fix(stm): stop forcing rustls in the future_snark feature

The TLS backend of the SRS download is now selected by the callers,
which makes the native-tls feature usable.

Author: jpraynaud

.github/workflows/test-rust.yml

@@ -19,7 +19,7 @@ jobs:
             test-args: --features full,unstable --workspace
             cargo-profile: ci-tests
           - os: ubuntu-24.04
-            test-args: --features future_snark -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
+            test-args: --features future_snark,rustls -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
             artifact-suffix: -future-snark
             # Default to the fast profile; the `prepare` step upgrades to `slow-cargo-profile`
             # only when the slow SNARK tests are actually in scope for this run (so we don't pay

demo/protocol-demo/Cargo.toml

@@ -9,8 +9,11 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [features]
+default = ["rustls"]
 # Enable experimental SNARK support in mithril-stm and mithril-common.
 future_snark = ["mithril-stm/future_snark", "mithril-common/future_snark"]
+# Enable the TLS features of mithril-stm.
+rustls = ["mithril-stm/rustls"]
 
 [dependencies]
 clap = { workspace = true }

docs/runbook/update-circuit-keys/README.md

@@ -29,13 +29,13 @@ Reviewers:
 Commands to run the integrity tests:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_non_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_non_recursive_production_key -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_recursive_production_key -- --ignored
 ```
 
 Release manager:
@@ -52,13 +52,13 @@ The author needs to update the golden value of the verification keys in the gold
 To update the production circuit verification keys, one needs to run the following commands:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 that will update the files holding the values of the production keys, `mithril-stm/src/circuits/halo2/non_recursive_circuit_verification_key_for_production.bin` and `mithril-stm/src/circuits/halo2_ivc/recursive_circuit_verification_key_for_production.bin`.

mithril-aggregator/Cargo.toml

@@ -11,7 +11,7 @@ repository = { workspace = true }
 
 [features]
 default = ["rustls"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 future_snark = ["mithril-common/future_snark", "dep:ciborium"]
 

mithril-client/Cargo.toml

@@ -30,13 +30,13 @@ unstable = []
 
 # These features are for support of dependent crates only.
 # They do not change the operation of the main crate.
-native-tls = ["reqwest/native-tls"]
-native-tls-no-alpn = ["reqwest/native-tls-no-alpn"]
-native-tls-vendored = ["reqwest/native-tls-vendored"]
-native-tls-vendored-no-alpn = ["reqwest/native-tls-vendored-no-alpn"]
+native-tls = ["mithril-common/native-tls", "reqwest/native-tls"]
+native-tls-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-no-alpn"]
+native-tls-vendored = ["mithril-common/native-tls", "reqwest/native-tls-vendored"]
+native-tls-vendored-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-vendored-no-alpn"]
 
-rustls = ["reqwest/rustls"]
-rustls-no-provider = ["reqwest/rustls-no-provider"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
+rustls-no-provider = ["mithril-common/rustls", "reqwest/rustls-no-provider"]
 
 # Support compressed traffic with `reqwest`
 enable-http-compression = ["reqwest/gzip", "reqwest/zstd", "reqwest/deflate", "reqwest/brotli"]

mithril-common/Cargo.toml

@@ -32,6 +32,11 @@ allow_skip_signer_certification = []
 # Enables the future SNARK implementation for the `mithril-stm` dependency
 future_snark = ["mithril-stm/future_snark"]
 
+# Enables the TLS features for the `mithril-stm` dependency
+# Exactly one of these must be enabled together with `future_snark`
+native-tls = ["mithril-stm/native-tls"]
+rustls = ["mithril-stm/rustls"]
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }

mithril-relay/Cargo.toml

@@ -13,7 +13,7 @@ repository = { workspace = true }
 default = ["rustls"]
 # For activating snark features
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }

mithril-signer/Cargo.toml

@@ -16,7 +16,7 @@ ignored = ["reqwest"]
 [features]
 default = ["rustls"]
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }

mithril-stm/Cargo.toml

@@ -31,8 +31,6 @@ future_snark = [
     "dep:sha2",
     "dep:rand_chacha",
     "dep:reqwest",
-    # Temporarily activate rustls before it is activated in the caller
-    "rustls",
 ]
 # TLS backend for the SRS download client (used by `future_snark`).
 # Exactly one of these must be enabled together with `future_snark`.

mithril-stm/README.md

@@ -43,6 +43,14 @@ cd mithril-stm
 cargo build --release
 ```
 
+## TLS backend
+
+The `future_snark` feature downloads the SRS of the trusted setup over HTTPS and lets the caller pick the TLS backend. Enable exactly one of the `rustls` or `native-tls` features along with it:
+
+```shell
+cargo build --release --features future_snark,rustls
+```
+
 ## Running the tests
 
 For running rust tests, simply run (to run the tests faster, the use of `--release` flag is recommended):
@@ -247,15 +255,15 @@ Three metrics are measured per tier: VK/PK setup time, proof generation time, an
 Small and medium tiers use Criterion (10 samples, flat sampling — one iteration per sample):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/small
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/medium
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/small
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/medium
 ```
 
 Large and production tiers run a single timed measurement (Criterion's 10-sample minimum is impractical at this scale):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/large
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/production
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/large
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/production
 ```
 
 ## CI Parameter Benchmarks
@@ -294,5 +302,5 @@ All tiers complete in under 15 minutes on any developer machine with at least 4
 ### Running the benchmarks
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_prover_modes
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_prover_modes
 ```