prisma-engines icon indicating copy to clipboard operation
prisma-engines copied to clipboard

Use `rustls`

Open Milo123459 opened this issue 3 years ago • 4 comments

Related: https://github.com/Brendonovich/prisma-client-rust/issues/101

Milo123459 avatar Jul 10 '22 15:07 Milo123459

Reasoning: makes life easier when cross-building and rustls removes a bunch of build time.

Suya1671 avatar Jul 10 '22 18:07 Suya1671

All the database crates must use rustls for this to work out. We tried with Tiberius and SQL Server for one version, and got bug reports back for certain SQL Server instances that ceased to work with rustls.

For now, the best compatibility is to just embed OpenSSL everywhere and if not having too many issues, use the system SSL to get the security updates.

Schannel and OpenSSL work pretty well with everything. Apple's Security Framework and rustls are having issues quite often.

pimeys avatar Jul 10 '22 18:07 pimeys

All the database crates must use rustls for this to work out. We tried with Tiberius and SQL Server for one version, and got bug reports back for certain SQL Server instances that ceased to work with rustls.

For now, the best compatibility is to just embed OpenSSL everywhere and if not having too many issues, use the system SSL to get the security updates.

Schannel and OpenSSL work pretty well with everything. Apple's Security Framework and rustls are having issues quite often.

Cross compiling and using this crate in things like alpine are incredibly difficult with openSSL. There should atleast be an option to toggle rustls

Suya1671 avatar Jul 10 '22 18:07 Suya1671

You can start by looking into getting tokio-postgres and mysql_async working with rustls. Then do a PR to quaint, and another one to engines that enables a feature flag, switching from system TLS to rustls.

It's kind of a lot of work, and I doubt we will do it in the near future.

pimeys avatar Jul 10 '22 18:07 pimeys