From 0b4488aee675ee51db17765c5dd14dd7db2e1a1e Mon Sep 17 00:00:00 2001 From: pizzle85-maker Date: Tue, 22 Sep 2026 10:30:26 -0400 Subject: [PATCH 1/2] fix: eliminate transitive OpenSSL dependency via rustls teller-providers depended on both vaultrs (which already defaults to the rustls TLS backend) and rustify directly. rustify was left on its own default features, which select reqwest's native-tls backend. Since Cargo unifies features across a dependency graph, this silently pulled openssl-sys/native-tls back into the final binary even though vaultrs had already opted out of it. Pin both vaultrs and rustify to their rustls feature explicitly and disable default features, so the whole dependency tree is TLS-backend consistent. Confirmed openssl-sys no longer appears anywhere in `cargo tree`, and the resulting release binary has zero libssl runtime dependency (checked with ldd). This is the actual fix for #290 ("Deprecated OpenSSL 1.1.1 Dependency on Linux") - the released v2.0.7 binary links against libssl.so.1.1 because it happened to be built on an ubuntu-20.04 runner (system OpenSSL 1.1.1), not because any dependency requires OpenSSL 1.1.1 specifically. With this change, no OpenSSL version is linked at all. Co-Authored-By: Claude Sonnet 5 --- Cargo.lock | 111 ------------------------------------ teller-providers/Cargo.toml | 4 +- 2 files changed, 2 insertions(+), 113 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index f3f33b5a..46833ede 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1532,21 +1532,6 @@ version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2" -[[package]] -name = "foreign-types" -version = "0.3.2" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1" -dependencies = [ - "foreign-types-shared", -] - -[[package]] -name = "foreign-types-shared" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b" - [[package]] name = "form_urlencoded" version = "1.2.2" @@ -2069,22 +2054,6 @@ dependencies = [ "tower-service", ] -[[package]] -name = "hyper-tls" -version = "0.6.0" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0" -dependencies = [ - "bytes", - "http-body-util", - "hyper 1.8.1", - "hyper-util", - "native-tls", - "tokio", - "tokio-native-tls", - "tower-service", -] - [[package]] name = "hyper-util" version = "0.1.19" @@ -2529,23 +2498,6 @@ version = "0.10.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084" -[[package]] -name = "native-tls" -version = "0.2.14" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e" -dependencies = [ - "libc", - "log", - "openssl", - "openssl-probe 0.1.6", - "openssl-sys", - "schannel", - "security-framework 2.11.1", - "security-framework-sys", - "tempfile", -] - [[package]] name = "normalize-line-endings" version = "0.3.0" @@ -2606,32 +2558,6 @@ version = "1.70.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" -[[package]] -name = "openssl" -version = "0.10.75" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328" -dependencies = [ - "bitflags 2.10.0", - "cfg-if", - "foreign-types", - "libc", - "once_cell", - "openssl-macros", - "openssl-sys", -] - -[[package]] -name = "openssl-macros" -version = "0.1.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" -dependencies = [ - "proc-macro2", - "quote", - "syn 2.0.114", -] - [[package]] name = "openssl-probe" version = "0.1.6" @@ -2644,18 +2570,6 @@ version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe" -[[package]] -name = "openssl-sys" -version = "0.9.111" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321" -dependencies = [ - "cc", - "libc", - "pkg-config", - "vcpkg", -] - [[package]] name = "os_pipe" version = "1.2.3" @@ -2846,12 +2760,6 @@ version = "0.1.