release: use cross + rustls-tls for linux targets#15
Merged
Conversation
The aarch64-unknown-linux-gnu release build was failing because openssl-sys (pulled in by reqwest's native-tls feature) couldn't find aarch64 OpenSSL headers — setup-cross-toolchain-action points the host GCC at a stub sysroot that lacks them. Switch reqwest to rustls-tls so TLS doesn't depend on system libs, and run Linux builds through `cross` (matching fnox) so the Docker image also gives us an older, more portable glibc. Identity::from_pkcs8_pem is native-tls-only, so the per-registry client-cert path now concatenates cert+key into a combined PEM and calls Identity::from_pem, which works under rustls. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Greptile SummaryThis PR fixes a cross-compilation failure for Key changes:
Confidence Score: 5/5Safe to merge — changes are well-scoped, the root cause of the build failure is correctly addressed, and the rustls migration is complete and consistent. All four changed files are coherent: the workspace-level reqwest switch to rustls-tls, the redundant native-tls removal in the registry crate, the Identity::from_pem adaptation (which is the correct API under rustls), and the workflow migration to cross all fit together cleanly. The PEM concatenation correctly inserts a newline between cert and key. No open edge cases were found. No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "release: use cross + rustls-tls for linu..." | Re-trigger Greptile |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit ddb786b. Configure here.
Setting `default-features = false` dropped http2, charset, and system-proxy along with native-tls. http2 is load-bearing — the registry client explicitly relies on ALPN multiplexing for concurrent fetches (see client.rs idle-connection-pool comment). system-proxy matters for users behind corporate proxies. Restore all three. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
jdx
added a commit
that referenced
this pull request
Apr 18, 2026
aube can now be installed via npm (`npm install -g @endevco/aube`), and Linux binaries have been rebuilt with broader glibc compatibility and a pure-Rust TLS stack — no more OpenSSL system dependency. ## Highlights - **Install from npm** — `npm install -g @endevco/aube` ships native binaries for all six supported platforms (macOS, Linux, Windows × arm64/x64). The multicall shims `aubr` and `aubx` work out of the box. - **Better Linux portability** — Linux targets are now built with `cross`, producing binaries that run on older glibc versions. The switch from OpenSSL to `rustls` removes the system OpenSSL dependency entirely. ## Added - **npm distribution** — aube is now published on npm as `@endevco/aube`. At install time, a `preinstall` script fetches the correct `@endevco/aube-<os>-<arch>` sub-package and hardlinks the three binaries (`aube`, `aubr`, `aubx`) into place. No runtime JS shim — npm's bin wrapper calls the native binary directly. Pre-releases use the `next` dist-tag; stable releases use `latest`. ([#12](#12) by @jdx) ```sh npm install -g @endevco/aube # or try it without installing npx @endevco/aube --version ``` > **Note:** Because install relies on `preinstall`, the `--ignore-scripts` flag and fully offline caches are not supported. Use mise or `cargo install` in those environments. ## Changed - **TLS backend switched to rustls** — HTTP requests now use the pure-Rust `rustls` TLS implementation instead of the system's OpenSSL via `native-tls`. This eliminates the need for OpenSSL headers at build time and removes the OpenSSL runtime dependency on Linux. ([#15](#15) by @jdx) - **Linux builds use `cross`** — Linux release binaries (x86_64 and aarch64) are now compiled inside `cross`'s Docker images, which target an older glibc baseline for broader distribution compatibility. ([#15](#15) by @jdx) ## Fixed - **Per-registry client certificate auth** — The mTLS client certificate path now concatenates cert and key into a single PEM buffer and calls `Identity::from_pem`, which works correctly under rustls. The previous `Identity::from_pkcs8_pem` was a `native-tls`-only API. ([#15](#15) by @jdx) **Full Changelog**: 6587e37...16ded6f <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > This is primarily a release/versioning PR (changelogs, version bumps, and dependency lockfile updates) with no functional code changes shown in the diff, so runtime risk is low. > > **Overview** > Prepares the `v1.0.0-beta.2` release by adding a top-level `CHANGELOG.md` and per-crate changelogs, and bumping the workspace + internal crate versions from `1.0.0-beta.1` to `1.0.0-beta.2`. > > Updates `Cargo.lock` for the release (dependency version/lock refresh) and syncs the reported CLI/docs version (`aube.usage.kdl`, `docs/cli/index.md`, `docs/cli/commands.json`) to `1.0.0-beta.2`. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0e53762. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: release-plz[bot] <release-plz+bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
aarch64-unknown-linux-gnuupload-assets job in run 24613265153 failed withfatal error: openssl/opensslconf.h: No such file or directory—openssl-sys(pulled in by reqwest'snative-tlsfeature) couldn't find aarch64 OpenSSL headers.setup-cross-toolchain-actioninstallsaarch64-linux-gnu-gccbut points it at a stub sysroot that lacks the arch-specific openssl config.rustls-tls(pure Rust) so TLS no longer depends on system libraries, and run Linux builds throughcrossso the per-target Docker image also gives us an older, more portable glibc — matching how fnox ships Linux binaries.Identity::from_pkcs8_pemis native-tls-only. The per-registry client-cert path now concatenates cert+key into a combined PEM buffer and callsIdentity::from_pem, which works under rustls.Changes
Cargo.toml— reqwest:default-features = false, addrustls-tlscrates/aube-registry/Cargo.toml— drop now-redundantnative-tlsfeature overridecrates/aube-registry/src/client.rs— switchIdentity::from_pkcs8_pem→Identity::from_pemwith combined cert+key PEM.github/workflows/release.yml— addbuild-toolmatrix column (crossfor Linux,cargoelsewhere); removesetup-cross-toolchain-action(the action installs cross itself)Test plan
cargo buildpasses locallycargo clippy --all-targets -- -D warningscleanaarch64-unknown-linux-gnu🤖 Generated with Claude Code
Note
Medium Risk
Medium risk because it changes the TLS backend for all HTTP calls and modifies the release build pipeline for Linux targets, which could affect network compatibility and artifact portability.
Overview
Switches HTTP TLS from system OpenSSL to pure-Rust
rustls. Workspacereqwestis rebuilt withdefault-features = falseandrustls-tls(droppingnative-tls/OpenSSL dependencies), andaube-registryremoves itsnative-tlsoverride;Cargo.lockupdates accordingly.Updates registry client mTLS handling and release builds. Per-registry client cert/key loading now concatenates cert+key into a single PEM and uses
reqwest::Identity::from_pemfor rustls compatibility, and the release workflow builds Linux targets viacross(matrixbuild-tool) while keepingcargoelsewhere and removing the cross toolchain setup step.Reviewed by Cursor Bugbot for commit e214e23. Bugbot is set up for automated code reviews on this repo. Configure here.