Skip to content

cargo: make vss-server/impls easier to consume as a library #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
phlip9 wants to merge 6 commits into
base: main
Choose a base branch
from
Open

cargo: make vss-server/impls easier to consume as a library #116

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0cf41d9
cargo: relax direct dependency version requirements
phlip9 Sep 9, 2026
f4ae56b
server+impls: make postgres native TLS optional
phlip9 Sep 9, 2026
019b348
ci: update actions/checkout v3 -> v7
phlip9 Sep 24, 2026
50ced5c
ci: better workflow defaults
phlip9 Sep 24, 2026
7a3e207
ci: add rustfmt checks
phlip9 Sep 24, 2026
f18aec2
ci: add minimal-versions check
phlip9 Sep 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 61 additions & 0 deletions .github/workflows/checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,61 @@
name: Continuous Integration Checks

on: [push, pull_request]

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

defaults:
run:
shell: bash

jobs:
rustfmt:
runs-on: ubuntu-latest
timeout-minutes: 15
env:
TOOLCHAIN: 1.85.0
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Install Rust ${{ env.TOOLCHAIN }} toolchain
run: |
rustup toolchain install ${{ env.TOOLCHAIN }} --profile minimal
rustup default ${{ env.TOOLCHAIN }}
rustup component add rustfmt
- name: Run rustfmt checks
run: cargo fmt --check

minimal-versions:
runs-on: ubuntu-latest
timeout-minutes: 15
strategy:
fail-fast: false
matrix:
toolchain: [ stable, 1.85.0 ] # 1.85.0 is the MSRV
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Install Rust ${{ matrix.toolchain }} toolchain
run: |
rustup toolchain install ${{ matrix.toolchain }} --profile minimal
rustup default ${{ matrix.toolchain }}
- name: Install cargo-hack
uses: taiki-e/install-action@cargo-hack
- uses: Swatinem/rust-cache@v2
- name: "check -Z direct-minimal-versions"
run: |
# Remove dev-deps from all Cargo.toml's to prevent `cargo update` from
# determining minimal versions based on dev-deps.
cargo hack --remove-dev-deps --workspace

# Resolve direct dependencies using the min. version specified in our
# Cargo.toml's.
RUSTC_BOOTSTRAP=1 cargo update -Z direct-minimal-versions

cargo check --workspace
cargo check --workspace --no-default-features
10 changes: 9 additions & 1 deletion .github/workflows/implementation-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

defaults:
run:
shell: bash

jobs:
postgres-backend-tests:
strategy:
Expand Down Expand Up @@ -33,7 +40,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v7
with:
path: vss-server
- name: Install Rust toolchain
Expand All @@ -45,3 +52,4 @@ jobs:
run: |
cd vss-server/impls
cargo test -- --test-threads=1
cargo test --no-default-features -- --test-threads=1
11 changes: 9 additions & 2 deletions .github/workflows/ldk-node-integration-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

defaults:
run:
shell: bash

jobs:
ldk-node-integration-tests:
strategy:
Expand Down Expand Up @@ -33,11 +40,11 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v7
with:
path: vss-server
- name: Checkout LDK Node
uses: actions/checkout@v3
uses: actions/checkout@v7
with:
repository: lightningdevkit/ldk-node
path: ldk-node
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/ping-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

defaults:
run:
shell: bash

jobs:
ping-tests:
strategy:
Expand Down Expand Up @@ -33,7 +40,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v7
- name: Install Rust toolchain
run: |
rustup toolchain install ${{ matrix.toolchain }} --profile minimal --component rustfmt
Expand Down
9 changes: 8 additions & 1 deletion .github/workflows/server-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

permissions:
contents: read

defaults:
run:
shell: bash

jobs:
server-tests:
strategy:
Expand Down Expand Up @@ -33,7 +40,7 @@ jobs:

steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v7
- name: Install Rust toolchain
run: |
rustup toolchain install ${{ matrix.toolchain }} --profile minimal
Expand Down
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ repository = "https://github.com/lightningdevkit/vss-server/"
[workspace.dependencies]
api = { package = "vss-api", version = "0.1.0-alpha.0", path = "./api" }
auth-impls = { package = "vss-auth-impls", version = "0.1.0-alpha.0", path = "./auth-impls" }
impls = { package = "vss-impls", version = "0.1.0-alpha.0", path = "./impls" }
impls = { package = "vss-impls", version = "0.1.0-alpha.0", path = "./impls", default-features = false }

[profile.release]
panic = "abort"
Expand Down
10 changes: 5 additions & 5 deletions api/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,13 @@ homepage.workspace = true
repository.workspace = true

[dependencies]
async-trait = "0.1.77"
prost = { version = "0.11.6", default-features = false, features = ["std", "prost-derive"] }
bytes = "1.4.0"
rand = { version = "0.8.5", optional = true}
async-trait = "0.1.13"
prost = { version = "0.11", default-features = false, features = ["std", "prost-derive"] }
bytes = "1"
rand = { version = "0.8", optional = true}

