Skip to content

host_env: keep rustls off the rustls-free ssl surface - #8727

Open
youknowone wants to merge 2 commits into
RustPython:mainfrom
youknowone:host-env-ssl-split
Open

host_env: keep rustls off the rustls-free ssl surface#8727
youknowone wants to merge 2 commits into
RustPython:mainfrom
youknowone:host-env-ssl-split

Conversation

@youknowone

@youknowone youknowone commented Sep 17, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary

host_env's ssl feature compiled the rustls engine and, on wasm32-unknown-unknown, also enabled rustls-pki-types web so UnixTime::now existed. That web feature pulls web-time → wasm-bindgen. A wasmtime host cannot satisfy __wbindgen_placeholder__, so any guest that used host_env ssl without a JS runtime failed to instantiate.

stdlib already distinguishes rustls-free ssl from ssl-rustls. This matches that split in host_env:

  • ssl — MemoryBIO, constants, OID, ALPN, hostname checks. No rustls.
  • ssl-rustls — the rustls engine.

The blanket wasm32 rustls-pki-types web dependency is gone. The browser crate already enables that feature itself, which is the crate that actually has a JS clock.

Test plan

  • cargo check -p rustpython-host_env --features ssl
  • cargo check -p rustpython-host_env --features ssl-rustls
  • CI

Assisted-by: Claude

Summary by CodeRabbit

  • New Features
    • SSL support can now be used without the Rustls engine, providing a lighter rustls-free SSL surface.
    • Rustls-based certificate handling, connections, verification, and related capabilities are available through a dedicated optional configuration.
    • WebAssembly builds continue to include Rustls-backed SSL support.
    • Standard-library SSL configuration now consistently enables the Rustls implementation and its supporting capabilities.

@youknowone
host_env: keep rustls off the rustls-free ssl surface
dfa6e23 
ssl is MemoryBIO, constants, OID, and ALPN. ssl-rustls is
the rustls engine. Drop the wasm32 rustls-pki-types web
dep; the browser crate already enables that feature.

Assisted-by: Claude
@youknowone
host_env: drop rustls-pki-types from the lockfile
03f047b 
Assisted-by: Claude
@coderabbitai

coderabbitai Bot commented Sep 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Advanced

Run ID: 2e97ff22-6d3d-49b5-b20a-2d402ab105e9

📥 Commits

Reviewing files that changed from the base of the PR and between 7da001a and 03f047b.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (5)
  • crates/host_env/Cargo.toml
  • crates/host_env/src/ssl/mod.rs
  • crates/host_env/src/ssl/protocol.rs
  • crates/stdlib/Cargo.toml
  • crates/wasm/Cargo.toml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The SSL feature split moves rustls dependencies behind ssl-rustls. Rustls-free SSL modules remain available with ssl. Rustls-dependent modules and exports are gated. Standard library and wasm feature wiring now enables ssl-rustls.

Changes

SSL feature separation

Layer / File(s) Summary
Host feature contract
crates/host_env/Cargo.toml, crates/host_env/src/ssl/protocol.rs		 The ssl feature no longer enables rustls dependencies. The new ssl-rustls feature enables them. The wasm-specific rustls-pki-types declaration was removed. rustls_versions is gated by ssl-rustls.
SSL module surface
crates/host_env/src/ssl/mod.rs		 Rustls-free modules and exports are unconditional. Rustls-dependent modules and exports are compiled only with ssl-rustls.
Feature wiring
crates/stdlib/Cargo.toml, crates/wasm/Cargo.toml		 The standard library and wasm target now enable rustpython-host_env/ssl-rustls with their rustls feature paths.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 03f04

The SSL feature split preserves rustls support for the stdlib and browser paths while allowing rustls-free SSL functionality elsewhere. No actionable merge risk was identified.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the primary change: separating the rustls-dependent implementation from the rustls-free SSL surface.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 …
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@youknowone