Skip to content

refactor(http): merge server implementation into HTTP extension#6826

Open
TheHypnoo wants to merge 3 commits into
mainfrom
refactor/merge-http-server-into-http
Open

refactor(http): merge server implementation into HTTP extension#6826
TheHypnoo wants to merge 3 commits into
mainfrom
refactor/merge-http-server-into-http

Conversation

@TheHypnoo

@TheHypnoo TheHypnoo commented Jul 24, 2026

Copy link
Copy Markdown
Member

Summary

  • Merge the standalone HTTP server crate into perry-ext-http as an internal module.
  • Preserve the selected static library, native ABI, event-loop pumps, and HTTP behavior.
  • Remove the obsolete crate, workspace edges, policy entry, and active documentation references.

Changes

  • Move HTTP/1.1, HTTPS, HTTP/2, WebSocket upgrade, dispatch, and pump implementation/tests under perry-ext-http::server.
  • Consolidate server dependencies and test shims into perry-ext-http.
  • Retain the release linker anchors required to preserve externally referenced server symbols under LTO.
  • Keep http, https, and http2 owned by libperry_ext_http.a.
  • Centralize shared HTTP/TLS dependency versions under [workspace.dependencies].
  • Add changelog.d/6826-http-server-consolidation.md.

Architecture impact

Metric Before After
Workspace members 77 76
Default members 1 1
Default dependency closure 17 17
Perry dependency closure 17 17
Relevant exported HTTP symbols 215 215

The output artifact remains libperry_ext_http.a.

Review size

size:exception accepted by the maintainer: 832 authored additions/deletions, excluding 12,823 high-similarity move lines. The crate removal, dependency migration, module relocation, and ABI retention must land atomically.

Test plan

  • python3 scripts/workspace_architecture.py --self-test
  • python3 scripts/workspace_architecture.py --check --print-summary
  • cargo metadata --no-deps --format-version 1
  • cargo fmt --all -- --check
  • git diff --check
  • cargo check -p perry-ext-http
  • cargo test -p perry-ext-http — 68 passed
  • cargo clippy -p perry-ext-http --all-targets
  • cargo clippy -p perry --bins
  • HTTP/HTTPS/HTTP2 parity fixtures — 3 passed
  • Node-suite HTTP pump, WebSocket upgrade, HTTP/2 loopback, and HTTPS fixtures — 4 passed
  • node_http_webfetch.ts release link-and-run smoke
  • Debug/release exported-symbol comparison — 215 unchanged
  • Final active-reference search found no perry-ext-http-server Cargo edge or path

The broad --filter node_http selection includes three intentionally long-lived fixtures that do not close their listener, so the parity runner terminates them after 10 seconds. The self-closing parity and Node-suite server fixtures above pass.

Scope

This PR does not migrate perry-ext-http away from perry-runtime, redesign perry-ffi, remove the legacy stdlib HTTP implementation, or change TLS, routing, timeout, pump, or codegen behavior.

Next phase

Phase 3 can expand the stable perry-ffi surface required by HTTP and remove the production perry-ext-http → perry-runtime dependency while keeping the independently selected HTTP static library.

Related issue

n/a — Perry architecture roadmap Phase 2B.

Summary by CodeRabbit

  • New Features

    • HTTP, HTTPS, HTTP/2, and WebSocket server capabilities are now delivered through a unified implementation.
    • Added Node-compatible HTTP/2 settings packing, unpacking, and default settings support.
    • Improved cluster-aware listening and TLS certificate/key handling.
    • Added faster handling for common HTTP response status codes and headers.
  • Bug Fixes

    • Improved HTTP header normalization, cookie handling, and WebSocket event-listener behavior.
  • Tests

    • Expanded coverage for HTTP/2 settings, TLS parsing, response handling, and event semantics.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The HTTP server implementation is consolidated into perry-ext-http. Workspace dependencies, server modules, HTTP/2 settings, TLS helpers, cluster binding, response tests, linker retention, and repository references are updated accordingly.