[target.'cfg(genproto)'.build-dependencies]
prost-build = { version = "0.11.3" }
prost-build = { version = "0.11" }

[dev-dependencies]

Expand Down
14 changes: 7 additions & 7 deletions auth-impls/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,15 +15,15 @@ sigs = [ "bitcoin_hashes", "hex-conservative", "secp256k1" ]

[dependencies]
api = { workspace = true }
async-trait = "0.1.77"
base64 = { version = "0.22.1", optional = true, default-features = false, features = ["std"] }
async-trait = "0.1.13"
base64 = { version = "0.22", optional = true, default-features = false, features = ["std"] }
bitcoin_hashes = { version = "1.0", optional = true, default-features = false }
hex-conservative = { version = "1.0", optional = true, default-features = false }
openssl = { version = "0.10.75", optional = true, default-features = false }
openssl = { version = "0.10.39", optional = true, default-features = false }
secp256k1 = { version = "0.31", optional = true, default-features = false, features = [ "global-context" ] }
serde = { version = "1.0.210", optional = true, default-features = false, features = ["derive"] }
serde_json = { version = "1.0.149", optional = true, default-features = false, features = ["std"] }
serde = { version = "1.0.184", optional = true, default-features = false, features = ["derive"] }
serde_json = { version = "1.0.45", optional = true, default-features = false, features = ["std"] }

[dev-dependencies]
jsonwebtoken = { version = "9.3.0", default-features = false, features = ["use_pem"] }
tokio = { version = "1.38.0", default-features = false, features = ["rt-multi-thread", "macros"] }
jsonwebtoken = { version = "9", default-features = false, features = ["use_pem"] }
tokio = { version = "1.30", default-features = false, features = ["rt-multi-thread", "macros"] }
17 changes: 16 additions & 1 deletion docs/getting-started.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@ the threat model and auth overview, see the root [README](../README.md).

- Rust and Cargo, using at least the repository MSRV of 1.85.0.
- PostgreSQL 15 or newer.
- OpenSSL development/runtime libraries for PostgreSQL TLS support.
- **(Optional)** OpenSSL development/runtime libraries for JWT authentication and PostgreSQL TLS
support. These features are enabled by default.

## Quick Start with Docker PostgreSQL

Expand Down Expand Up @@ -99,6 +100,20 @@ or set `VSS_JWT_RSA_PEM`. Clients must send `Authorization: Bearer <jwt>`. Token
include `sub` and `exp` claims, and omit `aud`; `sub` becomes the VSS storage user token. VSS only
verifies tokens, you must run the service that issues them.

### Optional Features

The following optional cargo features are available, all enabled by default:

- `jwt`: Enables JWT authentication
- `sigs`: Enables Signature authentication
- `postgres-native-tls`: Enables connecting to PostgreSQL via TLS

For example, to build without OpenSSL enable only the `sigs` feature:

```bash
cargo build --release --no-default-features --features sigs
```

### Local No-Auth Mode

For local development only, build with the cfg-gated no-op authorizer:
Expand Down
22 changes: 13 additions & 9 deletions impls/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,17 +9,21 @@ license.workspace = true
homepage.workspace = true
repository.workspace = true

[features]
default = ["postgres-native-tls"]
postgres-native-tls = ["dep:native-tls", "dep:postgres-native-tls"]

[dependencies]
async-trait = "0.1.77"
async-trait = "0.1.13"
api = { workspace = true }
chrono = "0.4.38"
tokio-postgres = { version = "0.7.12", features = ["with-chrono-0_4"] }
bytes = "1.4.0"
tokio = { version = "1.38.0", default-features = false, features = ["rt", "macros"] }
native-tls = { version = "0.2.14", default-features = false }
postgres-native-tls = { version = "0.5.2", default-features = false, features = ["runtime"] }
log = { version = "0.4.29", default-features = false }
chrono = "0.4.16"
tokio-postgres = { version = "0.7.15", features = ["with-chrono-0_4"] }
bytes = "1"
tokio = { version = "1.30", default-features = false, features = ["rt", "macros"] }
native-tls = { version = "0.2.4", optional = true, default-features = false }
postgres-native-tls = { version = "0.5", optional = true, default-features = false, features = ["runtime"] }
Comment thread
phlip9 marked this conversation as resolved.
log = { version = "0.4.8", default-features = false }
Comment thread
phlip9 marked this conversation as resolved.

