Skip to content

Replace SSL backend to rustls #6244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 4 commits into from
Nov 16, 2025
Merged

Replace SSL backend to rustls #6244

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b062944
Create a new ssl library based on rustls
youknowone Nov 9, 2025
7ef298c
ring -> aws-ls
youknowone Nov 11, 2025
8ccba94
Add warnings
youknowone Nov 10, 2025
98fb4ad
version
youknowone Nov 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
ring -> aws-ls
  • Loading branch information
@youknowone
youknowone committed Nov 15, 2025
commit 7ef298cdbf647c0c2358b835d439971c93d9ab12
1 change: 1 addition & 0 deletions .cspell.dict/cpython.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ VARKEYWORDS
varkwarg
wbits
weakreflist
webpki
withitem
withs
xstat
Expand Down
15 changes: 8 additions & 7 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ concurrency:

env:
CARGO_ARGS: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite,ssl-rustls
CARGO_ARGS_NO_SSL: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite
# Skip additional tests on Windows. They are checked on Linux and MacOS.
# test_glob: many failing tests
# test_io: many failing tests
Expand Down Expand Up @@ -169,7 +170,7 @@ jobs:
target: aarch64-apple-ios
if: runner.os == 'macOS'
- name: Check compilation for iOS
run: cargo check --target aarch64-apple-ios
run: cargo check --target aarch64-apple-ios ${{ env.CARGO_ARGS_NO_SSL }}
if: runner.os == 'macOS'

exotic_targets:
Expand All @@ -186,14 +187,14 @@ jobs:
- name: Install gcc-multilib and musl-tools
run: sudo apt-get update && sudo apt-get install gcc-multilib musl-tools
- name: Check compilation for x86 32bit
run: cargo check --target i686-unknown-linux-gnu
run: cargo check --target i686-unknown-linux-gnu ${{ env.CARGO_ARGS_NO_SSL }}

- uses: dtolnay/rust-toolchain@stable
with:
target: aarch64-linux-android

- name: Check compilation for android
run: cargo check --target aarch64-linux-android
run: cargo check --target aarch64-linux-android ${{ env.CARGO_ARGS_NO_SSL }}

- uses: dtolnay/rust-toolchain@stable
with:
Expand All @@ -202,28 +203,28 @@ jobs:
- name: Install gcc-aarch64-linux-gnu
run: sudo apt install gcc-aarch64-linux-gnu
- name: Check compilation for aarch64 linux gnu
run: cargo check --target aarch64-unknown-linux-gnu
run: cargo check --target aarch64-unknown-linux-gnu ${{ env.CARGO_ARGS_NO_SSL }}

- uses: dtolnay/rust-toolchain@stable
with:
target: i686-unknown-linux-musl

- name: Check compilation for musl
run: cargo check --target i686-unknown-linux-musl
run: cargo check --target i686-unknown-linux-musl ${{ env.CARGO_ARGS_NO_SSL }}

- uses: dtolnay/rust-toolchain@stable
with:
target: x86_64-unknown-freebsd

- name: Check compilation for freebsd
run: cargo check --target x86_64-unknown-freebsd
run: cargo check --target x86_64-unknown-freebsd ${{ env.CARGO_ARGS_NO_SSL }}

- uses: dtolnay/rust-toolchain@stable
with:
target: x86_64-unknown-freebsd

- name: Check compilation for freeBSD
run: cargo check --target x86_64-unknown-freebsd
run: cargo check --target x86_64-unknown-freebsd ${{ env.CARGO_ARGS_NO_SSL }}

# - name: Prepare repository for redox compilation
# run: bash scripts/redox/uncomment-cargo.sh
Expand Down
110 changes: 104 additions & 6 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ winresource = "0.1"
[dependencies]
rustpython-compiler = { workspace = true }
rustpython-pylib = { workspace = true, optional = true }
rustpython-stdlib = { workspace = true, optional = true, features = ["compiler", "ssl-rustls"] }
rustpython-stdlib = { workspace = true, optional = true, features = ["compiler"] }
rustpython-vm = { workspace = true, features = ["compiler"] }
ruff_python_parser = { workspace = true }