Changes

HTTP extension consolidation

Layer / File(s) Summary
Workspace removal and dependency migration
Cargo.toml, crates/perry-ext-http/Cargo.toml, crates/perry-stdlib/Cargo.toml, workspace-architecture.json
Removes perry-ext-http-server, adds shared HTTP/TLS dependencies, and updates dependent crate declarations and workspace metadata.
Server module foundation
crates/perry-ext-http/src/server/*
Adds cluster binding, listen-argument and NaN-boxed value helpers, HTTP/2 settings serialization, TLS configuration, and test-linking support.
Server path and dispatch rewiring
crates/perry-ext-http/src/lib.rs, crates/perry-ext-http/src/server/*
Compiles server functionality through the internal server module and updates HTTP, HTTPS, HTTP/2, upgrade, request, response, and dispatch paths.
Response behavior and validation
crates/perry-ext-http/src/server/response_fast.rs, crates/perry-ext-http/src/server/response_tests.rs
Adds response fast-path helpers and tests for status lines, headers, cookies, and listener behavior.
Ecosystem documentation alignment
crates/perry-codegen/*, crates/perry-runtime/*, crates/perry-stdlib/*, docs/*, scripts/*, test-files/*
Updates references, comments, changelog text, smoke-test notes, and architecture documentation to identify perry-ext-http as the server implementation.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

  • PerryTS/perry#6639: Both changes touch linker-retention handling for perry-ext-http-server.
  • PerryTS/perry#6735: Both changes concern HTTP server symbol wiring and side-table clearing.
  • PerryTS/perry#6758: Both changes update workspace handling for perry-ext-http-server.

Suggested reviewers: proggeramlug

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning No pull request description was provided, so none of the required template sections are filled in. Add the required Summary, Changes, Related issue, Test plan, Screenshots/output, and Checklist sections from the template.
✅ Passed checks (4 passed)
Check name Status Explanation
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Title check ✅ Passed The title clearly summarizes the main change: merging the HTTP server implementation into the HTTP extension.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch refactor/merge-http-server-into-http

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@TheHypnoo
TheHypnoo force-pushed the refactor/merge-http-server-into-http branch from 6fef98a to 252884b Compare July 24, 2026 10:30

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/perry-ext-http/src/server/http2_session_settings.rs`:
- Around line 45-67: Update the maxHeaderSize/maxHeaderListSize handling in the
settings deserialization method so both fields remain aliases while
maxHeaderSize wins when both keys are present, matching
js_node_http2_get_packed_settings. Avoid the current unconditional ordering that
lets the maxHeaderListSize block overwrite the value; preserve existing behavior
for either key supplied alone.

In `@crates/perry-ext-http/src/server/tls.rs`:
- Around line 188-201: Update the signing-key loading in the TLS server
configuration flow to use the same active CryptoProvider that
ServerConfig::builder() will use, rather than hard-coding
rustls::crypto::ring::default_provider(). Ensure provider installation and key
loading consistently select one provider, preserving the CertifiedKey
construction and existing error mapping.

In `@crates/perry/src/commands/compile/optimized_libs/driver.rs`:
- Around line 500-501: Update the fallback comment near the optimized library
dependency logic to mention perry-ext-http only once, removing the duplicated
“perry-ext-http / perry-ext-http” text while preserving the rest of the
explanation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2083ccb4-45be-4099-b8a8-f53fe4150c73

