d2d3b0c827
All checks were successful
ci / test (pull_request) Successful in 3m30s
GREEN. rustls 0.23 selects its CryptoProvider from its own 'ring' /
'aws-lc-rs' crate features. Arti reaches rustls through tor-rtcompat with
default-features = false and nothing in this workspace turned a provider
feature on, so rustls was compiled with zero providers and the first TLS
config built from the process default panicked:
Could not automatically determine the process-level CryptoProvider from
Rustls crate features. ...
That is the 'Failed to start' screen on the unlock path. The 'ring' crate
being present in the graph (via snow, for Noise) never had anything to do
with it.
'ring', not 'aws-lc-rs': aws-lc-rs wants CMake and a C toolchain for the
NDK and fights the cross-compile.
Belt and braces: open_wire() now calls install_crypto_provider() before
Node::start_with_passphrase, a OnceLock-guarded
ring::default_provider().install_default() with the already-installed Err
ignored. That keeps the cdylib correct regardless of how a consumer's
feature graph resolves rustls.
aws-lc-rs is absent from the lock, so there is no two-provider conflict to
report.
Evidence:
cargo test --release --test provider_resolution
before: panicked at rustls-0.23.44/src/crypto/mod.rs:249 (device message)
after: 1 passed
cargo tree -f '{p} [{f}]' -p rustls
rustls v0.23.44 [log,logging,ring,std,tls12]
51 lines
2 KiB
TOML
51 lines
2 KiB
TOML
[package]
|
|
name = "onionwire-sdk"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
rust-version = "1.91"
|
|
description = "OnionWire Android/Kotlin SDK: in-process Arti onion transport, Noise IK, identity = ed25519 pubkey."
|
|
license = "MIT"
|
|
publish = false
|
|
|
|
# Standalone workspace on purpose.
|
|
#
|
|
# Arti's TLS backends (`native-tls` vs `rustls`) are non-additive: exactly one
|
|
# may be enabled per feature resolution. The Linux TUI crate keeps native-tls,
|
|
# Android has no OpenSSL in the NDK and needs rustls. Two separate workspaces
|
|
# keep the two resolutions from colliding — this crate path-depends on the
|
|
# root package without joining its feature graph.
|
|
[workspace]
|
|
|
|
[lib]
|
|
name = "onionwire_sdk"
|
|
crate-type = ["cdylib", "lib"]
|
|
|
|
[dependencies]
|
|
onionwire = { path = "../..", default-features = false, features = ["rustls"] }
|
|
# `static-sqlite`: Android has no system libsqlite3 to link against.
|
|
arti-client = { version = "0.46", default-features = false, features = [
|
|
"tokio",
|
|
"onion-service-client",
|
|
"onion-service-service",
|
|
"compression",
|
|
"rustls",
|
|
"static-sqlite",
|
|
] }
|
|
tokio = { version = "1", features = ["rt-multi-thread", "time"] }
|
|
# rustls 0.23 resolves its provider from its OWN `ring` / `aws-lc-rs` features,
|
|
# never from whichever crypto crates happen to be linked in the graph. Arti
|
|
# pulls rustls in through `tor-rtcompat` with `default-features = false`, so
|
|
# without this line rustls compiles with zero providers and the first TLS config
|
|
# built from the process default fails at runtime — the "Failed to start /
|
|
# Could not automatically determine the process-level CryptoProvider" screen.
|
|
#
|
|
# `ring`, not `aws-lc-rs`: aws-lc-rs needs CMake and a C toolchain for the NDK
|
|
# and fights the Android cross-compile. The `ring` crate was already in the
|
|
# graph (via `snow`, for Noise) but that is a different thing entirely.
|
|
rustls = { version = "0.23", default-features = false, features = ["ring"] }
|
|
uniffi = { version = "0.32", features = ["cli", "tokio"] }
|
|
thiserror = "2"
|
|
|
|
[[bin]]
|
|
name = "uniffi-bindgen"
|
|
path = "src/bin/uniffi-bindgen.rs"
|