Repository navigation
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The prerequisite dependency is not yet consumed, malformed Ed25519 parameters remain accepted, and the documented MSRV and new RNG coverage need correction.
4 open findings
What changed in this PR
Replaces bundled wolfCrypt bindings with wolfSSL’s official Rust crate and updates integration, key handling, RNG reuse, documentation, and CI.
Changes:
- Removes the local
wolfcrypt-rscrate and migrates imports towolfssl-wolfcrypt. - Adds thread-local RNG reuse and refactors X25519 and Ed25519 handling.
- Updates rustls, dependencies, documentation, and wolfSSL CI setup.
| File | Description |
|---|---|
wolfcrypt-rs/src/lib.rs |
Removes the bundled bindings crate implementation. |
wolfcrypt-rs/src/bindings.rs |
Removes generated-binding inclusion. |
wolfcrypt-rs/Makefile |
Removes obsolete crate tasks. |
wolfcrypt-rs/libraries.h |
Removes bindgen headers. |
wolfcrypt-rs/Cargo.toml |
Removes the local crate manifest. |
wolfcrypt-rs/Cargo.lock |
Removes its dependency lockfile. |
wolfcrypt-rs/build.rs |
Removes wolfSSL download/build/bindgen logic. |
rustls-wolfcrypt-provider/tests/e2e.rs |
Uses official bindings and configurable wolfSSL server paths. |
rustls-wolfcrypt-provider/src/verify/rsapss.rs |
Migrates RSA-PSS bindings import. |
rustls-wolfcrypt-provider/src/verify/rsapkcs1.rs |
Migrates RSA PKCS#1 bindings import. |
rustls-wolfcrypt-provider/src/verify/eddsa.rs |
Migrates EdDSA bindings import. |
rustls-wolfcrypt-provider/src/verify/ecdsa.rs |
Migrates ECDSA bindings import. |
rustls-wolfcrypt-provider/src/types/mod.rs |
Migrates wrapped wolfCrypt types. |
rustls-wolfcrypt-provider/src/sign/rsa.rs |
Migrates RSA signing bindings. |
rustls-wolfcrypt-provider/src/sign/eddsa.rs |
Replaces Ed25519 PKCS#8 parsing. |
rustls-wolfcrypt-provider/src/sign/ecdsa.rs |
Migrates ECDSA signing bindings. |
rustls-wolfcrypt-provider/src/random.rs |
Adds per-thread RNG reuse under std. |
rustls-wolfcrypt-provider/src/prf.rs |
Migrates PRF bindings import. |
rustls-wolfcrypt-provider/src/lib.rs |
Makes std available to its feature path. |
rustls-wolfcrypt-provider/src/kx/x25519.rs |
Uses the official safe X25519 wrapper. |
rustls-wolfcrypt-provider/src/kx/sec521r1.rs |
Migrates P-521 bindings import. |
rustls-wolfcrypt-provider/src/kx/sec384r1.rs |
Migrates P-384 bindings import. |
rustls-wolfcrypt-provider/src/kx/sec256r1.rs |
Migrates P-256 bindings import. |
rustls-wolfcrypt-provider/src/hmac/mod.rs |
Migrates HMAC symbols. |
rustls-wolfcrypt-provider/src/hkdf.rs |
Migrates HKDF bindings import. |
rustls-wolfcrypt-provider/src/hash/sha384.rs |
Migrates SHA-384 bindings import. |
rustls-wolfcrypt-provider/src/hash/sha256.rs |
Migrates SHA-256 bindings import. |
rustls-wolfcrypt-provider/src/aead/quic.rs |
Migrates QUIC bindings import. |
rustls-wolfcrypt-provider/src/aead/chacha20.rs |
Removes RustCrypto key-size dependency. |
rustls-wolfcrypt-provider/src/aead/aes256gcm.rs |
Migrates AES-256-GCM bindings. |
rustls-wolfcrypt-provider/src/aead/aes128gcm.rs |
Migrates AES-128-GCM bindings. |
rustls-wolfcrypt-provider/Cargo.toml |
Updates rustls and adopts the official crate. |
rustls-wolfcrypt-provider/Cargo.lock |
