Merge pull request #3439 from IntersectMBO/jpraynaud/3423-fix-rustls-setup-stm

jpraynaud · web-flow · commit be497f01cd31 · 2026-08-03T10:58:21.000+02:00
fix(stm): stop forcing `rustls` in the `future_snark` feature
diff --git a/.github/workflows/test-rust.yml b/.github/workflows/test-rust.yml
@@ -19,7 +19,7 @@ jobs:
             test-args: --features full,unstable --workspace
             cargo-profile: ci-tests
           - os: ubuntu-24.04
-            test-args: --features future_snark -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
+            test-args: --features future_snark,rustls -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
             artifact-suffix: -future-snark
             # Default to the fast profile; the `prepare` step upgrades to `slow-cargo-profile`
             # only when the slow SNARK tests are actually in scope for this run (so we don't pay
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/demo/protocol-demo/Cargo.toml b/demo/protocol-demo/Cargo.toml
@@ -9,8 +9,11 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [features]
+default = ["rustls"]
 # Enable experimental SNARK support in mithril-stm and mithril-common.
 future_snark = ["mithril-stm/future_snark", "mithril-common/future_snark"]
+# Enable the TLS features of mithril-stm.
+rustls = ["mithril-stm/rustls"]
 
 [dependencies]
 clap = { workspace = true }
diff --git a/docs/runbook/update-circuit-keys/README.md b/docs/runbook/update-circuit-keys/README.md
@@ -29,13 +29,13 @@ Reviewers:
 Commands to run the integrity tests:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_non_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_non_recursive_production_key -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_recursive_production_key -- --ignored
 ```
 
 Release manager:
@@ -52,13 +52,13 @@ The author needs to update the golden value of the verification keys in the gold
 To update the production circuit verification keys, one needs to run the following commands:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 that will update the files holding the values of the production keys, `mithril-stm/src/circuits/halo2/non_recursive_circuit_verification_key_for_production.bin` and `mithril-stm/src/circuits/halo2_ivc/recursive_circuit_verification_key_for_production.bin`.
diff --git a/internal/cardano-node/mithril-cardano-node-internal-database/Cargo.toml b/internal/cardano-node/mithril-cardano-node-internal-database/Cargo.toml
@@ -15,7 +15,7 @@ anyhow = { workspace = true }
 async-trait = { workspace = true }
 digest = { workspace = true }
 hex = { workspace = true }
-mithril-common = { path = "../../../mithril-common", version = "0.7.14" }
+mithril-common = { path = "../../../mithril-common", version = "0.7.15" }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = "0.10.9"
diff --git a/internal/mithril-aggregator-client/Cargo.toml b/internal/mithril-aggregator-client/Cargo.toml
@@ -13,7 +13,7 @@ include = ["**/*.rs", "Cargo.toml", "README.md"]
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
-mithril-common = { path = "../../mithril-common", version = "0.7.14" }
+mithril-common = { path = "../../mithril-common", version = "0.7.15" }
 reqwest = { workspace = true }
 semver = { workspace = true }
 serde = { workspace = true }
diff --git a/internal/mithril-aggregator-discovery/Cargo.toml b/internal/mithril-aggregator-discovery/Cargo.toml
@@ -14,7 +14,7 @@ include = ["**/*.rs", "Cargo.toml", "README.md", ".gitignore"]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
 mithril-aggregator-client = { path = "../mithril-aggregator-client", version = "0.2.4" }
-mithril-common = { path = "../../mithril-common", version = "0.7.14" }
+mithril-common = { path = "../../mithril-common", version = "0.7.15" }
 rand = { version = "0.10.2" }
 reqwest = { workspace = true }
 serde = { workspace = true }
diff --git a/mithril-aggregator/Cargo.toml b/mithril-aggregator/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-aggregator"
-version = "0.9.18"
+version = "0.9.19"
 description = "A Mithril Aggregator server"
 authors = { workspace = true }
 edition = { workspace = true }
@@ -11,7 +11,7 @@ repository = { workspace = true }
 
 [features]
 default = ["rustls"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 future_snark = ["mithril-common/future_snark", "dep:ciborium"]
 
diff --git a/mithril-client/Cargo.toml b/mithril-client/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-client"
-version = "0.14.17"
+version = "0.14.18"
 description = "Mithril client library"
 authors = { workspace = true }
 edition = { workspace = true }
@@ -30,13 +30,13 @@ unstable = []
 
 # These features are for support of dependent crates only.
 # They do not change the operation of the main crate.
-native-tls = ["reqwest/native-tls"]
-native-tls-no-alpn = ["reqwest/native-tls-no-alpn"]
-native-tls-vendored = ["reqwest/native-tls-vendored"]
-native-tls-vendored-no-alpn = ["reqwest/native-tls-vendored-no-alpn"]
+native-tls = ["mithril-common/native-tls", "reqwest/native-tls"]
+native-tls-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-no-alpn"]
+native-tls-vendored = ["mithril-common/native-tls", "reqwest/native-tls-vendored"]
+native-tls-vendored-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-vendored-no-alpn"]
 
-rustls = ["reqwest/rustls"]
-rustls-no-provider = ["reqwest/rustls-no-provider"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
+rustls-no-provider = ["mithril-common/rustls", "reqwest/rustls-no-provider"]
 
 # Support compressed traffic with `reqwest`
 enable-http-compression = ["reqwest/gzip", "reqwest/zstd", "reqwest/deflate", "reqwest/brotli"]
@@ -64,7 +64,7 @@ flate2 = { version = "1.1.9", optional = true }
 flume = { version = "0.12.0", optional = true }
 futures = "0.3.32"
 mithril-aggregator-client = { path = "../internal/mithril-aggregator-client", version = "0.2.4" }
-mithril-common = { path = "../mithril-common", version = "0.7.14", default-features = false }
+mithril-common = { path = "../mithril-common", version = "0.7.15", default-features = false }
 reqwest = { workspace = true, default-features = false, features = ["charset", "http2", "stream", "system-proxy"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
diff --git a/mithril-common/Cargo.toml b/mithril-common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-common"
-version = "0.7.14"
+version = "0.7.15"
 description = "Common types, interfaces, and utilities for Mithril nodes."
 authors = { workspace = true }
 edition = { workspace = true }
@@ -32,6 +32,11 @@ allow_skip_signer_certification = []
 # Enables the future SNARK implementation for the `mithril-stm` dependency
 future_snark = ["mithril-stm/future_snark"]
 
+# Enables the TLS features for the `mithril-stm` dependency
+# Exactly one of these must be enabled together with `future_snark`
+native-tls = ["mithril-stm/native-tls"]
+rustls = ["mithril-stm/rustls"]
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }
@@ -46,7 +51,7 @@ fixed = "1.31.0"
 hex = { workspace = true }
 kes-summed-ed25519 = { version = "0.2.1", features = ["serde_enabled", "sk_clone_enabled"] }
 mithril-merkle-tree = { path = "../internal/mithril-merkle-tree", version = "0.1.4" }
-mithril-stm = { path = "../mithril-stm", version = "0.12.0", default-features = false }
+mithril-stm = { path = "../mithril-stm", version = "0.12.1", default-features = false }
 nom = "8.0.0"
 rand_chacha = { workspace = true }
 rand_core = { workspace = true }
diff --git a/mithril-relay/Cargo.toml b/mithril-relay/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-relay"
-version = "0.2.7"
+version = "0.2.8"
 description = "A Mithril relay"
 authors = { workspace = true }
 edition = { workspace = true }
@@ -13,7 +13,7 @@ repository = { workspace = true }
 default = ["rustls"]
 # For activating snark features
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }
diff --git a/mithril-signer/Cargo.toml b/mithril-signer/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-signer"
-version = "1.1.6"
+version = "1.1.7"
 description = "A Mithril Signer"
 authors = { workspace = true }
 edition = { workspace = true }
@@ -16,7 +16,7 @@ ignored = ["reqwest"]
 [features]
 default = ["rustls"]
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }
diff --git a/mithril-stm/CHANGELOG.md b/mithril-stm/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.12.1 (08-03-2026)
+
+### Changed
+
+- The `future_snark` feature no longer enables the `rustls` feature: the TLS backend of the SRS download is now selected by the caller, which makes the `native-tls` feature usable.
+
 ## 0.12.0 (07-29-2026)
 
 ### Added
diff --git a/mithril-stm/Cargo.toml b/mithril-stm/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mithril-stm"
-version = "0.12.0"
+version = "0.12.1"
 edition = { workspace = true }
 authors = { workspace = true }
 homepage = { workspace = true }
@@ -31,8 +31,6 @@ future_snark = [
     "dep:sha2",
     "dep:rand_chacha",
     "dep:reqwest",
-    # Temporarily activate rustls before it is activated in the caller
-    "rustls",
 ]
 # TLS backend for the SRS download client (used by `future_snark`).
 # Exactly one of these must be enabled together with `future_snark`.
diff --git a/mithril-stm/README.md b/mithril-stm/README.md
@@ -43,6 +43,14 @@ cd mithril-stm
 cargo build --release
 ```
 
