Add rustls-ring feature, probe CA paths for static rustls builds

Cargo.toml

@@ -49,7 +49,8 @@ ssl = ["openssl-sys", "openssl-probe", "curl-sys/ssl"] # OpenSSL/system TLS back
 mesalink = ["curl-sys/mesalink"] # MesaLink TLS backend
 http2 = ["curl-sys/http2"]
 spnego = ["curl-sys/spnego"]
-rustls = ["curl-sys/rustls"]
+rustls = ["curl-sys/rustls", "openssl-probe"]
+rustls-ring = ["curl-sys/rustls-ring", "openssl-probe"]
 static-curl = ["curl-sys/static-curl"]
 apple-sectrust = ["ssl", "static-curl", "curl-sys/apple-sectrust"]
 static-ssl = ["curl-sys/static-ssl"]

README.md

@@ -128,6 +128,8 @@ with various Cargo features:
 
   Note that Rustls support is experimental within Curl itself and may have significant bugs, so we don't offer any sort of stability guarantee with this feature.
 
+- `rustls-ring`: Like `rustls`, but with [ring] as the crypto provider instead of aws-lc-rs. ring needs no cmake at build time and no CPU jitter entropy seeding at startup, which makes it the better fit for cross-compiled and short-lived programs. Disabled by default.
+
 - `http2`: Enable HTTP/2 support via libnghttp2. Disabled by default.
 - `static-curl`: Use a bundled libcurl version and statically link to it. Disabled by default.
 - `apple-sectrust`: Use Apple SecTrust for certificate verification with bundled libcurl and OpenSSL on Apple platforms. Implies `ssl` and `static-curl`. Disabled by default.
@@ -183,5 +185,6 @@ details.
 [libcurl]: https://curl.haxx.se/libcurl/
 [OpenSSL]: https://www.openssl.org/
 [Rustls]: https://github.com/ctz/rustls
+[ring]: https://github.com/briansmith/ring
 [Schannel]: https://docs.microsoft.com/en-us/windows/win32/com/schannel
 [Secure Transport]: https://developer.apple.com/documentation/security/secure_transport

build.rs

@@ -20,7 +20,14 @@ fn main() {
         Err(_) => false,
     };
 
-    if use_openssl {
+    // libcurl's rustls backend loads its roots from CURLOPT_CAINFO / CAPATH as
+    // well (it only uses the platform verifier when CURLSSLOPT_NATIVE_CA is
+    // set), so a static build on rustls needs the probe as much as one on
+    // OpenSSL.
+    let use_rustls = env::var_os("CARGO_FEATURE_RUSTLS").is_some()
+        || env::var_os("CARGO_FEATURE_RUSTLS_RING").is_some();
+
+    if use_openssl || use_rustls {
         let apple_sectrust = env::var_os("CARGO_FEATURE_APPLE_SECTRUST").is_some()
             && env::var("CARGO_CFG_TARGET_VENDOR").ok().as_deref() == Some("apple");
 

curl-sys/Cargo.toml

@@ -29,6 +29,7 @@ libnghttp2-sys = { optional = true, version = "0.1.3" }
 version = "0.15"
 optional = true
 features = ["no_log_capture"]
+default-features = false
 
 [target.'cfg(all(unix))'.dependencies]
 openssl-sys = { workspace = true, optional = true }
@@ -48,7 +49,8 @@ default = ["ssl"]
 ssl = ["openssl-sys"]
 http2 = ["libnghttp2-sys"]
 mesalink = []
-rustls = ["rustls-ffi"]
+rustls = ["rustls-ffi", "rustls-ffi/aws-lc-rs", "rustls-ffi/prefer-post-quantum"]
+rustls-ring = ["rustls-ffi", "rustls-ffi/ring"]
 static-curl = []
 apple-sectrust = ["ssl", "static-curl"]
 windows-static-ssl = []

curl-sys/build.rs

@@ -350,7 +350,7 @@ fn main() {
 
     // Configure TLS backend. Since Cargo does not support mutually exclusive
     // features, make sure we only compile one vtls.
-    if cfg!(feature = "rustls") {
+    if cfg!(any(feature = "rustls", feature = "rustls-ring")) {
         cfg.define("USE_RUSTLS", None)
             .file("curl/lib/vtls/cipher_suite.c")
             .file("curl/lib/vtls/rustls.c")

curl-sys/lib.rs

@@ -8,7 +8,7 @@ extern crate libnghttp2_sys;
 extern crate libz_sys;
 #[cfg(link_openssl)]
 extern crate openssl_sys;
-#[cfg(feature = "rustls")]
+#[cfg(any(feature = "rustls", feature = "rustls-ring"))]
 extern crate rustls_ffi;
 
 use libc::c_ulong;