Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Kit compiles both AWS-LC and ring TLS providers

Aperta
  • Qualcosa non va?
#20 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
28/100
Tipo di issue
Refactoring
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
backend, build-system, performance, security

Direzione di ricerca

Trace Reqwest client construction in Kit and AgentKit, plus the agentkit-mcp RMCP path, and identify where provider installation must occur before each independent client path. Start with cargo tree -e features, then run the locked checks and tests covering A2A, MCP, OAuth, and JWT behavior. Done means one Rustls provider remains, initialization is deterministic and idempotent, all checks pass, and clean timings are recorded on both target platforms.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Kit's dependency graph currently compiles both aws-lc-sys and ring. AWS-LC is selected by Reqwest's rustls feature and jsonwebtoken's aws_lc_rs backend. The A2A client independently selects ring through its default tls-rustls feature. This duplicates cryptographic providers and makes AWS-LC's native build the largest unit in clean checks.

The preferred optimization is a coordinated ring-only configuration:

  • change Kit and AgentKit Reqwest dependencies from rustls to rustls-no-provider;
  • change agentkit-mcp from RMCP's reqwest feature to reqwest-tls-no-provider;
  • change Kit's jsonwebtoken backend from aws_lc_rs to rust_crypto; and
  • explicitly install rustls::crypto::ring::default_provider() before any Reqwest client is constructed.

An isolated full-graph experiment removed AWS-LC and retained A2A HTTPS. A clean cargo check --locked --timings improved from 52.98 seconds to 43.83 seconds on aarch64-apple-darwin with Rust 1.94.0, approximately 17%. User CPU fell from 180.90 to 156.60 seconds and system CPU from 42.35 to 26.58 seconds. The package count increased from 468 to 477 because jsonwebtoken's rust_crypto feature enables RSA, ECDSA, and Ed25519 dependencies together, but these pure-Rust crates were still cheaper to build than AWS-LC and its native toolchain.

A feature-only prototype is not safe to ship. It compiled successfully, but the full Kit test suite failed when Reqwest constructed clients before a process-level provider had been installed:

No rustls crypto provider is configured. When using the `rustls-no-provider`
feature you must install a crypto provider before building a Client.

Provider installation must cover Kit's direct blocking and asynchronous Reqwest clients as well as AgentKit and RMCP construction paths. AgentKit is also usable as a library, so initialization ownership and idempotency must be explicit rather than relying accidentally on A2A's Cargo features.

Alternatives considered

  • Disabling the A2A client's default features removes ring but also disables A2A HTTPS.
  • An AWS-LC-only graph requires A2A to support an AWS-LC or provider-neutral TLS feature and retains the dominant native build cost.
  • Native TLS introduces platform-specific OpenSSL and system-framework behavior.
  • Replacing jsonwebtoken with a narrow RS256 implementation could reduce the RustCrypto graph, but a security-sensitive JWT rewrite is not justified solely as a build optimization without separate design and security review.

Acceptance criteria

  • Only one Rustls crypto provider is present in cargo tree -e features.
  • A2A, MCP, provider HTTP, OAuth token exchange/revocation, and OpenAI RS256 JWT verification continue to work.
  • Provider installation is deterministic, idempotent, and tested before every client-construction path that can run independently.
  • cargo check --locked --all-targets, Clippy with warnings denied, and the complete locked test suite pass.
  • Clean build timings are measured on macOS ARM64 and Linux x64 before landing.
  • Affected AgentKit crates are released before Kit updates its exact pins.
Lingua principale
Rust
Stelle
43
Fork
5
Merge medio
5h 43m
PR unite (30g)
81

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di speakeasy-api/kit

Tutte le issue di speakeasy-api/kit

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.