Add webpki-root-certs crate #75
Conversation
|
As extra motivation, wanting full self-signed certs from |
This works for "large" in terms of in-memory size (arguably most important here) and compilation overhead but of course it still bloats the source code and crate download size. A possible alternative might be to put this in another crate, maybe webpki-root-certs? Might make sense if we assume the use case will remain relatively niche (which not be true if most platform-verifier users pull this in?) -- I'm guessing the added maintenance overhead would be minimal. |
|
I quite like the idea of a separate crate; naturally in this repo and workspace. I think it would also make sense to have its versions match webpki-roots. |
That sounds OK to me. Any votes on the name? |
|
I suggested webpki-root-certs in my previous comment, which seems nice. The double plural in roots-certs seems a little awkward? |
It's more idiomatic to use `values()` on a map when the desire is to iterate just the values vs iterating the map and discarding each key from the iterated tuple.
|
Pushed an update with a rework around a separate |
This adds a `const`-friendly `CertificateDer` constructor we will use for a new opt-in `root_certs` feature.
This commit adds a new crate, `webpki-root-certs`, to the project workspace. Compared to `webpki-roots`, this crate contains the full self-signed DER X.509 certificate of each trust anchor in a `TLS_SERVER_ROOT_CERTS` slice. This is done in a separate crate from `webpki-roots` because the X.509 representation is quite large compared to the `webpki`-specific `TrustAnchor` type. However, in some circumstances (e.g. interfacing with non-webpki consumers like platform verifiers) the full self-signed certificates are required. Users with this requirement can depend on this crate in addition to/or in place of `webpki-roots`. Care is taken to push regular users of `rustls` towards the pre-existing crate.
* Add webpki-root-certs and describe why you should probably prefer webpki-roots * Removes the regenerating sources information - this is covered by each individual crate's README. The Warning is left since this is valuable top-level context to remember for each crate.
This branch adds a new crate,
webpki-root-certs, to the project workspace. Compared towebpki-roots, this crate contains the full self-signed DER X.509 certificate of each trust anchor in aTLS_SERVER_ROOT_CERTSslice.This is done in a separate crate from
webpki-rootsbecause the X.509 representation is quite large compared to thewebpki-specificTrustAnchortype. However, in some circumstances (e.g. interfacing with non-webpki consumers like platform verifiers) the full self-signed certificates are required. Users with this requirement can depend on this crate in addition to/or in place ofwebpki-roots. Care is taken to push regular users ofrustlstowards the pre-existing crate.Some related discussion can be found in Discord (e.g. here, and here).