cargo: make vss-server/impls easier to consume as a library by phlip9 · Pull Request #116 · lightningdevkit/vss-server

phlip9 · 2026-09-10T04:04:35Z

server+impls: make postgres native TLS optional

The native-tls crate adds a ton of build headache that I'd like to
avoid if I'm not actually using it. This diff makes it possible to
disable it.

cargo: relax direct dependency version requirements

Make it easier to consume VSS crates as a library. I've limited direct
crate dep semver versions to the first MSRV+semver compatible crate that
compiles and passes all tests.

tokio-v1.30 is the first version that supports OnceCell::const_new
without the parking_lot crate enabled

ldk-reviews-bot · 2026-09-10T04:04:38Z

👋 Thanks for assigning @tnull as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

phlip9 · 2026-09-10T04:06:30Z

Looks like vss-server also needs something like lightningdevkit/ldk-node#1092 to fix MSRV CI checks

tnull

Not opposed to the change, but could expand a bit on a) what headache you're referring to exactly and b) what's your use case for using the crates independently from the vss-server binary?

Changes themselves LGTM I think.

phlip9 · 2026-09-22T01:22:18Z

Sure, let me expand on this a bit:

a) We try really hard to use only one TLS stack (rustls) as much as we can. This is for hardening (avoid exposing more non-memory safe code to the open internet), build convenience (it's slightly annoying to configure openssl+pkgconfig in nix builds and dev machines), dependency minimization, reduced binary bloat, and reduced CI build time. So pulling in openssl and the native-tls crate is something I would like to avoid.

b) We're now running an internal VSS (inside our VPC with mTLS auth). It was actually really nice just pulling in the VssService hyper service from server/src/vss_service.rs and serving it on top of all our existing Rust tooling. This integrates cleanly into our e2e tests, gets all our logs+traces+metrics tooling, mTLS config, instrumented allocator, etc ~ for free. It's not that we can't do this as a separate "opaque" service behind nginx, but then it's definitely harder to test.

tnull · 2026-09-22T08:37:49Z

Sure, let me expand on this a bit:

a) We try really hard to use only one TLS stack (rustls) as much as we can. This is for hardening (avoid exposing more non-memory safe code to the open internet), build convenience (it's slightly annoying to configure openssl+pkgconfig in nix builds and dev machines), dependency minimization, reduced binary bloat, and reduced CI build time. So pulling in openssl and the native-tls crate is something I would like to avoid.

b) We're now running an internal VSS (inside our VPC with mTLS auth). It was actually really nice just pulling in the VssService hyper service from server/src/vss_service.rs and serving it on top of all our existing Rust tooling. This integrates cleanly into our e2e tests, gets all our logs+traces+metrics tooling, mTLS config, instrumented allocator, etc ~ for free. It's not that we can't do this as a separate "opaque" service behind nginx, but then it's definitely harder to test.

Okay, makes sense (though I'm not sure where I stand on the rustls vs openssl arguments, but that is for an orthogonal discussion, trade-offs everywhere).

So, happy to have this land from my side, but @tankyleo still needs to review.

phlip9 · 2026-09-22T23:51:36Z

Pushed a separate PR to fix MSRV CI issues: #117

tankyleo

[Some buggy github stuff ignore this]

Make it easier to consume VSS crates as a library. I've limited direct crate dep semver versions to the first MSRV+semver compatible crate that compiles and passes all tests. * tokio-v1.30 is the first version that supports `OnceCell::const_new` without the `parking_lot` crate enabled

The `native-tls` crate adds a ton of build headache that I'd like to avoid if I'm not actually using it. This diff makes it possible to disable it.

Ensure that crates continue to build if we resolve dependencies to the minimal version specified in the Cargo.toml (vs the versions locked in the Cargo.lock).

tankyleo · 2026-09-25T01:33:00Z

+tokio = { version = "1.30", default-features = false, features = ["rt", "macros"] }
+native-tls = { version = "0.2.4", default-features = false }
+postgres-native-tls = { version = "0.5", default-features = false, features = ["runtime"] }
+log = { version = "0.4.8", default-features = false }


nit: looks like we can still pull this down to 0.4.6 ? Same for server/Cargo.toml.

tankyleo · 2026-09-25T01:36:30Z

 include `sub` and `exp` claims, and omit `aud`; `sub` becomes the VSS storage user token. VSS only
 verifies tokens, you must run the service that issues them.

+### Optional Features


Let's put this section right after prerequisites above, with a H2 header instead of H3

tankyleo · 2026-09-25T01:38:31Z

+          rustup default ${{ env.TOOLCHAIN }}
+          rustup component add rustfmt
+      - name: Run rustfmt checks
+        run: cargo fmt --check


we've got this check already in ping-tests.yml I know it's hidden away in there.

Let's drop the fmt command in ping-tests.yml, and use fmt --all --check here

tankyleo · 2026-09-25T01:42:25Z

+          cargo check --workspace
+          cargo check --workspace --no-default-features


Sounds like we can do a single

cargo hack check --workspace --each-feature --locked

here to test all feature combinations ?

ldk-reviews-bot requested a review from tankyleo September 10, 2026 04:14

tnull self-requested a review September 11, 2026 21:13

tnull reviewed Sep 21, 2026

View reviewed changes

Comment thread impls/src/postgres_store.rs

phlip9 force-pushed the phlip9/relax-deps branch from 0d96d8d to c257e98 Compare September 22, 2026 01:01

tankyleo reviewed Sep 23, 2026

View reviewed changes

Comment thread impls/Cargo.toml

Comment thread server/Cargo.toml

Comment thread impls/src/lib.rs Outdated

Comment thread impls/Cargo.toml

Comment thread server/Cargo.toml

tankyleo reviewed Sep 23, 2026

View reviewed changes

phlip9 added 2 commits September 23, 2026 16:27

server+impls: make postgres native TLS optional

f4ae56b

The `native-tls` crate adds a ton of build headache that I'd like to avoid if I'm not actually using it. This diff makes it possible to disable it.

phlip9 force-pushed the phlip9/relax-deps branch from c257e98 to f4ae56b Compare September 24, 2026 00:08

phlip9 added 4 commits September 23, 2026 17:35

ci: update actions/checkout v3 -> v7

019b348

ci: better workflow defaults

50ced5c

ci: add rustfmt checks

7a3e207

ci: add minimal-versions check

f18aec2

Ensure that crates continue to build if we resolve dependencies to the minimal version specified in the Cargo.toml (vs the versions locked in the Cargo.lock).

tankyleo reviewed Sep 25, 2026

View reviewed changes

		cargo check --workspace
		cargo check --workspace --no-default-features

Conversation

phlip9 commented Sep 10, 2026

server+impls: make postgres native TLS optional

cargo: relax direct dependency version requirements

Uh oh!

ldk-reviews-bot commented Sep 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phlip9 commented Sep 10, 2026

Uh oh!

tnull left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

phlip9 commented Sep 22, 2026

Uh oh!

tnull commented Sep 22, 2026

Uh oh!

phlip9 commented Sep 22, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tankyleo left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tankyleo Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

tankyleo Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

tankyleo Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

tankyleo Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ldk-reviews-bot commented Sep 10, 2026 •

edited

Loading

tankyleo left a comment •

edited

Loading