Rework rpk and no-patches features

boring-sys/Cargo.toml

@@ -71,14 +71,6 @@ rpk = []
 # can be provided by setting `BORING_BSSL{,_FIPS}_SOURCE_PATH`.
 pq-experimental = []
 
-# Disables git patching of the BoringSSL sources for features like `rpk` and `pq-experimental`,
-# but keeps the related Rust API.
-# 
-# Supposed to be used with either pre-compiled BoringSSL (via `BORING_BSSL{,_FIPS}_PATH` env
-# variable) or  with custom BoringSSL sources (via `BORING_BSSL{,_FIPS}_SOURCE_PATH` env variable)
-# already containing required patches.
-no-patches = []
-
 [build-dependencies]
 bindgen = { workspace = true }
 cmake = { workspace = true }

boring-sys/build/config.rs

@@ -15,7 +15,6 @@ pub(crate) struct Config {
 }
 
 pub(crate) struct Features {
-    pub(crate) no_patches: bool,
     pub(crate) fips: bool,
     pub(crate) fips_link_precompiled: bool,
     pub(crate) pq_experimental: bool,
@@ -27,6 +26,7 @@ pub(crate) struct Env {
     pub(crate) include_path: Option<PathBuf>,
     pub(crate) source_path: Option<PathBuf>,
     pub(crate) precompiled_bcm_o: Option<PathBuf>,
+    pub(crate) assume_patched: bool,
     pub(crate) debug: Option<OsString>,
     pub(crate) opt_level: Option<OsString>,
     pub(crate) android_ndk_home: Option<PathBuf>,
@@ -71,15 +71,15 @@ impl Config {
         let is_external_native_lib_source =
             !is_precompiled_native_lib && self.env.source_path.is_none();
 
-        if self.features.no_patches && is_external_native_lib_source {
+        if self.env.assume_patched && is_external_native_lib_source {
             panic!(
-                "`no-patches` feature is supposed to be used with `BORING_BSSL{{,_FIPS}}_PATH`\
-                or `BORING_BSSL{{,_FIPS}}_SOURCE_PATH` env variables"
+                "`BORING_BSSL_{{,_FIPS}}_ASSUME_PATCHED` env variable is supposed to be used with\
+                `BORING_BSSL{{,_FIPS}}_PATH` or `BORING_BSSL{{,_FIPS}}_SOURCE_PATH` env variables"
             );
         }
 
         let features_with_patches_enabled = self.features.rpk || self.features.pq_experimental;
-        let patches_required = features_with_patches_enabled && !self.features.no_patches;
+        let patches_required = features_with_patches_enabled && !self.env.assume_patched;
         let build_from_sources_required = self.features.fips_link_precompiled || patches_required;
 
         if is_precompiled_native_lib && build_from_sources_required {
@@ -90,14 +90,12 @@ impl Config {
 
 impl Features {
     fn from_env() -> Self {
-        let no_patches = env::var_os("CARGO_FEATURE_NO_PATCHES").is_some();
         let fips = env::var_os("CARGO_FEATURE_FIPS").is_some();
         let fips_link_precompiled = env::var_os("CARGO_FEATURE_FIPS_LINK_PRECOMPILED").is_some();
         let pq_experimental = env::var_os("CARGO_FEATURE_PQ_EXPERIMENTAL").is_some();
         let rpk = env::var_os("CARGO_FEATURE_RPK").is_some();
 
         Self {
-            no_patches,
             fips,
             fips_link_precompiled,
             pq_experimental,
@@ -121,14 +119,15 @@ impl Env {
             } else {
                 var(name)
             }
-            .map(PathBuf::from)
         };
 
         Self {
-            path: boringssl_var("BORING_BSSL_PATH"),
-            include_path: boringssl_var("BORING_BSSL_INCLUDE_PATH"),
-            source_path: boringssl_var("BORING_BSSL_SOURCE_PATH"),
-            precompiled_bcm_o: boringssl_var("BORING_BSSL_PRECOMPILED_BCM_O"),
+            path: boringssl_var("BORING_BSSL_PATH").map(PathBuf::from),
+            include_path: boringssl_var("BORING_BSSL_INCLUDE_PATH").map(PathBuf::from),
+            source_path: boringssl_var("BORING_BSSL_SOURCE_PATH").map(PathBuf::from),
+            precompiled_bcm_o: boringssl_var("BORING_BSSL_PRECOMPILED_BCM_O").map(PathBuf::from),
+            assume_patched: boringssl_var("BORING_BSSL_ASSUME_PATCHED")
+                .is_some_and(|v| !v.is_empty()),
             debug: var("DEBUG"),
             opt_level: var("OPT_LEVEL"),
             android_ndk_home: var("ANDROID_NDK_HOME").map(Into::into),

boring-sys/build/main.rs

@@ -496,7 +496,7 @@ fn built_boring_source_path(config: &Config) -> &PathBuf {
     static BUILD_SOURCE_PATH: OnceLock<PathBuf> = OnceLock::new();
 
