34 lines
1.4 KiB
TOML
34 lines
1.4 KiB
TOML
# Native-only crate. On wasm32 it compiles to nothing (aws-lc does not build there, and the
|
|
# browser's TLS is the browser's), so the workspace's wasm lines need no exclude for it.
|
|
[package]
|
|
name = "flowrs-tls"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
publish.workspace = true
|
|
rust-version.workspace = true
|
|
authors.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "The one TLS configuration every flowRS client and server uses: rustls on aws-lc-rs, X25519MLKEM768 (FIPS 203 ML-KEM-768 with X25519) offered first."
|
|
|
|
[lib]
|
|
crate-type = ["rlib"]
|
|
|
|
[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
|
|
# aws-lc-rs is the provider with ML-KEM; ring's has none. Already in the lock through
|
|
# reqwest. `prefer-post-quantum` is named so that every rustls user unified into the same
|
|
# build (reqwest's default provider included) offers the hybrid first too; this crate's own
|
|
# provider does not rely on it and lists its groups in order. 0.23.46 is the floor: it
|
|
# fixes RUSTSEC-2026-0349, where one forged ServerHello made later connections classical.
|
|
rustls = { version = "0.23.46", default-features = false, features = [
|
|
"aws_lc_rs",
|
|
"prefer-post-quantum",
|
|
"std",
|
|
"tls12",
|
|
] }
|
|
|
|
[features]
|
|
default = []
|
|
# A loopback TLS server that agrees to X25519MLKEM768 and nothing else, and an in-memory
|
|
# handshake driver: what other crates' tests use to show their clients offer the hybrid
|
|
# first. Enabled from dev-dependencies only.
|
|
testing = []
|