Skip to content

Commit 16884e5

Browse files
maxlambrechtmaxlambrecht
authored
feat: introduce spiffe-rustls crate for rustls integration (#189)
Signed-off-by: Max Lambrecht <[email protected]>
1 parent b7076d0 commit 16884e5

25 files changed

+1623
-11
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,23 @@ jobs:
6262
with:
6363
shared-key: ${{ runner.os }}-cargo
6464

65-
- name: Build Rust project
66-
run: cargo build --all-targets --all-features
65+
- name: Build workspace (default features)
66+
run: cargo build --workspace --all-targets
67+
68+
- name: Test workspace
69+
run: cargo test --workspace
70+
71+
- name: Build spiffe-rustls (aws-lc-rs)
72+
run: cargo build -p spiffe-rustls --no-default-features --features aws-lc-rs --all-targets
73+
74+
- name: Test spiffe-rustls (aws-lc-rs)
75+
run: cargo test -p spiffe-rustls --no-default-features --features aws-lc-rs
76+
77+
- name: Build spiffe-rustls examples (tcp)
78+
run: cargo build -p spiffe-rustls --features tcp-examples --examples
79+
80+
- name: Build spiffe-rustls examples (grpc)
81+
run: cargo build -p spiffe-rustls --features grpc-examples --examples
6782

6883
- name: Start SPIRE
6984
run: .github/workflows/scripts/run-spire.sh

‎Cargo.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,7 @@
22
members = [
33
"spiffe",
44
"spire-api",
5+
"spiffe-rustls",
56
]
7+
68
resolver = "2"

‎README.md‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,45 @@
44
[![Coverage](https://coveralls.io/repos/github/maxlambrecht/rust-spiffe/badge.svg?branch=main)](https://coveralls.io/github/maxlambrecht/rust-spiffe?branch=main)
55
[![Docs](https://docs.rs/spiffe/badge.svg)](https://docs.rs/spiffe/)
66

7-
This repository contains two distinct Rust libraries focused on supporting SPIRE functionalities:
7+
This repository contains a set of Rust libraries focused on supporting SPIFFE and SPIRE
8+
functionality across different layers of the stack.
89

910
## [spiffe](./spiffe)
1011

11-
The `spiffe` crate enables interaction with
12-
the [SPIFFE Workload API](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md). It allows
13-
fetching of X.509 and JWT SVIDs, bundles, and supports watch/stream updates. The types in the library are in compliance
14-
with [SPIFFE standards](https://github.com/spiffe/spiffe/tree/main/standards). More about SPIFFE can be found
15-
at [spiffe.io](https://spiffe.io/).
12+
The `spiffe` crate enables interaction with the
13+
[SPIFFE Workload API](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md).
14+
It supports fetching X.509 and JWT SVIDs, trust bundles, and watch/stream updates.
1615

17-
- [Read the README](./spiffe/README.md) for more information.
16+
The types and behaviors in this crate are compliant with
17+
[SPIFFE standards](https://github.com/spiffe/spiffe/tree/main/standards).
18+
More information about SPIFFE can be found at [spiffe.io](https://spiffe.io/).
19+
20+
- [Read the README](./spiffe/README.md) for usage and API details.
1821

1922
## [spire-api](./spire-api)
2023

21-
The `spire-api` crate provides support for SPIRE specific APIs, including the Delegated Identity API.
24+
The `spire-api` crate provides support for SPIRE-specific APIs, including the
25+
Delegated Identity API and related SPIRE extensions.
2226

2327
- [Read the README](./spire-api/README.md) for more information.
2428

29+
## [spiffe-rustls](./spiffe-rustls)
30+
31+
The `spiffe-rustls` crate integrates SPIFFE identity with
32+
[`rustls`](https://crates.io/crates/rustls) using the `spiffe` crate’s `X509Source`
33+
(SPIRE Workload API).
34+
35+
It provides builders for `rustls::ClientConfig` and `rustls::ServerConfig` backed by a
36+
live `X509Source`, enabling automatic use of rotated SVIDs and trust bundles in new TLS
37+
handshakes. The crate focuses on authentication and connection-level authorization via SPIFFE IDs, while
38+
delegating cryptography and TLS mechanics to `rustls`.
39+
40+
- [Read the README](./spiffe-rustls/README.md) for details and examples.
41+
2542
## Getting Started
2643