     BUILD_SOURCE_PATH.get_or_init(|| {
-        if config.features.no_patches {
+        if config.env.assume_patched {
             println!(
                 "cargo:warning=skipping git patches application, provided\
                 native BoringSSL is expected to have the patches included"

boring/Cargo.toml

@@ -25,23 +25,19 @@ fips = ["boring-sys/fips"]
 fips-link-precompiled = ["boring-sys/fips-link-precompiled"]
 
 # Enables Raw public key API (https://datatracker.ietf.org/doc/html/rfc7250)
+# This feature is necessary in order to compile the bindings for the
+# default branch of boringSSL. Alternatively, a version of boringSSL that
+# implements the same feature set can be provided by setting
+# `BORING_BSSL{,_FIPS}_SOURCE_PATH` and `BORING_BSSL{,_FIPS}_ASSUME_PATCHED`.
 rpk = ["boring-sys/rpk"]
 
 # Applies a patch to the boringSSL source code that enables support for PQ key
 # exchange. This feature is necessary in order to compile the bindings for the
 # default branch of boringSSL. Alternatively, a version of boringSSL that
 # implements the same feature set can be provided by setting
-# `BORING_BSSL{,_FIPS}_SOURCE_PATH`.
+# `BORING_BSSL{,_FIPS}_SOURCE_PATH` and `BORING_BSSL{,_FIPS}_ASSUME_PATCHED`.
 pq-experimental = ["boring-sys/pq-experimental"]
 
-# Disables git patching of the BoringSSL sources for features like `rpk` and `pq-experimental`,
-# but keeps the related Rust API.
-#
-# Supposed to be used with either pre-compiled BoringSSL (via `BORING_BSSL{,_FIPS}_PATH` env
-# variable) or with custom BoringSSL sources (via `BORING_BSSL{,_FIPS}_SOURCE_PATH` env variable)
-# already containing required patches.
-no-patches = ["boring-sys/no-patches"]
-
 # Controlling key exchange preferences at compile time
 
 # Choose key exchange preferences at compile time. This prevents the user from

hyper-boring/Cargo.toml

@@ -25,21 +25,9 @@ fips = ["tokio-boring/fips"]
 # Link with precompiled FIPS-validated `bcm.o` module.
 fips-link-precompiled = ["tokio-boring/fips-link-precompiled"]
 
-# Enables Raw public key API (https://datatracker.ietf.org/doc/html/rfc7250)
-rpk = ["tokio-boring/rpk"]
-
 # Enables experimental post-quantum crypto (https://blog.cloudflare.com/post-quantum-for-all/)
 pq-experimental = ["tokio-boring/pq-experimental"]
 
-# Disables git patching of the BoringSSL sources for features like `rpk` and `pq-experimental`,
-# but keeps the related Rust API.
-# 
-# Supposed to be used with either pre-compiled BoringSSL (via `BORING_BSSL{,_FIPS}_PATH` env
-# variable) or with custom BoringSSL sources (via `BORING_BSSL{,_FIPS}_SOURCE_PATH` env variable)
-# already containing required patches.
-no-patches = ["tokio-boring/no-patches"]
-
-
 [dependencies]
 antidote = { workspace = true }
 http = { workspace = true }

tokio-boring/Cargo.toml

@@ -22,20 +22,9 @@ fips = ["boring/fips", "boring-sys/fips"]
 # Link with precompiled FIPS-validated `bcm.o` module.
 fips-link-precompiled = ["boring/fips-link-precompiled", "boring-sys/fips-link-precompiled"]
 
-# Enables Raw public key API (https://datatracker.ietf.org/doc/html/rfc7250)
-rpk = ["boring/rpk"]
-
 # Enables experimental post-quantum crypto (https://blog.cloudflare.com/post-quantum-for-all/)
 pq-experimental = ["boring/pq-experimental"]
 
-# Disables git patching of the BoringSSL sources for features like `rpk` and `pq-experimental`,
-# but keeps the related Rust API.
-# 
-# Supposed to be used with either pre-compiled BoringSSL (via `BORING_BSSL{,_FIPS}_PATH` env
-# variable) or  with custom BoringSSL sources (via `BORING_BSSL{,_FIPS}_SOURCE_PATH` env variable)
-# already containing required patches.
-no-patches = ["boring/no-patches"]
-
 [dependencies]
 boring = { workspace = true }
 boring-sys = { workspace = true }