HTHou commented on PR #3606: URL: https://github.com/apache/thrift/pull/3606#issuecomment-4818079298
Thanks for putting this together. Could we consider narrowing the upstream change to a generic TLS-provider compatibility layer, rather than making Tongsuo/NTLS a first-class Thrift backend? The current patch adds Tongsuo-specific build plumbing, `SSLProtocol::NTLS`, and `loadSign*` / `loadEnc*` APIs to `TSSLSocketFactory`. That makes the Tongsuo/TLCP surface part of Thrift's public C++ API/ABI and ongoing build/test matrix. An alternative might be to expose a small backend-neutral extension point around `SSLContext` / `SSL_CTX` creation and configuration, for example allowing applications to provide an already-created `SSLContext`/`SSL_CTX`, or a protected/public hook that creates and configures the context. Then downstream applications that need Tongsuo can link against it themselves and apply the NTLS/TLCP dual-certificate setup in their own factory/subclass, while Thrift only maintains the generic OpenSSL-compatible transport layer. That would still let users avoid carrying a private transport fork, but keeps the provider-specific dependency and policy choices outside the core Thrift tree. Would you be open to reshaping the patch in that direction? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
