cargo: make vss-server/impls easier to consume as a library

.github/workflows/checks.yml

@@ -0,0 +1,61 @@
+name: Continuous Integration Checks
+
+on: [push, pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  rustfmt:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      TOOLCHAIN: 1.85.0
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Install Rust ${{ env.TOOLCHAIN }} toolchain
+        run: |
+          rustup toolchain install ${{ env.TOOLCHAIN }} --profile minimal
+          rustup default ${{ env.TOOLCHAIN }}
+          rustup component add rustfmt
+      - name: Run rustfmt checks
+        run: cargo fmt --check
+
+  minimal-versions:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        toolchain: [ stable, 1.85.0 ] # 1.85.0 is the MSRV
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Install Rust ${{ matrix.toolchain }} toolchain
+        run: |
+          rustup toolchain install ${{ matrix.toolchain }} --profile minimal
+          rustup default ${{ matrix.toolchain }}
+      - name: Install cargo-hack
+        uses: taiki-e/install-action@cargo-hack
+      - uses: Swatinem/rust-cache@v2
+      - name: "check -Z direct-minimal-versions"
+        run: |
+          # Remove dev-deps from all Cargo.toml's to prevent `cargo update` from
+          # determining minimal versions based on dev-deps.
+          cargo hack --remove-dev-deps --workspace
+
+          # Resolve direct dependencies using the min. version specified in our
+          # Cargo.toml's.
+          RUSTC_BOOTSTRAP=1 cargo update -Z direct-minimal-versions
+
+          cargo check --workspace
+          cargo check --workspace --no-default-features

.github/workflows/implementation-tests.yml

@@ -6,6 +6,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   postgres-backend-tests:
     strategy:
@@ -33,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           path: vss-server
       - name: Install Rust toolchain
@@ -45,3 +52,4 @@ jobs:
         run: |
           cd vss-server/impls
           cargo test -- --test-threads=1
+          cargo test --no-default-features -- --test-threads=1

.github/workflows/ldk-node-integration-tests.yml

@@ -6,6 +6,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   ldk-node-integration-tests:
     strategy:
@@ -33,11 +40,11 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           path: vss-server
       - name: Checkout LDK Node
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
         with:
           repository: lightningdevkit/ldk-node
           path: ldk-node

.github/workflows/ping-tests.yml

@@ -6,6 +6,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   ping-tests:
     strategy:
@@ -33,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install Rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }} --profile minimal --component rustfmt

.github/workflows/server-tests.yml

@@ -6,6 +6,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
 jobs:
   server-tests:
     strategy:
@@ -33,7 +40,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
       - name: Install Rust toolchain
         run: |
           rustup toolchain install ${{ matrix.toolchain }} --profile minimal

Cargo.toml

@@ -15,7 +15,7 @@ repository = "https://github.com/lightningdevkit/vss-server/"
 [workspace.dependencies]
 api = { package = "vss-api", version = "0.1.0-alpha.0", path = "./api" }
 auth-impls = { package = "vss-auth-impls", version = "0.1.0-alpha.0", path = "./auth-impls" }
-impls = { package = "vss-impls", version = "0.1.0-alpha.0", path = "./impls" }
+impls = { package = "vss-impls", version = "0.1.0-alpha.0", path = "./impls", default-features = false }
 
 [profile.release]
 panic = "abort"

api/Cargo.toml

@@ -10,13 +10,13 @@ homepage.workspace = true
 repository.workspace = true
 
 [dependencies]
-async-trait = "0.1.77"
-prost = { version = "0.11.6", default-features = false, features = ["std", "prost-derive"] }
-bytes = "1.4.0"
-rand = { version = "0.8.5", optional = true}
+async-trait = "0.1.13"
+prost = { version = "0.11", default-features = false, features = ["std", "prost-derive"] }
+bytes = "1"
+rand = { version = "0.8", optional = true}
 
 [target.'cfg(genproto)'.build-dependencies]
-prost-build = { version = "0.11.3" }
+prost-build = { version = "0.11" }
 
 [dev-dependencies]
 

auth-impls/Cargo.toml

@@ -15,15 +15,15 @@ sigs = [ "bitcoin_hashes", "hex-conservative", "secp256k1" ]
 
