crypto: feature-gate telemetry SDKs (LaunchDarkly, Segment, Sentry)#35946
Draft
jasonhernandez wants to merge 3 commits intomainfrom
Draft
crypto: feature-gate telemetry SDKs (LaunchDarkly, Segment, Sentry)#35946jasonhernandez wants to merge 3 commits intomainfrom
jasonhernandez wants to merge 3 commits intomainfrom
Conversation
Add rustls/aws-lc-rs workspace dependencies alongside existing OpenSSL deps, and introduce a `crypto` feature in mz-ore with a `#[ctor::ctor]` auto-install of the aws-lc-rs CryptoProvider. This is the foundation for the full crypto migration from native-tls/OpenSSL to rustls/aws-lc-rs. Changes: - Add rustls, rustls-pemfile, rustls-pki-types, tokio-rustls, hyper-rustls, rcgen, launchdarkly-server-sdk, launchdarkly-sdk-transport to workspace dependencies - Add fork overrides for azure-sdk and launchdarkly-sdk-transport - Add `crypto` and `fips` features to mz-ore with aws-lc-rs/rustls/ctor deps - Add src/ore/src/crypto.rs with auto-install and fips_crypto_provider() - Add CDLA-Permissive-2.0 to accepted licenses (about.toml + deny.toml) - Remove rustls ban from deny.toml (migration in progress) - Add rustls ecosystem duplicate version skips to deny.toml Part 1 of 7 in the crypto migration from native-tls/OpenSSL to rustls/aws-lc-rs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Make telemetry SDKs optional behind feature flags to enable FIPS builds that exclude non-compliant crypto dependencies: - adapter: telemetry feature gates launchdarkly-server-sdk, mz-segment - environmentd: telemetry feature gates mz-segment, sentry-tracing - balancerd: telemetry feature gates launchdarkly-server-sdk - ore: split sentry from tracing feature (sentry-tracing now optional) - orchestrator-tracing, service: sentry feature for sentry-tracing All features enabled by default — no behavioral change. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
|
Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone. PR title guidelines
Pre-merge checklist
|
…racing in environmentd Ensures sentry deps are only pulled in via explicit telemetry/test features rather than through default feature propagation, enabling proper exclusion in FIPS builds. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
telemetryfeature in adapter/balancerd/environmentdtelemetryfeature in adapter/environmentdsentryfeature)sentryfeature to orchestrator-tracing and service cratessentryfeaturePart 6 of 7 in the crypto migration. Depends on PR1 (#35940).
Test plan
cargo check --workspacepasses (telemetry enabled by default)cargo check -p mz-environmentd --features testpasses🤖 Generated with Claude Code