It seems like Rustls is the upstream default and what they build their own releases with. I think sticking with the memory‐safe implementation makes more sense without a strong reason to diverge from that.

It seems like Rustls is the upstream default and what they build their own releases with. I think sticking with the memory‐safe implementation makes more sense without a strong reason to diverge from that.

I do not think it's fair to call rustls memory safe, it depends on the ring crate which is largely ASM on x86_64 for performance reasons.

The rationale is that the binary sizes are substantially smaller with libssl, which is almost always already on the system since nix itself links it. Measurements are in the original post.

Well, it’s memory safe in the sense that all Rust is: the bulk of the code involving gnarly and vulnerability‐prone stuff like X.509 parsing etc. is written in a memory‐safe dialect, but at the bottom there are of course primitives that need to be trusted. Cryptography primitives are usually not especially high‐risk for memory safety, since they tend to operate on fixed blocks with known bounds. I don’t think that shaving off a megabyte is worth the sacrifice here without another reason to diverge from upstream to use something less safe.

Would a flag in the package args be a possible solution? There's still the need to agree on whether it should be opt-in or opt-out, but at least it would leave the choice in the hands of the users who care enough to look for it

If there’s a meaningful functionality difference for users (e.g. more protocol versions supported with OpenSSL?), then that could be reasonable. I don’t think we should just delegate every packaging decision to users, though, especially ones trading off memory safety for a megabyte of storage.

The upstream change that added native-tls support justifies it with support for architectures like PowerPC and MIPS. We can’t compile Rust code for MIPS at present. Maybe we can for PowerPC? I’m not sure if there are any NixOS‐on‐PowerPC users (it’s certainly not a platform we support in any official capacity).

I think it makes more sense to stick to the upstream default when it doesn't break functionality. If you really care about this, you can add an option to achieve it.

I'm happy to accept the consensus that it's better off with rustls, thanks everyone for the discussion!