📥 Commits

Reviewing files that changed from the base of the PR and between 8bda035 and 203ed16.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (78)
  • .github/workflows/test.yml
  • Cargo.toml
  • changelog.d/6826-http-server-consolidation.md
  • crates/perry-codegen/src/ext_registry.rs
  • crates/perry-codegen/src/lower_call/native_table/http_http2.rs
  • crates/perry-codegen/src/lower_call/native_table/net_events.rs
  • crates/perry-codegen/src/runtime_decls/stdlib_ffi/net_http.rs
  • crates/perry-ext-fastify/Cargo.toml
  • crates/perry-ext-fastify/src/cluster_bind.rs
  • crates/perry-ext-fastify/src/context.rs
  • crates/perry-ext-fastify/src/server.rs
  • crates/perry-ext-fastify/src/upgrade.rs
  • crates/perry-ext-http-server/Cargo.toml
  • crates/perry-ext-http-server/src/test_async_shims.rs
  • crates/perry-ext-http/Cargo.toml
  • crates/perry-ext-http/src/client_overload.rs
  • crates/perry-ext-http/src/force_link.rs
  • crates/perry-ext-http/src/lib.rs
  • crates/perry-ext-http/src/server/cluster_bind.rs
  • crates/perry-ext-http/src/server/dispatch_ext.rs
  • crates/perry-ext-http/src/server/handle_dispatch.rs
  • crates/perry-ext-http/src/server/http2_server.rs
  • crates/perry-ext-http/src/server/http2_server/controls.rs
  • crates/perry-ext-http/src/server/http2_server/dispatch.rs
  • crates/perry-ext-http/src/server/http2_server/pump.rs
  • crates/perry-ext-http/src/server/http2_server/session.rs
  • crates/perry-ext-http/src/server/http2_session_settings.rs
  • crates/perry-ext-http/src/server/http2_settings.rs
  • crates/perry-ext-http/src/server/http2_stream_props.rs
  • crates/perry-ext-http/src/server/https_server.rs
  • crates/perry-ext-http/src/server/mod.rs
  • crates/perry-ext-http/src/server/raw_upgrade.rs
  • crates/perry-ext-http/src/server/request.rs
  • crates/perry-ext-http/src/server/response.rs
  • crates/perry-ext-http/src/server/response_fast.rs
  • crates/perry-ext-http/src/server/response_tests.rs
  • crates/perry-ext-http/src/server/server.rs
  • crates/perry-ext-http/src/server/server/in_flight.rs
  • crates/perry-ext-http/src/server/tls.rs
  • crates/perry-ext-http/src/server/types.rs
  • crates/perry-ext-http/src/server/upgrade.rs
  • crates/perry-ext-http/src/test_async_shims.rs
  • crates/perry-ext-net/Cargo.toml
  • crates/perry-ext-net/src/adopt.rs
  • crates/perry-ext-net/src/handle_ids.rs
  • crates/perry-ext-net/src/jsvalue.rs
  • crates/perry-ext-net/src/lib.rs
  • crates/perry-ext-ws/Cargo.toml
  • crates/perry-ext-ws/src/lib.rs
  • crates/perry-ffi/src/error.rs
  • crates/perry-ffi/src/handle.rs
  • crates/perry-hir/src/lower/expr_member.rs
  • crates/perry-runtime/Cargo.toml
  • crates/perry-runtime/src/buffer/query.rs
  • crates/perry-runtime/src/closure/dynamic_props.rs
  • crates/perry-runtime/src/cluster.rs
  • crates/perry-runtime/src/cluster_sched.rs
  • crates/perry-runtime/src/error.rs
  • crates/perry-runtime/src/lib.rs
  • crates/perry-runtime/src/object/native_module_dispatch/dispatch_q_u.rs
  • crates/perry-runtime/src/symbol/properties.rs
  • crates/perry-runtime/src/value/handle.rs
  • crates/perry-runtime/src/value/tags.rs
  • crates/perry-stdlib/Cargo.toml
  • crates/perry-stdlib/src/common/async_bridge.rs
  • crates/perry-stdlib/src/common/dispatch/init.rs
  • crates/perry-stdlib/src/common/dispatch/method_dispatch.rs
  • crates/perry-stdlib/src/tls.rs
  • crates/perry-stdlib/src/ws.rs
  • crates/perry/src/commands/compile/optimized_libs/driver.rs
  • crates/perry/src/commands/stdlib_features.rs
  • crates/perry/well_known_bindings.toml
  • docs/src/contributing/crate-policy.md
  • scripts/release_sweep_tiers/tier12_link_smoke.sh
  • test-files/test_issue_1124_http_buffer_body.ts
  • test-files/test_issue_2533_aliased_http_createserver.ts
  • test-files/test_node_http_basic.ts
  • workspace-architecture.json
💤 Files with no reviewable changes (2)
  • crates/perry-ext-http-server/Cargo.toml
  • crates/perry-ext-http-server/src/test_async_shims.rs