[dev-dependencies]
tokio = { version = "1.38.0", default-features = false, features = ["rt-multi-thread", "macros"] }
tokio = { version = "1.30", default-features = false, features = ["rt-multi-thread", "macros"] }
api = { workspace = true, features = ["_test_utils"] }
11 changes: 6 additions & 5 deletions impls/src/postgres_store.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,6 @@ use api::types::{
use async_trait::async_trait;
use bytes::Bytes;
use chrono::Utc;
use native_tls::TlsConnector;
use postgres_native_tls::MakeTlsConnector;
use std::cmp::min;
use std::io::{self, Error, ErrorKind};
use tokio::sync::Mutex;
Expand All @@ -19,6 +17,7 @@ use tokio_postgres::{Client, NoTls, Socket, Transaction, error};

use log::{debug, info, warn};

#[cfg(feature = "postgres-native-tls")]
pub use native_tls::Certificate;
Comment thread
phlip9 marked this conversation as resolved.

pub(crate) struct VssDbRecord {
Expand Down Expand Up @@ -146,7 +145,8 @@ where
pub type PostgresPlaintextBackend = PostgresBackend<NoTls>;

/// A postgres backend with TLS connections to the database
pub type PostgresTlsBackend = PostgresBackend<MakeTlsConnector>;
#[cfg(feature = "postgres-native-tls")]
pub type PostgresTlsBackend = PostgresBackend<postgres_native_tls::MakeTlsConnector>;

async fn make_db_connection<T>(
postgres_endpoint: &str, db_name: &str, tls: T,
Expand Down Expand Up @@ -228,12 +228,13 @@ impl PostgresPlaintextBackend {
}
}

#[cfg(feature = "postgres-native-tls")]
impl PostgresTlsBackend {
/// Constructs a [`PostgresTlsBackend`] using `postgres_endpoint` for PostgreSQL connection information.
pub async fn new(
postgres_endpoint: &str, default_db: &str, vss_db: &str, crt_pem: Option<&str>,
) -> Result<Self, Error> {
let mut builder = TlsConnector::builder();
let mut builder = native_tls::TlsConnector::builder();
if let Some(pem) = crt_pem {
let crt = Certificate::from_pem(pem.as_bytes()).map_err(|e| {
Error::new(
Expand All @@ -250,7 +251,7 @@ impl PostgresTlsBackend {
postgres_endpoint,
default_db,
vss_db,
MakeTlsConnector::new(connector),
postgres_native_tls::MakeTlsConnector::new(connector),
)
.await
}
Expand Down
21 changes: 11 additions & 10 deletions server/Cargo.toml
View file
Open in desktop

@tankyleo tankyleo Sep 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't update the Cargo.lock file in commit 4238833 so I am worried we may ship a piece of code in the future that no longer works with the declared minimum versions in this commit.

Is it worth adding some automated testing for this case ?

@phlip9 phlip9 Sep 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure, I usually do something like this in CI:

# Remove dev-deps from Cargo.toml to prevent `cargo update` determining minimal
# versions based on dev-deps.
cargo hack --remove-dev-deps --workspace

# Resolve direct dependencies using the min. version in our Cargo.toml's.
RUSTC_BOOTSTRAP=1 cargo update -Z direct-minimal-versions

cargo check --workspace

I'll add this

@phlip9 phlip9 Sep 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

Original file line number Diff line number Diff line change
Expand Up @@ -10,9 +10,10 @@ homepage.workspace = true
repository.workspace = true

[features]
default = [ "jwt", "sigs", "postgres-native-tls" ]
jwt = ["auth-impls/jwt"]
sigs = ["auth-impls/sigs"]
default = [ "jwt", "sigs" ]
postgres-native-tls = ["impls/postgres-native-tls"]

[dependencies]
api = { workspace = true }
Expand All @@ -21,15 +22,15 @@ impls = { workspace = true }

hyper = { version = "1", default-features = false, features = ["server", "http1"] }
http-body-util = { version = "0.1", default-features = false }
hyper-util = { version = "0.1", default-features = false, features = ["server-graceful"] }
tokio = { version = "1.38.0", default-features = false, features = ["time", "signal", "rt-multi-thread", "macros"] }
prost = { version = "0.11.6", default-features = false, features = ["std"] }
bytes = "1.4.0"
serde = { version = "1.0.203", default-features = false, features = ["derive"] }
toml = { version = "0.8.9", default-features = false, features = ["parse"] }
log = { version = "0.4.29", default-features = false, features = ["std"] }
chrono = { version = "0.4", default-features = false, features = ["clock"] }
rand = { version = "0.9.2", default-features = false }
hyper-util = { version = "0.1", default-features = false, features = ["tokio"] }
tokio = { version = "1.30", default-features = false, features = ["time", "signal", "rt-multi-thread", "macros"] }
prost = { version = "0.11", default-features = false, features = ["std"] }
bytes = "1"
serde = { version = "1.0.184", default-features = false, features = ["derive"] }
toml = { version = "0.8", default-features = false, features = ["parse"] }
log = { version = "0.4.8", default-features = false, features = ["std"] }
Comment thread
phlip9 marked this conversation as resolved.
chrono = { version = "0.4.16", default-features = false, features = ["clock"] }
rand = { version = "0.9", default-features = false }

[target.'cfg(noop_authorizer)'.dependencies]
api = { workspace = true, features = ["_test_utils"] }
Expand Down
Loading
Loading