Giters

rustls / webpki

WebPKI X.509 Certificate Validation in Rust

Home Page:https://docs.rs/rustls-webpki/latest/webpki/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

webpki compiled without default features and the alloc feature enabled depends on std

japaric opened this issue · comments

commented

Steps to reproduce

$ cargo b --no-default-features --features alloc

yields errors when building src/crl.rs due to two reasons

  1. Vec is used without importing it from alloc first
  2. HashMap is imported but that's defined in the std crate

Fixing (1) is easy. The easiest fix for (2) is using BTreeMap but that has different performance costs

commented

The title mentions rustls, but I guess this is about webpki?

Why does HashMap need std while BTreeMap doesn't? Is that because of the randomness source? I'm guessing BTreeMap would be okay for the use in crl here -- though @cpu should probably comment on this, alternatively could we minimally abstract over using HashMap with std and BTreeMap when std is not available?

commented

The title mentions rustls, but I guess this is about webpki?

I updated the tittle.

I'm guessing BTreeMap would be okay for the use in crl here -- though @cpu should probably comment on this,

I left a comment on the fix PR with some benchmarking stats. TLDR: We trade off faster up-front parsing for slightly slower lookups by using the BTreeMap. The difference in lookup speed is small enough I don't personally think it makes sense to complicate matters with any additional abstractions, WDYT?

commented

Why does HashMap need std while BTreeMap doesn't? Is that because of the randomness source?

yes, its default hasher RandomState fetches entroy from the OS. in principle, a generic HashMap with no default hasher could live in alloc and then you would be able to use it with some no-std hasher from crates.io but that's not the case (and I don't know what prevents that from happening since HashMap already has a generic hasher parameter)

another no-std option is indexmap. according to its docs it should have performance on par with std::HashMap but you would also need to use it with some no-std hasher from crates.io so that would be two extra external dependencies in no-std mode.

commented

In practice the cryptography provider that we need for signature verification would generally also provide some of way of getting random bytes, but on the other hand that would not actually be needed for signature verification.