add pluggable crypto provider #2819
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: ["main", "rel-*", "ci/*"] | |
| pull_request: | |
| merge_group: | |
| schedule: | |
| - cron: "0 18 * * *" | |
| workflow_dispatch: | |
| env: | |
| RUSTFLAGS: -D warnings | |
| jobs: | |
| format-unstable: | |
| name: Format (unstable) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install rust nightly toolchain | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: nightly | |
| components: rustfmt | |
| - name: Check formatting (unstable) | |
| run: cargo fmt --all -- --check --config-path .rustfmt.unstable.toml | |
| - if: ${{ failure() }} | |
| run: echo "Nightly formatting check failed. Please run \`cargo +nightly fmt --config-path .rustfmt.unstable.toml\`" | |
| lint: | |
| name: Clippy | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - run: cargo clippy --features ring,pem,x509-parser --all-targets | |
| # rustls-cert-gen require either aws_lc_rs or ring feature | |
| - run: cargo clippy -p rcgen --no-default-features --all-targets | |
| - run: cargo clippy -p rcgen --no-default-features --features crypto,pem,x509-parser --all-targets | |
| - name: Ensure backend-free builds have no built-in crypto dependencies | |
| run: | | |
| if cargo tree -p rcgen --no-default-features --features crypto --edges normal,build | grep -E 'ring v|aws-lc'; then | |
| exit 1 | |
| fi | |
| - name: Ensure FIPS requires an explicit provider | |
| run: | | |
| if output=$(cargo check -p rcgen --no-default-features --features fips 2>&1); then | |
| exit 1 | |
| fi | |
| grep -Fq "the 'fips' feature currently requires the 'aws_lc_rs' feature" <<<"$output" | |
| - run: cargo clippy --no-default-features --features ring --all-targets | |
| - run: cargo clippy --no-default-features --features aws_lc_rs,pem,x509-parser --all-targets | |
| - run: cargo clippy --no-default-features --features aws_lc_rs_unstable,pem,x509-parser --all-targets | |
| - run: cargo clippy --no-default-features --features aws_lc_rs --all-targets | |
| - run: cargo clippy --no-default-features --features aws_lc_rs,fips,pem,x509-parser --all-targets | |
| rustdoc: | |
| name: Documentation | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| toolchain: [stable, nightly] | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ matrix.toolchain }} | |
| - name: cargo doc (ring) | |
| run: cargo doc --features ring,pem,x509-parser --document-private-items | |
| env: | |
| RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=rcgen_docsrs' || '-Dwarnings' }} | |
| - name: cargo doc (provider API without a built-in backend) | |
| run: cargo doc -p rcgen --no-default-features --features crypto,pem,x509-parser | |
| env: | |
| RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=rcgen_docsrs' || '-Dwarnings' }} | |
| - name: cargo doc (aws_lc_rs_unstable) | |
| run: cargo doc --features aws_lc_rs_unstable,pem,x509-parser --document-private-items | |
| env: | |
| RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=rcgen_docsrs' || '-Dwarnings' }} | |
| - name: cargo doc (fips) | |
| run: cargo doc --no-default-features --features aws_lc_rs,fips --document-private-items | |
| env: | |
| RUSTDOCFLAGS: ${{ matrix.toolchain == 'nightly' && '-Dwarnings --cfg=rcgen_docsrs' || '-Dwarnings' }} | |
| check-external-types: | |
| name: Validate external types appearing in public API | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: nightly-2026-03-20 | |
| # ^ sync with https://github.com/awslabs/cargo-check-external-types/blob/main/rust-toolchain.toml | |
| - run: cargo install --locked cargo-check-external-types | |
| - name: run cargo-check-external-types for rcgen/ | |
| working-directory: rcgen/ | |
| run: cargo check-external-types --features ring,pem,x509-parser | |
| - name: run cargo-check-external-types for rcgen/ | |
| working-directory: rcgen/ | |
| run: cargo check-external-types --features aws_lc_rs_unstable,pem,x509-parser | |
| semver: | |
| name: Check semver compatibility | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Check semver | |
| uses: obi1kenobi/cargo-semver-checks-action@v2 | |
| with: | |
| exclude: rustls-cert-gen | |
| msrv: | |
| name: Check MSRV | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: 1.88.0 | |
| - run: cargo check --locked --lib --features ring,pem,x509-parser | |
| - run: cargo check --locked --lib --features aws_lc_rs_unstable | |
| - run: cargo check --locked --lib --features aws_lc_rs,fips | |
| build-windows: | |
| runs-on: windows-latest | |
| env: | |
| # botan doesn't build on windows if the source is | |
| # on a different drive than the artifacts | |
| # https://github.com/randombit/botan-rs/issues/82 | |
| BOTAN_CONFIGURE_LINK_METHOD: copy | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| $VCPKG_DEFAULT_BINARY_CACHE | |
| key: ${{ runner.os }}-cargo-stable-${{ hashFiles('Cargo.lock') }} | |
| - uses: egor-tensin/vs-shell@v2 | |
| with: | |
| arch: amd64 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install NASM for aws-lc-rs on Windows | |
| uses: ilammy/setup-nasm@v1 | |
| - name: Run cargo check | |
| run: cargo check --all-targets | |
| - name: Run the tests | |
| run: cargo test | |
| - name: Run the tests with x509-parser enabled | |
| run: cargo test --features x509-parser | |
| - name: Run the tests with aws_lc_rs backend enabled | |
| run: cargo test --no-default-features --features aws_lc_rs,pem | |
| - name: Run the tests with no built-in backend | |
| run: cargo test -p rcgen --no-default-features --features crypto,pem,x509-parser | |
| # rustls-cert-gen require either aws_lc_rs or ring feature | |
| - name: Run the tests with no features enabled | |
| run: cargo test -p rcgen --no-default-features | |
| build: | |
| strategy: | |
| matrix: | |
| os: [macOS-latest, ubuntu-latest] | |
| toolchain: [stable, beta, nightly, stable 7 months ago] | |
| exclude: | |
| - os: macOS-latest | |
| toolchain: beta | |
| - os: macOS-latest | |
| toolchain: nightly | |
| - os: macOS-latest | |
| toolchain: stable 7 months ago | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-${{matrix.toolchain}}-${{ hashFiles('Cargo.lock') }} | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ matrix.toolchain }} | |
| - name: Run cargo check | |
| run: cargo check --all-targets | |
| - name: Run the tests | |
| run: cargo test | |
| - name: Run the tests with x509-parser enabled | |
| run: cargo test --features x509-parser | |
| - name: Run the tests with aws_lc_rs backend enabled | |
| run: cargo test --no-default-features --features aws_lc_rs,pem | |
| # Build rustls-cert-gen as a standalone package, see this PR for why it's needed: | |
| # https://github.com/rustls/rcgen/pull/206#pullrequestreview-1816197358 | |
| build-rustls-cert-gen-standalone: | |
| name: Build rustls-cert-gen as a standalone package | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Run the tests | |
| run: cargo test --package rustls-cert-gen | |
| coverage: | |
| name: Measure coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-stable-${{ hashFiles('Cargo.lock') }} | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@cargo-llvm-cov | |
| - name: Install rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: llvm-tools | |
| - name: Measure coverage | |
| run: cargo llvm-cov --features ring,pem,x509-parser --lcov --output-path ./lcov.info | |
| - name: Report to codecov.io | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| files: ./lcov.info | |
| fail_ci_if_error: false | |
| verbose: true |