27-
Follow the links above to the individual README files for detailed information on how to use each library.
44+
Follow the links above to the individual README files for detailed information on how to
45+
use each library.
2846

2947
## License
3048

‎spiffe-rustls/Cargo.toml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
[package]
2+
name = "spiffe-rustls"
3+
version = "0.1.0"
4+
edition = "2024"
5+
license = "Apache-2.0"
6+
description = "SPIFFE/SPIRE integration for rustls"
7+
repository = "https://github.com/maxlambrecht/rust-spiffe"
8+
readme = "README.md"
9+
keywords = ["spiffe", "spire", "rustls", "mtls", "tls"]
10+
categories = ["network-programming", "cryptography", "authentication"]
11+
12+
# ----------------------------
13+
# Features
14+
# ----------------------------
15+
[features]
16+
default = ["ring"]
17+
18+
# Crypto backend selection
19+
ring = ["rustls/ring"]
20+
aws-lc-rs = ["rustls/aws_lc_rs"]
21+
22+
# Examples
23+
grpc-examples = [
24+
"dep:tonic",
25+
"dep:tonic-rustls",
26+
"dep:tonic-prost",
27+
"dep:prost",
28+
"dep:prost-types",
29+
]
30+
tcp-examples = ["dep:tokio-rustls"]
31+
32+
integration-tests = ["dep:tokio-rustls"]
33+
34+
# ----------------------------
35+
# Library dependencies
36+
# ----------------------------
37+
[dependencies]
38+
spiffe = { version = "0.7.0", path = "../spiffe" }
39+
40+
# rustls with std needed for builder APIs + Error impls
41+
rustls = { version = "0.23.35", default-features = false, features = ["std"] }
42+
43+
# Minimal Tokio for the library itself
44+
tokio = { version = "1", default-features = false, features = ["rt", "sync"] }
45+
46+
# Optional, enabled via ring/aws-lc-rs pull-in
47+
tokio-rustls = { version = "0.26.4", default-features = false, optional = true }
48+
49+
log = "0.4"
50+
thiserror = "2"
51+
x509-parser = "0.18.0"
52+
tokio-util = "0.7.10"
53+
54+
# gRPC stack, only when grpc-examples enabled
55+
tonic = { version = "0.14", optional = true, features = ["transport"] }
56+
tonic-rustls = { version = "0.3.0", optional = true }
57+
tonic-prost = { version = "0.14", optional = true }
58+
prost = { version = "0.14", optional = true }
59+
prost-types = { version = "0.14", optional = true }
60+
61+
# ----------------------------
62+
# Build-time: proto generation
63+
# ----------------------------
64+
[build-dependencies]
65+
tonic-prost-build = "0.14"
66+
67+
# ----------------------------
68+
# Dev deps (tests, examples)
69+
# ----------------------------
70+
[dev-dependencies]
71+
tokio = { version = "1", default-features = false, features = [
72+
"macros",
73+
"rt-multi-thread",
74+
"signal",
75+
"net",
76+
"io-util",
77+
"sync",
78+
] }
79+
80+
anyhow = "1"
81+
env_logger = "0.11.8"
82+
83+
# ----------------------------
84+
# Examples (feature-gated)
85+
# ----------------------------
86+
[[example]]
87+
name = "grpc_server_mtls"
88+
path = "examples/grpc_server_mtls.rs"
89+
required-features = ["grpc-examples"]
90+
91+
[[example]]
92+
name = "grpc_client_mtls"
93+
path = "examples/grpc_client_mtls.rs"
94+
required-features = ["grpc-examples"]
95+
96+
[[example]]
97+
name = "mtls_tcp_server"
98+
path = "examples/mtls_tcp_server.rs"
99+
required-features = ["tcp-examples"]
100+
101+
[[example]]
102+
name = "mtls_tcp_client"
103+
path = "examples/mtls_tcp_client.rs"
104+
required-features = ["tcp-examples"]
105+

0 commit comments

Comments
 (0)