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184" -[[package]] -name = "pkg-config" -version = "0.3.32" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" - [[package]] name = "potential_utf" version = "0.1.4" @@ -3204,11 +3112,9 @@ dependencies = [ "http-body-util", "hyper 1.8.1", "hyper-rustls 0.27.7", - "hyper-tls", "hyper-util", "js-sys", "log", - "native-tls", "percent-encoding 2.3.2", "pin-project-lite", "quinn", @@ -3219,7 +3125,6 @@ dependencies = [ "serde_urlencoded", "sync_wrapper", "tokio", - "tokio-native-tls", "tokio-rustls 0.26.4", "tower", "tower-http", @@ -4330,16 +4235,6 @@ dependencies = [ "syn 2.0.114", ] -[[package]] -name = "tokio-native-tls" -version = "0.3.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2" -dependencies = [ - "native-tls", - "tokio", -] - [[package]] name = "tokio-rustls" version = "0.24.1" @@ -4842,12 +4737,6 @@ dependencies = [ "url 2.5.8", ] -[[package]] -name = "vcpkg" -version = "0.2.15" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" - [[package]] name = "version_check" version = "0.9.5" diff --git a/teller-providers/Cargo.toml b/teller-providers/Cargo.toml index 6704dc56..c0cf35ca 100644 --- a/teller-providers/Cargo.toml +++ b/teller-providers/Cargo.toml @@ -61,8 +61,8 @@ aws-sdk-secretsmanager = { version = "1.74.0", optional = true } # dotenv dotenvy = { version = "0.15.7", optional = true } # hashivault -vaultrs = { version = "0.7.4", optional = true } -rustify = { version = "0.6.1", optional = true } +vaultrs = { version = "0.7.4", optional = true, default-features = false, features = ["rustls"] } +rustify = { version = "0.6.1", optional = true, default-features = false, features = ["rustls-tls"] } # HashiCorp Consul rs-consul = { version = "0.13.0", optional = true } From 9ed231f9932bfc3ffefebdc403b4155540f7dece Mon Sep 17 00:00:00 2001 From: pizzle85-maker Date: Tue, 22 Sep 2026 10:30:39 -0400 Subject: [PATCH 2/2] ci: modernize GitHub Actions and clear pre-existing lint/test failures master's CI has been red since the last "fix build" commits in January, which is very likely why no release has shipped since v2.0.7 (2024-05-20) despite real fixes landing on master since then: - actions-rs/toolchain and actions-rs/cargo are from an org archived since November 2021; replaced with dtolnay/rust-toolchain and plain `cargo` invocations in both build.yml and release.yml. - actions/upload-artifact@v2 and actions/download-artifact@v2 stopped working entirely on 2025-01-30 (GitHub fully shut off the v1/v2 APIs) - release.yml's Dist/Publish jobs cannot currently complete even if a tag is pushed. Bumped to v4, including download-artifact's `pattern` input to preserve the per-platform directory layout the publish script expects. - release.yml's x86_64-linux Dist job pinned `ubuntu-20.04`, a runner image GitHub has since retired. Bumped to `ubuntu-22.04`. (This was also the direct cause of the OpenSSL 1.1.1 linking in the v2.0.7 release binary - ubuntu-20.04's system OpenSSL is 1.1.1 - though the previous commit's fix means the runner's OpenSSL version no longer matters either way.) - Replaced the deprecated `::set-output::` workflow command in release.yml's publish job with $GITHUB_OUTPUT. - Fixed the 3 cargo clippy errors (-D warnings with pedantic/nursery enabled) and 1 stale rustfmt formatting spot that were failing the Lints job, and one stale trycmd test snapshot (delete.trycmd) that no longer matched current error-message formatting, failing the Test Suite job. Verified locally: `cargo fmt --all -- --check`, `cargo clippy --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idioms`, and `cargo test --all-features --all` (for teller/teller-core/teller-providers) all pass cleanly. The one remaining test failure is providers::etcd::tests::sanity_test, which is unrelated to this change: Bitnami removed the `bitnami/etcd` image from Docker Hub entirely in their 2025 catalog restructuring (zero tags now exist for bitnami/etcd), so that integration test needs a different image - a separate, maintainer judgment call left out of scope here. