hongzhi-gao commented on PR #3606: URL: https://github.com/apache/thrift/pull/3606#issuecomment-4840851029
> Thanks for putting this together. Could we consider narrowing the upstream change to a generic TLS-provider compatibility layer, rather than making Tongsuo/NTLS a first-class Thrift backend? > > The current patch adds Tongsuo-specific build plumbing, `SSLProtocol::NTLS`, and `loadSign*` / `loadEnc*` APIs to `TSSLSocketFactory`. That makes the Tongsuo/TLCP surface part of Thrift's public C++ API/ABI and ongoing build/test matrix. > > An alternative might be to expose a small backend-neutral extension point around `SSLContext` / `SSL_CTX` creation and configuration, for example allowing applications to provide an already-created `SSLContext`/`SSL_CTX`, or a protected/public hook that creates and configures the context. Then downstream applications that need Tongsuo can link against it themselves and apply the NTLS/TLCP dual-certificate setup in their own factory/subclass, while Thrift only maintains the generic OpenSSL-compatible transport layer. > > That would still let users avoid carrying a private transport fork, but keeps the provider-specific dependency and policy choices outside the core Thrift tree. Would you be open to reshaping the patch in that direction? 1. Fixed by removing the Tongsuo-specific loadSign* / loadEnc* APIs entirely. The reshaped patch no longer adds those methods. 2. Added a Licensing section: Thrift still depends only on OpenSSL by default; Tongsuo is an application-side choice (Apache 2.0, ASF Category A) and is not vendored or added to Thrift's build. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