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/perry-ext-http/src/server/http2_session_settings.rs`:
- Around line 45-67: Update the maxHeaderSize/maxHeaderListSize handling in the
settings deserialization method so both fields remain aliases while
maxHeaderSize wins when both keys are present, matching
js_node_http2_get_packed_settings. Avoid the current unconditional ordering that
lets the maxHeaderListSize block overwrite the value; preserve existing behavior
for either key supplied alone.

In `@crates/perry-ext-http/src/server/tls.rs`:
- Around line 188-201: Update the signing-key loading in the TLS server
configuration flow to use the same active CryptoProvider that
ServerConfig::builder() will use, rather than hard-coding
rustls::crypto::ring::default_provider(). Ensure provider installation and key
loading consistently select one provider, preserving the CertifiedKey
construction and existing error mapping.

In `@crates/perry/src/commands/compile/optimized_libs/driver.rs`:
- Around line 500-501: Update the fallback comment near the optimized library
dependency logic to mention perry-ext-http only once, removing the duplicated
“perry-ext-http / perry-ext-http” text while preserving the rest of the
explanation.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 2083ccb4-45be-4099-b8a8-f53fe4150c73

📥 Commits

Reviewing files that changed from the base of the PR and between 8bda035 and 203ed16.

⛔ Files ignored due to path filters (1)
  • Cargo.lock is excluded by !**/*.lock
📒 Files selected for processing (78)
  • .github/workflows/test.yml
  • Cargo.toml
  • changelog.d/6826-http-server-consolidation.md
  • crates/perry-codegen/src/ext_registry.rs
  • crates/perry-codegen/src/lower_call/native_table/http_http2.rs
  • crates/perry-codegen/src/lower_call/native_table/net_events.rs
  • crates/perry-codegen/src/runtime_decls/stdlib_ffi/net_http.rs
  • crates/perry-ext-fastify/Cargo.toml
  • crates/perry-ext-fastify/src/cluster_bind.rs
  • crates/perry-ext-fastify/src/context.rs
  • crates/perry-ext-fastify/src/server.rs
  • crates/perry-ext-fastify/src/upgrade.rs
  • crates/perry-ext-http-server/Cargo.toml
  • crates/perry-ext-http-server/src/test_async_shims.rs
  • crates/perry-ext-http/Cargo.toml
  • crates/perry-ext-http/src/client_overload.rs
  • crates/perry-ext-http/src/force_link.rs
  • crates/perry-ext-http/src/lib.rs
  • crates/perry-ext-http/src/server/cluster_bind.rs
  • crates/perry-ext-http/src/server/dispatch_ext.rs
  • crates/perry-ext-http/src/server/handle_dispatch.rs
  • crates/perry-ext-http/src/server/http2_server.rs
  • crates/perry-ext-http/src/server/http2_server/controls.rs
  • crates/perry-ext-http/src/server/http2_server/dispatch.rs
  • crates/perry-ext-http/src/server/http2_server/pump.rs
  • crates/perry-ext-http/src/server/http2_server/session.rs
  • crates/perry-ext-http/src/server/http2_session_settings.rs
  • crates/perry-ext-http/src/server/http2_settings.rs
  • crates/perry-ext-http/src/server/http2_stream_props.rs
  • crates/perry-ext-http/src/server/https_server.rs
  • crates/perry-ext-http/src/server/mod.rs
  • crates/perry-ext-http/src/server/raw_upgrade.rs
  • crates/perry-ext-http/src/server/request.rs
  • crates/perry-ext-http/src/server/response.rs
  • crates/perry-ext-http/src/server/response_fast.rs
  • crates/perry-ext-http/src/server/response_tests.rs
  • crates/perry-ext-http/src/server/server.rs
  • crates/perry-ext-http/src/server/server/in_flight.rs
