"
readme = "../README-crates.io.md"
description = "Rustls bindings for non-Rust languages"
Expand Down Expand Up @@ -30,7 +30,7 @@ prefer-post-quantum = ["aws-lc-rs", "rustls/prefer-post-quantum"]

[dependencies]
# Keep in sync with RUSTLS_CRATE_VERSION in build.rs
rustls = { version = "=0.23.36", default-features = false, features = ["std", "tls12"] }
rustls = { version = "=0.23.37", default-features = false, features = ["std", "tls12"] }
webpki = { workspace = true }
libc = { workspace = true }
log = { workspace = true }
Expand Down
16 changes: 8 additions & 8 deletions librustls/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,6 @@ use std::fs::File;
use std::io::Write;
use std::{env, fs, path::PathBuf};

// Keep in sync with Cargo.toml.
//
// We don't populate this automatically from the Cargo.toml at build time
// because doing so would require a heavy-weight deserialization lib dependency
// (and it couldn't be a _dev_ dep for use in a build script) or doing brittle
// by-hand parsing.
const RUSTLS_CRATE_VERSION: &str = "0.23.36";

fn main() {
let out_dir = PathBuf::from(env::var_os("OUT_DIR").unwrap());
let include_dir = out_dir.join("include");
Expand Down Expand Up @@ -38,3 +30,11 @@ fn main() {

println!("cargo:rerun-if-env-changed=CARGO_PKG_VERSION");
}

// Keep in sync with Cargo.toml.
//
// We don't populate this automatically from the Cargo.toml at build time
// because doing so would require a heavy-weight deserialization lib dependency
// (and it couldn't be a _dev_ dep for use in a build script) or doing brittle
// by-hand parsing.
const RUSTLS_CRATE_VERSION: &str = "0.23.37";
2 changes: 1 addition & 1 deletion librustls/cbindgen.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ after_includes = """

#define RUSTLS_VERSION_MAJOR 0
#define RUSTLS_VERSION_MINOR 15
#define RUSTLS_VERSION_PATCH 0
#define RUSTLS_VERSION_PATCH 1

/**
* This gives each version part 8 bits, and leaves the 8 least significant bits
Expand Down
2 changes: 1 addition & 1 deletion librustls/src/rustls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@

#define RUSTLS_VERSION_MAJOR 0
#define RUSTLS_VERSION_MINOR 15
#define RUSTLS_VERSION_PATCH 0
#define RUSTLS_VERSION_PATCH 1

/**
* This gives each version part 8 bits, and leaves the 8 least significant bits
Expand Down
Loading