Refreshes the resolved dependency graph. |
README.md |
Documents external wolfSSL installation. |
.gitignore |
Removes obsolete local-crate exclusions. |
.github/workflows/ubuntu-rustls-tests.yml |
Builds wolfSSL for Ubuntu compatibility tests. |
.github/workflows/ubuntu-build.yml |
Builds wolfSSL for Ubuntu CI. |
.github/workflows/macos-rustls-tests.yml |
Builds wolfSSL for macOS compatibility tests. |
.github/workflows/macos-build.yml |
Builds wolfSSL for macOS CI. |
.github/test-workspace/provider-Cargo.toml |
Migrates compatibility-test dependencies. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
gasbytes
force-pushed
the
use-wolfssl-wolfcrypt-crate
branch
2 times, most recently
from
October 13, 2026 17:07
2df18b5 to
231e2f7
Compare
gasbytes
force-pushed
the
use-wolfssl-wolfcrypt-crate
branch
from
October 13, 2026 17:25
231e2f7 to
3b9c7db
Compare
gasbytes
marked this pull request as ready for review
October 13, 2026 17:31
holtrop-wolfssl
requested changes
Oct 13, 2026
| env_logger = { version = "0.11.6", default-features = false } | ||
| wolfcrypt-rs = { path = "../wolfcrypt-rs" } | ||
| wolfssl-wolfcrypt = { git = "https://github.com/wolfSSL/wolfssl" } | ||
| rustls-pemfile = { version = "2.2.0", default-features = false } |
Contributor
There was a problem hiding this comment.
Is the expectation to change this to the published 3.0.0 version when that is available?
| - name: Use the wolfCrypt crate from wolfSSL master | ||
| run: | | ||
| mkdir -p .cargo | ||
| printf '[patch."https://github.com/wolfSSL/wolfssl"]\nwolfssl-wolfcrypt = { path = "%s/wrapper/rust/wolfssl-wolfcrypt" }\n' \ |
Contributor
There was a problem hiding this comment.
Will cargo not find the crate in the repository subdirectory without this?
| match hash_type { | ||
| wolfcrypt_rs::wc_HashType_WC_HASH_TYPE_SHA256 => WCShaHmac::Sha256, | ||
| wolfcrypt_rs::wc_HashType_WC_HASH_TYPE_SHA384 => WCShaHmac::Sha384, | ||
| wolfssl_wolfcrypt::sys::wc_HashType_WC_HASH_TYPE_SHA256 => WCShaHmac::Sha256, |
Contributor
There was a problem hiding this comment.
I didn't fully evaluate the callers into here, but there are pub consts for these (e.g. TYPE_SHA256 from hmac.rs) if it makes more sense to use them instead of the sys items directly.
| use alloc::vec::Vec; | ||
| use core::ptr; | ||
| use wolfcrypt_rs::*; | ||
| use wolfssl_wolfcrypt::sys::*; |
Contributor
There was a problem hiding this comment.
I noticed that many files use wolfssl_wolfcrypt::sys::* rather than the Rust-provided APIs. Is that because it was too big of a change to switch to the Rust APIs (or that was just out of scope so far)? Or is there any functionality missing in the Rust API that would be needed here?
Contributor
|
This is an exciting change to see! I marked as "requesting change" rather than approve not because I am asking for any specific change, but just had some questions and didn't want someone to merge before getting answers. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the provider onto wolfssl's official Rust crate, removes some unused RustCrypto deps, reuses one RNG per thread, and bumps rustls to 0.23.45.
Also now the ed25519 pkcs#8 v2 keys that don't contain an embedded public key are now rejected.