  • crates/perry-ext-http/src/server/tls.rs
  • crates/perry-ext-http/src/server/types.rs
  • crates/perry-ext-http/src/server/upgrade.rs
  • crates/perry-ext-http/src/test_async_shims.rs
  • crates/perry-ext-net/Cargo.toml
  • crates/perry-ext-net/src/adopt.rs
  • crates/perry-ext-net/src/handle_ids.rs
  • crates/perry-ext-net/src/jsvalue.rs
  • crates/perry-ext-net/src/lib.rs
  • crates/perry-ext-ws/Cargo.toml
  • crates/perry-ext-ws/src/lib.rs
  • crates/perry-ffi/src/error.rs
  • crates/perry-ffi/src/handle.rs
  • crates/perry-hir/src/lower/expr_member.rs
  • crates/perry-runtime/Cargo.toml
  • crates/perry-runtime/src/buffer/query.rs
  • crates/perry-runtime/src/closure/dynamic_props.rs
  • crates/perry-runtime/src/cluster.rs
  • crates/perry-runtime/src/cluster_sched.rs
  • crates/perry-runtime/src/error.rs
  • crates/perry-runtime/src/lib.rs
  • crates/perry-runtime/src/object/native_module_dispatch/dispatch_q_u.rs
  • crates/perry-runtime/src/symbol/properties.rs
  • crates/perry-runtime/src/value/handle.rs
  • crates/perry-runtime/src/value/tags.rs
  • crates/perry-stdlib/Cargo.toml
  • crates/perry-stdlib/src/common/async_bridge.rs
  • crates/perry-stdlib/src/common/dispatch/init.rs
  • crates/perry-stdlib/src/common/dispatch/method_dispatch.rs
  • crates/perry-stdlib/src/tls.rs
  • crates/perry-stdlib/src/ws.rs
  • crates/perry/src/commands/compile/optimized_libs/driver.rs
  • crates/perry/src/commands/stdlib_features.rs
  • crates/perry/well_known_bindings.toml
  • docs/src/contributing/crate-policy.md
  • scripts/release_sweep_tiers/tier12_link_smoke.sh
  • test-files/test_issue_1124_http_buffer_body.ts
  • test-files/test_issue_2533_aliased_http_createserver.ts
  • test-files/test_node_http_basic.ts
  • workspace-architecture.json
💤 Files with no reviewable changes (2)
  • crates/perry-ext-http-server/Cargo.toml
  • crates/perry-ext-http-server/src/test_async_shims.rs
🛑 Comments failed to post (3)
crates/perry-ext-http/src/server/http2_session_settings.rs (1)

45-67: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

maxHeaderSize/maxHeaderListSize tie-break contradicts http2_settings.rs's documented rule.

Real Node.js treats maxHeaderSize as a pure alias of the single maxHeaderListSize setting. This codebase's own js_node_http2_get_packed_settings (in http2_settings.rs) documents and implements "when both are present Node lets maxHeaderSize win." Here, the two independent if let blocks run unconditionally in fixed order, so when both keys are present in the input, maxHeaderListSize's block (processed second) always overwrites maxHeaderSize's — the opposite winner from the sibling implementation.

🐛 Proposed fix to align the tie-break with the packing path
-        if let Some(v) = obj.get("maxHeaderSize").and_then(json_u32) {
-            self.max_header_size = v;
-            self.max_header_list_size = v;
-        }
-        if let Some(v) = obj.get("maxHeaderListSize").and_then(json_u32) {
-            self.max_header_list_size = v;
-            self.max_header_size = v;
-        }
+        let max_header = obj.get("maxHeaderSize").and_then(json_u32);
+        let max_header_list = obj.get("maxHeaderListSize").and_then(json_u32);
+        if let Some(v) = max_header.or(max_header_list) {
+            self.max_header_size = v;
+            self.max_header_list_size = v;
+        }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