 [dependencies]
 api = { workspace = true }
-async-trait = "0.1.77"
-base64 = { version = "0.22.1", optional = true, default-features = false, features = ["std"] }
+async-trait = "0.1.13"
+base64 = { version = "0.22", optional = true, default-features = false, features = ["std"] }
 bitcoin_hashes = { version = "1.0", optional = true, default-features = false }
 hex-conservative = { version = "1.0", optional = true, default-features = false }
-openssl = { version = "0.10.75", optional = true, default-features = false }
+openssl = { version = "0.10.39", optional = true, default-features = false }
 secp256k1 = { version = "0.31", optional = true, default-features = false, features = [ "global-context" ] }
-serde = { version = "1.0.210", optional = true, default-features = false, features = ["derive"] }
-serde_json = { version = "1.0.149", optional = true, default-features = false, features = ["std"] }
+serde = { version = "1.0.184", optional = true, default-features = false, features = ["derive"] }
+serde_json = { version = "1.0.45", optional = true, default-features = false, features = ["std"] }
 
 [dev-dependencies]
-jsonwebtoken = { version = "9.3.0", default-features = false, features = ["use_pem"] }
-tokio = { version = "1.38.0", default-features = false, features = ["rt-multi-thread", "macros"] }
+jsonwebtoken = { version = "9", default-features = false, features = ["use_pem"] }
+tokio = { version = "1.30", default-features = false, features = ["rt-multi-thread", "macros"] }

docs/getting-started.md

@@ -7,7 +7,8 @@ the threat model and auth overview, see the root [README](../README.md).
 
 - Rust and Cargo, using at least the repository MSRV of 1.85.0.
 - PostgreSQL 15 or newer.
-- OpenSSL development/runtime libraries for PostgreSQL TLS support.
+- **(Optional)** OpenSSL development/runtime libraries for JWT authentication and PostgreSQL TLS
+  support. These features are enabled by default.
 
 ## Quick Start with Docker PostgreSQL
 
@@ -99,6 +100,20 @@ or set `VSS_JWT_RSA_PEM`. Clients must send `Authorization: Bearer <jwt>`. Token
 include `sub` and `exp` claims, and omit `aud`; `sub` becomes the VSS storage user token. VSS only
 verifies tokens, you must run the service that issues them.
 
+### Optional Features
+
+The following optional cargo features are available, all enabled by default:
+
+- `jwt`: Enables JWT authentication
+- `sigs`: Enables Signature authentication
+- `postgres-native-tls`: Enables connecting to PostgreSQL via TLS
+
+For example, to build without OpenSSL enable only the `sigs` feature:
+
+```bash
+cargo build --release --no-default-features --features sigs
+```
+
 ### Local No-Auth Mode
 
 For local development only, build with the cfg-gated no-op authorizer:

impls/Cargo.toml

@@ -9,17 +9,21 @@ license.workspace = true
 homepage.workspace = true
 repository.workspace = true
 
+[features]
+default = ["postgres-native-tls"]
+postgres-native-tls = ["dep:native-tls", "dep:postgres-native-tls"]
+
 [dependencies]
-async-trait = "0.1.77"
+async-trait = "0.1.13"
 api = { workspace = true }
-chrono = "0.4.38"
-tokio-postgres = { version = "0.7.12", features = ["with-chrono-0_4"] }
-bytes = "1.4.0"
-tokio = { version = "1.38.0", default-features = false, features = ["rt", "macros"] }
-native-tls = { version = "0.2.14", default-features = false }
-postgres-native-tls = { version = "0.5.2", default-features = false, features = ["runtime"] }
-log = { version = "0.4.29", default-features = false }
+chrono = "0.4.16"
+tokio-postgres = { version = "0.7.15", features = ["with-chrono-0_4"] }
+bytes = "1"
+tokio = { version = "1.30", default-features = false, features = ["rt", "macros"] }
+native-tls = { version = "0.2.4", optional = true, default-features = false }
+postgres-native-tls = { version = "0.5", optional = true, default-features = false, features = ["runtime"] }
+log = { version = "0.4.8", default-features = false }
 