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/build.yml | 31 ++++----------- .github/workflows/release.yml | 39 +++++++------------ teller-cli/tests/cmd/delete.trycmd | 2 +- teller-providers/src/providers/dotenv.rs | 2 +- teller-providers/src/providers/etcd.rs | 5 +-- .../src/providers/hashicorp_consul.rs | 7 +--- 6 files changed, 27 insertions(+), 59 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4733adac..e4f45cd4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,11 +23,9 @@ jobs: uses: actions/checkout@v4 - name: Install stable toolchain - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: - profile: minimal toolchain: ${{ matrix.rust }} - override: true - uses: Swatinem/rust-cache@v2 @@ -37,10 +35,7 @@ jobs: tool: protoc - name: Run cargo test - uses: actions-rs/cargo@v1 - with: - command: test - args: --all-features --all + run: cargo test --all-features --all coverage: name: Coverage @@ -54,10 +49,9 @@ jobs: uses: actions/checkout@v4 - name: Install stable toolchain - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: toolchain: ${{ matrix.rust }} - override: true components: llvm-tools-preview - uses: Swatinem/rust-cache@v2 @@ -74,10 +68,7 @@ jobs: echo "$HOME/.local/bin" >> $GITHUB_PATH - name: Run xtask coverage - uses: actions-rs/cargo@v1 - with: - command: xtask - args: coverage + run: cargo xtask coverage - name: Upload to codecov.io uses: codecov/codecov-action@v3 @@ -94,11 +85,9 @@ jobs: submodules: true - name: Install stable toolchain - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: - profile: minimal toolchain: stable - override: true components: rustfmt, clippy - uses: Swatinem/rust-cache@v2 @@ -109,13 +98,7 @@ jobs: tool: protoc - name: Run cargo fmt - uses: actions-rs/cargo@v1 - with: - command: fmt - args: --all -- --check + run: cargo fmt --all -- --check - name: Run cargo clippy - uses: actions-rs/cargo@v1 - with: - command: clippy - args: --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idioms + run: cargo clippy --all-features -- -D warnings -W clippy::pedantic -W clippy::nursery -W rust-2018-idioms diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d3eb2986..81dc6a64 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -32,11 +32,9 @@ jobs: uses: actions/checkout@v4 - name: Install stable toolchain - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: - profile: minimal toolchain: ${{ matrix.rust }} - override: true - name: Install Protoc uses: taiki-e/install-action@v2 @@ -46,10 +44,7 @@ jobs: - uses: Swatinem/rust-cache@v2 - name: Run cargo test - uses: actions-rs/cargo@v1 - with: - command: test - args: --all-features --all + run: cargo test --all-features --all dist: name: Dist runs-on: ${{ matrix.os }} @@ -60,7 +55,7 @@ jobs: build: [x86_64-linux, aarch64-macos, x86_64-macos, x86_64-windows] #, x86_64-win-gnu, win32-msvc aarch64-linux, include: - build: x86_64-linux - os: ubuntu-20.04 + os: ubuntu-22.04 rust: stable target: x86_64-unknown-linux-gnu cross: false @@ -95,7 +90,7 @@ jobs: steps: - name: Checkout sources - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: submodules: true @@ -109,23 +104,17 @@ jobs: tool: protoc - name: Install ${{ matrix.rust }} toolchain - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: - profile: minimal toolchain: ${{ matrix.rust }} - target: ${{ matrix.target }} - override: true + targets: ${{ matrix.target }} - name: Install OpenSSL if: matrix.build == 'aarch64-linux' run: sudo apt-get install libssl-dev pkg-config - name: Build release binary - uses: actions-rs/cargo@v1 - with: - use-cross: ${{ matrix.cross }} - command: build - args: --release --locked --target ${{ matrix.target }} + run: cargo build --release --locked --target ${{ matrix.target }} - name: Strip release binary (linux and macos) if: matrix.build == 'x86_64-linux' || matrix.build == 'x86_64-macos' @@ -151,7 +140,7 @@ jobs: cp "target/${{ matrix.target }}/release/$BIN_NAME" "dist/" fi - - uses: actions/upload-artifact@v2.2.4 + - uses: actions/upload-artifact@v4 with: name: bins-${{ matrix.build }} path: dist @@ -162,14 +151,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout sources - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: submodules: false - - uses: actions/download-artifact@v2 - # with: - # path: dist - # - run: ls -al ./dist + - uses: actions/download-artifact@v4 + with: + pattern: bins-* + # - run: ls -al ./dist - run: ls -al bins-* - name: Calculate tag name @@ -178,7 +167,7 @@ jobs: if [[ $GITHUB_REF == refs/tags/v* ]]; then name=${GITHUB_REF:10} fi - echo ::set-output name=val::$name + echo "val=$name" >> "$GITHUB_OUTPUT" echo TAG=$name >> $GITHUB_ENV id: tagname diff --git a/teller-cli/tests/cmd/delete.trycmd b/teller-cli/tests/cmd/delete.trycmd index b0a140da..85ee6926 100644 --- a/teller-cli/tests/cmd/delete.trycmd +++ b/teller-cli/tests/cmd/delete.trycmd @@ -12,7 +12,7 @@ $ teller delete --providers new --map-id one $ teller show ? 1 -Error: NOT FOUND "new.env": file is empty +Error: NOT FOUND new.env: file is empty Location: [..] diff --git a/teller-providers/src/providers/dotenv.rs b/teller-providers/src/providers/dotenv.rs index dba0d1f6..982bf3e8 100644 --- a/teller-providers/src/providers/dotenv.rs +++ b/teller-providers/src/providers/dotenv.rs @@ -105,7 +105,7 @@ fn save(path: &Path, data: &BTreeMap) -> Result { serde_json::from_str(v); let json_value = if maybe_json.is_ok() { - serde_json::to_string(&v).map(Some).unwrap_or_default() + serde_json::to_string(&v).ok() } else { None }; diff --git a/teller-providers/src/providers/etcd.rs b/teller-providers/src/providers/etcd.rs index b5693c5c..57cd1b7c 100644 --- a/teller-providers/src/providers/etcd.rs +++ b/teller-providers/src/providers/etcd.rs @@ -179,7 +179,7 @@ impl Provider for Etcd { .await .map_err(|err| to_err(pm, err))?; } else { - for key in pm.keys.keys().map(|kv| format!("{}/{kv}", &pm.path)) { + for key in pm.keys.keys().map(|kv| format!("{}/{kv}", pm.path)) { client .delete(key, None) .await @@ -229,8 +229,7 @@ mod tests { #[cfg(not(target_arch = "aarch64"))] let image_name = "bitnami/etcd"; - let image = Image::with_repository(image_name) - .pull_policy(dockertest::PullPolicy::Always); + let image = Image::with_repository(image_name).pull_policy(dockertest::PullPolicy::Always); let mut etcd_container = Composition::with_image(image) .with_container_name("etcd-server") .with_env(env) diff --git a/teller-providers/src/providers/hashicorp_consul.rs b/teller-providers/src/providers/hashicorp_consul.rs index d363c66f..eb4d230b 100644 --- a/teller-providers/src/providers/hashicorp_consul.rs +++ b/teller-providers/src/providers/hashicorp_consul.rs @@ -87,10 +87,7 @@ impl HashiCorpConsul { let token = opts .token .as_ref() - .map_or_else( - || env::var("CONSUL_HTTP_TOKEN"), - |token| Ok(token.clone()), - ) + .map_or_else(|| env::var("CONSUL_HTTP_TOKEN"), |token| Ok(token.clone())) .unwrap_or_default(); Ok(Self { @@ -181,7 +178,7 @@ impl Provider for HashiCorpConsul { } else { pm.keys .keys() - .map(|kv| format!("{}/{kv}", &pm.path)) + .map(|kv| format!("{}/{kv}", pm.path)) .collect::>() };