        let max_header = obj.get("maxHeaderSize").and_then(json_u32);
        let max_header_list = obj.get("maxHeaderListSize").and_then(json_u32);
        if let Some(v) = max_header.or(max_header_list) {
            self.max_header_size = v;
            self.max_header_list_size = v;
        }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/perry-ext-http/src/server/http2_session_settings.rs` around lines 45 -
67, Update the maxHeaderSize/maxHeaderListSize handling in the settings
deserialization method so both fields remain aliases while maxHeaderSize wins
when both keys are present, matching js_node_http2_get_packed_settings. Avoid
the current unconditional ordering that lets the maxHeaderListSize block
overwrite the value; preserve existing behavior for either key supplied alone.
crates/perry-ext-http/src/server/tls.rs (1)

188-201: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

rustls CertifiedKey SigningKey portable across different CryptoProvider ring aws-lc-rs

💡 Result:

In rustls, a CertifiedKey is not inherently portable across different CryptoProviders because it contains a SigningKey trait object, which is tied to the specific provider that created or loaded it [1][2][3]. The SigningKey trait is an abstract interface used by rustls to perform private key operations [2][4]. When you load a private key using a CryptoProvider's KeyProvider (e.g., via rustls-ring or rustls-aws-lc-rs), the resulting SigningKey implementation is specific to that provider's internal cryptographic backends (ring or aws-lc-rs) [3][5]. Because these providers use different underlying libraries, they cannot be mixed; a SigningKey object produced by one provider will generally not be recognized or compatible with the expectations of another provider [3][5]. While both rustls-ring and rustls-aws-lc-rs implement the same rustls::crypto::CryptoProvider interface, they serve as interchangeable drop-in replacements at the configuration level, not as interoperable runtime environments for individual objects [5]. If you need to switch providers, you must re-load or re-create your CertifiedKey and SigningKey using the KeyProvider of the new, desired CryptoProvider [1][3]. The CertifiedKey::from_der method explicitly accepts a &CryptoProvider argument to perform this loading/parsing, highlighting that the provider is a necessary context for interpreting the key material [1][6].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Tracked relevant manifest/source files:\n'
git ls-files 'Cargo.toml' 'crates/*/Cargo.toml' '*.lock' 'crates/perry-ext-http/src/server/tls.rs' | sed -n '1,80p'

printf '\nManifest rustls/ring/aws mentions:\n'
rg -n 'rustls|aws-lc|ring' Cargo.toml crates/*/Cargo.toml 2>/dev/null || true

printf '\nLockfile entries:\n'
if [ -f Cargo.lock ]; then
  rg -n 'name = "rustls"|name = "rustls-ring"|name = "rustls-aws-lc-rs"|name = "aws-lc-rs"' Cargo.lock -A2 -B2 || true
fi

printf '\ntls.rs relevant source:\n'
sed -n '1,260p' crates/perry-ext-http/src/server/tls.rs

Repository: PerryTS/perry

Length of output: 22584


🌐 Web query:

rustls 0.23 CertifiedKey from_der provider load_private_key SigningKey trait object provider specific docs

💡 Result:

In rustls 0.23, you can use CertifiedKey::from_der to create a CertifiedKey from a certificate chain and a DER-encoded private key by providing a CryptoProvider [1][2]. The CryptoProvider contains a key_provider field (implementing the KeyProvider trait) that handles the parsing and loading of private keys into a SigningKey trait object [3][4][5]. The CertifiedKey::from_der function signature is: pub fn from_der(cert_chain: Vec<CertificateDer<'static>>, key: PrivateKeyDer<'static>, provider: &CryptoProvider) -> Result<Self, Error> [1][2] When this is called, it uses the provided CryptoProvider’s key_provider to invoke load_private_key, which returns an Arc<dyn SigningKey> [1][3]. The SigningKey trait defines the abstract interface for performing cryptographic signing operations (such as choose_scheme and algorithm) used during the TLS handshake [6][7]. Key points for implementation: - KeyProvider Trait: KeyProvider::load_private_key is designed for loading private keys from DER (e.g., from disk) [3][5]. If you are using hardware security modules (HSMs) or other external key sources, you should consult the "Customising private key usage" section in the Rustls manual, which guides you on implementing a custom SigningKey and Signer rather than relying solely on KeyProvider [7]. - Provider Selection: You can create a custom CryptoProvider by delegating elements (like SigningKey logic) to existing providers while overriding the key_provider field with your own implementation [4][8][9]. - Integration: CertifiedKey objects are typically used within ResolvesServerCert or ResolvesClientCert implementations to supply certificates and keys during a TLS handshake [6][7]. For detailed examples of implementing custom signing keys, check the signer module in the rustls-cng crate or the official Rustls "custom provider" examples provided in their documentation [7][10].