+## TLS backend
+
+The `future_snark` feature downloads the SRS of the trusted setup over HTTPS and lets the caller pick the TLS backend. Enable exactly one of the `rustls` or `native-tls` features along with it:
+
+```shell
+cargo build --release --features future_snark,rustls
+```
+
 ## Running the tests
 
 For running rust tests, simply run (to run the tests faster, the use of `--release` flag is recommended):
@@ -246,15 +254,15 @@ Three metrics are measured per tier: VK/PK setup time, proof generation time, an
 Small and medium tiers use Criterion (10 samples, flat sampling — one iteration per sample):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/small
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/medium
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/small
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/medium
 ```
 
 Large and production tiers run a single timed measurement (Criterion's 10-sample minimum is impractical at this scale):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/large
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/production
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/large
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/production
 ```
 
 ## CI Parameter Benchmarks
@@ -293,5 +301,5 @@ All tiers complete in under 15 minutes on any developer machine with at least 4
 ### Running the benchmarks
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_prover_modes
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_prover_modes
 ```
diff --git a/mithril-stm/benches/README.md b/mithril-stm/benches/README.md
diff --git a/mithril-stm/src/circuits/halo2_ivc/tests/assets/README.md b/mithril-stm/src/circuits/halo2_ivc/tests/assets/README.md
diff --git a/mithril-test-lab/mithril-end-to-end/Cargo.toml b/mithril-test-lab/mithril-end-to-end/Cargo.toml