 [dev-dependencies]
-tokio = { version = "1.38.0", default-features = false, features = ["rt-multi-thread", "macros"] }
+tokio = { version = "1.30", default-features = false, features = ["rt-multi-thread", "macros"] }
 api = { workspace = true, features = ["_test_utils"] }

impls/src/postgres_store.rs

@@ -9,8 +9,6 @@ use api::types::{
 use async_trait::async_trait;
 use bytes::Bytes;
 use chrono::Utc;
-use native_tls::TlsConnector;
-use postgres_native_tls::MakeTlsConnector;
 use std::cmp::min;
 use std::io::{self, Error, ErrorKind};
 use tokio::sync::Mutex;
@@ -19,6 +17,7 @@ use tokio_postgres::{Client, NoTls, Socket, Transaction, error};
 
 use log::{debug, info, warn};
 
+#[cfg(feature = "postgres-native-tls")]
 pub use native_tls::Certificate;
 
 pub(crate) struct VssDbRecord {
@@ -146,7 +145,8 @@ where
 pub type PostgresPlaintextBackend = PostgresBackend<NoTls>;
 
 /// A postgres backend with TLS connections to the database
-pub type PostgresTlsBackend = PostgresBackend<MakeTlsConnector>;
+#[cfg(feature = "postgres-native-tls")]
+pub type PostgresTlsBackend = PostgresBackend<postgres_native_tls::MakeTlsConnector>;
 
 async fn make_db_connection<T>(
 	postgres_endpoint: &str, db_name: &str, tls: T,
@@ -228,12 +228,13 @@ impl PostgresPlaintextBackend {
 	}
 }
 
+#[cfg(feature = "postgres-native-tls")]
 impl PostgresTlsBackend {
 	/// Constructs a [`PostgresTlsBackend`] using `postgres_endpoint` for PostgreSQL connection information.
 	pub async fn new(
 		postgres_endpoint: &str, default_db: &str, vss_db: &str, crt_pem: Option<&str>,
 	) -> Result<Self, Error> {
-		let mut builder = TlsConnector::builder();
+		let mut builder = native_tls::TlsConnector::builder();
 		if let Some(pem) = crt_pem {
 			let crt = Certificate::from_pem(pem.as_bytes()).map_err(|e| {
 				Error::new(
@@ -250,7 +251,7 @@ impl PostgresTlsBackend {
 			postgres_endpoint,
 			default_db,
 			vss_db,
-			MakeTlsConnector::new(connector),
+			postgres_native_tls::MakeTlsConnector::new(connector),
 		)
 		.await
 	}

server/Cargo.toml

@@ -10,9 +10,10 @@ homepage.workspace = true
 repository.workspace = true
 
 [features]
+default = [ "jwt", "sigs", "postgres-native-tls" ]
 jwt = ["auth-impls/jwt"]
 sigs = ["auth-impls/sigs"]
-default = [ "jwt", "sigs" ]
+postgres-native-tls = ["impls/postgres-native-tls"]
 
 [dependencies]
 api = { workspace = true }
@@ -21,15 +22,15 @@ impls = { workspace = true }
 
 hyper = { version = "1", default-features = false, features = ["server", "http1"] }
 http-body-util = { version = "0.1", default-features = false }
-hyper-util = { version = "0.1", default-features = false, features = ["server-graceful"] }
-tokio = { version = "1.38.0", default-features = false, features = ["time", "signal", "rt-multi-thread", "macros"] }
-prost = { version = "0.11.6", default-features = false, features = ["std"] }
-bytes = "1.4.0"
-serde = { version = "1.0.203", default-features = false, features = ["derive"] }
-toml = { version = "0.8.9", default-features = false, features = ["parse"] }
-log = { version = "0.4.29", default-features = false, features = ["std"] }
-chrono = { version = "0.4", default-features = false, features = ["clock"] }
-rand = { version = "0.9.2", default-features = false }
+hyper-util = { version = "0.1", default-features = false, features = ["tokio"] }
+tokio = { version = "1.30", default-features = false, features = ["time", "signal", "rt-multi-thread", "macros"] }
+prost = { version = "0.11", default-features = false, features = ["std"] }
+bytes = "1"
+serde = { version = "1.0.184", default-features = false, features = ["derive"] }
+toml = { version = "0.8", default-features = false, features = ["parse"] }
+log = { version = "0.4.8", default-features = false, features = ["std"] }
+chrono = { version = "0.4.16", default-features = false, features = ["clock"] }
+rand = { version = "0.9", default-features = false }
 
 [target.'cfg(noop_authorizer)'.dependencies]
 api = { workspace = true, features = ["_test_utils"] }