Citations:


🌐 Web query:

rustls-0.23.42 source rustls/certified_key.rs CertifiedKey::from_der load_private_key

💡 Result:

In rustls 0.23.42, the CertifiedKey::from_der method is defined in the rustls/src/crypto/signer.rs source file [1][2][3]. It serves to create a new CertifiedKey by processing a certificate chain and a DER-encoded private key [1][2][3]. The implementation of CertifiedKey::from_der follows this logic: 1. It takes the cert_chain (a vector of DER-encoded certificates), the key (a PrivateKeyDer instance), and a reference to a CryptoProvider as inputs [1][2][3]. 2. It calls the load_private_key method on the provider's KeyProvider, passing in the key [1][2][3]. This step handles the actual decoding and validation of the private key material [4][5]. 3. Upon success, it initializes a new CertifiedKey instance using the parsed private key and the provided certificate chain [1][2][3]. 4. It performs a consistency check using keys_match to ensure the private key corresponds to the public key in the end-entity certificate [1][2][3]. If this check returns either an OK result or an InconsistentKeys::Unknown error, the function returns the constructed CertifiedKey [1][2][3]. The KeyProvider trait defines load_private_key as the mechanism for decoding and validating a private signing key from the provided DER format [4][5]. This trait is essential for supporting different crypto backends, and the specific key formats supported (such as PKCS#1, PKCS#8, or SEC1) depend on the underlying CryptoProvider implementation [6][4][5].

Citations:


Load the signing key with the active CryptoProvider.

If aws-lc-rs is already the process-level default and install_default() silently returns Err, ServerConfig::builder() will use aws-lc-rs’s cipher/key options while this key is loaded with rustls::crypto::ring::default_provider(). Rustls SigningKey implementations are provider-specific, so either install one provider unconditionally and use that provider’s key_provider, or use a provider-agnostic parser/API that does not create the signed-cert chain with a different provider’s backend.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/perry-ext-http/src/server/tls.rs` around lines 188 - 201, Update the
signing-key loading in the TLS server configuration flow to use the same active
CryptoProvider that ServerConfig::builder() will use, rather than hard-coding
rustls::crypto::ring::default_provider(). Ensure provider installation and key
loading consistently select one provider, preserving the CertifiedKey
construction and existing error mapping.
crates/perry/src/commands/compile/optimized_libs/driver.rs (1)

500-501: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Remove the duplicated crate name in the fallback comment.

The comment currently says perry-ext-http / perry-ext-http, which is misleading and grammatically incorrect. Keep a single perry-ext-http reference.

Proposed fix
-            // node:http's server lives in perry-ext-http /
-            // perry-ext-http, which aren't perry-stdlib deps — so
+            // node:http's server lives in perry-ext-http, which isn't
+            // a perry-stdlib dependency — so
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

            // node:http's server lives in perry-ext-http, which isn't
            // a perry-stdlib dependency — so
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/perry/src/commands/compile/optimized_libs/driver.rs` around lines 500
- 501, Update the fallback comment near the optimized library dependency logic
to mention perry-ext-http only once, removing the duplicated “perry-ext-http /
perry-ext-http” text while preserving the rest of the explanation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant