rustls-platform-verifier

The reason this release is semver-incompatible is the upgrade from jni 0.21 to 0.22, which should only affect Android targets (and substantially reuse dependency duplication). Additionally there are several fixes for behavior on Windows.

What's Changed

• update cc to fix regression during macabi build by @conradludgate in #209
• update real world certificates by @conradludgate in #207
• remove outdated oncecell comment by @conradludgate in #205
• fix confusing target doc cfg by @conradludgate in #210
• fix win7 crash due to CERT_CHAIN_ENGINE_CONFIG by @cstkingkey in #213
• try with extra roots when root is untrusted by @cstkingkey in #215
• remove nix flake, CI testing by @cpu in #225
• Update Android setup instructions to include library usecase examples by @skeet70 in #223
• Upgrade jni to 0.22 by @djc in #193

What's Changed

• Do not permanently attach JVM threads by @complexspaces in #185
• ci: run iOS tests on ARM by @djc in #192
• Allow macOS 10.12 and 10.13 to work by @madsmtm in #194
• Allow use of windows-sys 0.61 by @djc in #191
• Make cdylib crate type optional by @filmor in #196

This version should fix the docs.rs build -- see #181.

What's Changed

• Add Kotlin Gradle script example to Android README section by @complexspaces in #167
• Fix docs build for 0.6.0 by @ctz in #182

Full Changelog: v/0.6.0...v/0.6.1

• Avoid implicit reliance on the default crypto provider
• Eagerly create the verifier on miscellaneous Unix platforms (including Linux) to avoid swallowing errors

What's Changed

• Update real world test certificates by @djc in #177
• Eagerly build root store on miscellaneous Unix platforms by @djc in #171
• Upgrade to webpki-root-certs 1 by @djc in #176

• Adapt to changes in rustls error API.

What's Changed

• Fix typo in Verifier::{with_provider, get_provider} docs by @paolobarbolini in #173
• Refine CI workflow triggers by @djc in #174
• Adapt to changing rustls error API by @djc in #168

The headline of this release is server compatibility improvements.

It removes an edge case where a failure to load any certificates on Linux/BSD platforms would result in silently turning the lack of certificate roots into "no signature algorithms". During the initialization of a TLS session with a server this caused rustls to send an empty supported signature list in the ClientHello.

What's Changed

• Remove signature list failure case in other Verifier by @complexspaces in #169

Full Changelog: v/0.5.1...v/0.5.2

Change the way we interact with the rustls API to avoid semver hazards: unfortunately changes in rustls 0.23.24 broke older rustls-platform-verifier releases due to downcasting of a no-longer compatible error wrapper. rustls 0.23.25 now exposes the required variant directly, which should avoid similar issues in the future. (For more details, see #163.)

What's Changed

• Update the crate version in README by @1hakusai1 in #155
• Update CI for Febuary 2025 by @complexspaces in #156
• fix 'environment' typo in android docs by @mcginty in #158
• Refactor Android init methods for more flexibility by @mcginty in #159
• Allow modern range of windows-sys versions by @complexspaces in #161
• Fix audit by @djc in #162
• Update dependencies by @djc in #163

The upgrade to jni 0.21 contained some Android-only breaking changes -- API changes should not affect other platforms.

What's Changed

• Update jni to 0.21 by @Cyannide in #151
• Bump MSRV & update dependencies by @djc in #152
• ci: add some missing persist-credentials by @cpu in #154

• Improved support for "extra" roots - the ability to specify additional root certificates beyond the platform's own roots has been extended to all supported platforms with the exception of Android (TBD). This can be used for additive configuration, for example to support all system roots and additionally some internal, or company specific, roots. The existing Linux/UNIX verifier's new_with_extra_roots() fn now accepts impl IntoIterator<Item = pki_types::TrustAnchor<'static>> in place of Vec<pki_types::CertificateDer<'static>> to better harmonize with the other platforms.
• Replace winapi with windows-sys - the latter is a 1st party Microsoft crate with better on-going support.
• Improved documentation - the README has been updated to better describe the differences between this crate and other available options.
• Added new BuilderVerifierExt and ConfigVerifierExt traits which provide with_platform_verifier() methods for easier rustls client configuration. These intend to replace tls_config and tls_config_with_provider, which are now deprecated.

What's Changed

• ci: disable dependabot cargo updates by @cpu in #120
• Port Windows verifier from winapi to windows-sys by @complexspaces in #131
• Fix and defend wasm code using wasi platform by @ctz in #136
• Add new with extra roots on macos/ios by @stormshield-gt and @complexspaces in #133
• Fix FreeBSD by @djc in #137
• tests: update vendored real world certs by @cpu in #140
• Add new with extra roots on windows by @stormshield-gt in #135
• ci: add cargo-semver-checks-action by @cpu in #143
• Add deployment considerations section to README by @complexspaces in #142
• Bump Java CI testing version from 11 to 17 by @complexspaces in #147
• relax new_with_extra_roots API by @stormshield-gt in #145
• Run tests on iOS using Mac Catalyst and expand Apple platforms by @complexspaces in #149
• Use extension trait to simplify config by @djc in #150
• Prepare 0.4.0 by @complexspaces in #148

New Contributors

• @stormshield-gt made their first contribution in #133

Full Changelog: v/0.3.4...v/0.4.0

• Fix an error in the handling of allowed EKUs on Windows; see #126

What's Changed

• small chores by @cpu in #116
• tests: regenerate verification_mock data by @cpu in #121
• Update deny config & bump base64 to 0.22 by @djc in #119
• build(deps): bump EmbarkStudios/cargo-deny-action from 1 to 2 by @dependabot in #118
• Fix UB in Windows verifier EKU handling by @complexspaces in #127
• Prepare 0.3.4 by @ctz in #129

Full Changelog: v/0.3.3...v/0.3.4