Expand Down
18 changes: 9 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,18 +66,11 @@ Welcome to the magnificent Rust Python interpreter
>>>>>
```

// TODO: fixme
If you'd like to make https requests, you can enable the `ssl` feature, which
also lets you install the `pip` package manager. Note that on Windows, you may
need to install OpenSSL, or you can enable the `ssl-vendor` feature instead,
which compiles OpenSSL for you but requires a C compiler, perl, and `make`.
OpenSSL version 3 is expected and tested in CI. Older versions may not work.

Once you've installed rustpython with SSL support, you can install pip by
You can install pip by
running:

```bash
cargo install --git https://github.com/RustPython/RustPython --features ssl
cargo install --git https://github.com/RustPython/RustPython
rustpython --install-pip
```
Comment on lines +69 to 75
Copy link
Contributor

@coderabbitai coderabbitai bot Nov 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Fix pip installation command; crate name is missing.

The cargo install example omits the crate name, so copy‑pasting line 73 will fail. It should mirror the earlier install example and include rustpython on the same line.

-```bash
-cargo install --git https://github.com/RustPython/RustPython
-rustpython --install-pip
-```
+```bash
+cargo install --git https://github.com/RustPython/RustPython rustpython
+rustpython --install-pip
+```
🤖 Prompt for AI Agents 
In README.md around lines 69 to 75, the cargo install example is missing the
crate name so the command will fail; update the install snippet to put the crate
name `rustpython` on the same line as `cargo install --git
https://github.com/RustPython/RustPython` and keep the subsequent `rustpython
--install-pip` line as shown in the suggested replacement so the two commands
can be copy-pasted and run successfully.


Expand All @@ -89,6 +82,13 @@ conda install rustpython -c conda-forge
rustpython
```

### SSL provider

For HTTPS requests, `ssl-rustls` feature is enabled by default. You can replace it with `ssl-openssl` feature if your environment requires OpenSSL.
Note that to use OpenSSL on Windows, you may need to install OpenSSL, or you can enable the `ssl-vendor` feature instead,
which compiles OpenSSL for you but requires a C compiler, perl, and `make`.
OpenSSL version 3 is expected and tested in CI. Older versions may not work.

### WASI

You can compile RustPython to a standalone WebAssembly WASI module so it can run anywhere.
Expand Down
14 changes: 9 additions & 5 deletions src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,14 @@ pub use rustpython_vm as vm;
pub use settings::{InstallPipMode, RunMode, parse_opts};
pub use shell::run_shell;

#[cfg(all(
feature = "ssl",
not(any(feature = "ssl-rustls", feature = "ssl-openssl"))
))]
compile_error!(
"Feature \"ssl\" is now enabled by either \"ssl-rustls\" or \"ssl-openssl\" to be enabled. Do not manually pass \"ssl\" feature. To enable ssl-openssl, use --no-default-features to disable ssl-rustls"
);

/// The main cli of the `rustpython` interpreter. This function will return `std::process::ExitCode`
/// based on the return code of the python code ran through the cli.
pub fn run(init: impl FnOnce(&mut VirtualMachine) + 'static) -> ExitCode {
Expand Down Expand Up @@ -141,11 +149,7 @@ __import__("io").TextIOWrapper(
}

fn install_pip(installer: InstallPipMode, scope: Scope, vm: &VirtualMachine) -> PyResult<()> {
if cfg!(feature = "ssl") {
if cfg!(not(any(feature = "ssl-rustls", feature = "ssl-openssl"))) {
// TODO: something
}
} else {
if !cfg!(feature = "ssl") {
return Err(vm.new_exception_msg(
vm.ctx.exceptions.system_error.to_owned(),
"install-pip requires rustpython be build with '--features=ssl'".to_owned(),
Expand Down
Loading