HTHou opened a new pull request, #3638: URL: https://github.com/apache/thrift/pull/3638
## Summary - add optional rustls-backed `TTlsClientChannel` and `TTlsServerChannel` transports - add `TServer::listen_tls` while keeping TLS configuration, trust anchors, client authentication, protocol versions, and crypto-provider selection under application control - extract `TSharedChannel` so a non-cloneable bidirectional TLS stream can be split safely for Thrift input and output transports - enable Rust client/server TLS cross-tests for buffered and framed transports across the supported protocols - document the Rust TLS API, feature flag, MSRV, and threat-model behavior This addresses [THRIFT-6097](https://issues.apache.org/jira/browse/THRIFT-6097). ## Compatibility The new `rustls` feature is optional and is not enabled by Thrift's default feature set, so existing users do not acquire a TLS dependency unless they opt in. The runtime does not select a crypto provider or load certificates/system roots; callers pass a fully configured rustls `ClientConfig` or `ServerConfig`. The Rust binding and generated code retain their Rust 1.65 baseline. Enabling the optional `rustls` feature requires Rust 1.71 or newer, matching rustls 0.23's declared MSRV. ## Dependency licensing - `rustls` is an optional library dependency (`0.23.42` currently resolved), licensed under `Apache-2.0 OR ISC OR MIT`; this contribution consumes it under the Apache-2.0 option. - `rustls-pemfile` is used only by the Rust cross-test binaries (`2.2.0` currently resolved), with the same `Apache-2.0 OR ISC OR MIT` terms and Apache-2.0 option. - The repository enables the `ring` provider only for Rust unit/cross-tests (`0.17.14` currently resolved); the library feature itself remains provider-neutral. `ring` is licensed under `Apache-2.0 AND ISC`. - Resolved transitive dependencies use Apache-2.0, MIT, ISC, or BSD-3-Clause terms (including `rustls-webpki`/`untrusted`: ISC; `subtle`: BSD-3-Clause; and `rustls-pki-types`/`once_cell`/`zeroize`: Apache-2.0/MIT). All of these are [ASF Category A licenses](https://www.apache.org/legal/resolved.html#category-a); no Category B or Category X dependency is introduced. No dependency source or binary is vendored into the Apache Thrift source distribution: Cargo downloads the crates separately at build/test time. Therefore the root `LICENSE` and `NOTICE` remain unchanged, following ASF guidance for [non-bundled dependencies](https://infra.apache.org/licensing-howto.html#bundled-vs-non-bundled-dependencies). ## Validation - `cargo fmt --all -- --check` (`lib/rs` and `test/rs`) - `cargo check --no-default-features --features rustls` (`lib/rs`) - `cargo test --all-features` (`lib/rs`: 175 unit tests, 2 shared-channel tests, 3 TLS tests, and 23 doc tests) - `cargo test` (`test/rs`) - `python3 test/test.py --server rs --client rs -R ip-ssl -j 1` (16/16 TLS combinations passed) - codespell check over the added lines ## AI assistance This change was developed with OpenAI Codex (GPT-5). The single commit contains the corresponding `Co-Authored-By` trailer. ## Checklist - [x] Created Apache JIRA ticket THRIFT-6097. - [x] PR title starts with `THRIFT-6097:`. - [x] Squashed the change to a single commit. - [x] Avoided a breaking default: TLS is opt-in through an optional feature. - [x] This PR contains code, so `[skip ci]` is not used. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
