feat: Modular crypto

.github/workflows/build-modules.yml

@@ -14,31 +14,45 @@
       toolchain:
         required: true
         type: string
+      tls_feature:
+        required: false
+        type: string
+        default: "tls-ring"
 
 jobs:
   build:
-    name: ${{ inputs.arch }}-${{ inputs.platform }}
+    name: ${{ inputs.arch }}-${{ inputs.platform }}-${{ inputs.tls_feature }}
     runs-on: ${{ inputs.os }}
     steps:
       - name: Checkout
         uses: actions/checkout@v6
       - name: Setup Rust
         uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
           toolchain: ${{ inputs.toolchain }}
       - name: Run build crates
         shell: bash
         env:
           RUSTFLAGS: ""
+          TLS_FEATURE: ${{ inputs.tls_feature }}
         run: |
           crates=$(cargo metadata --no-deps --format-version 1 --quiet | jq -r '.packages[] | select(.manifest_path | contains("modules/")) | .name')
           for crate in $crates; do
             echo "Compiling crate: $crate"
-            cargo build -p "$crate"
+            # Use TLS feature for crates that need TLS, with --no-default-features to avoid conflicts
+            if [ "$crate" = "llrt_fetch" ] || [ "$crate" = "llrt_http" ]; then
+              cargo build -p "$crate" --no-default-features --features "http1,http2,webpki-roots,compression-rust,$TLS_FEATURE"
+            else
+              cargo build -p "$crate"
+            fi
           done
       - name: Run build all
+        env:
+          TLS_FEATURE: ${{ inputs.tls_feature }}
         run: |
-          cargo build -p llrt_modules
+          cargo build -p llrt_modules --no-default-features --features "base,$TLS_FEATURE"
       - name: Run tests all
+        env:
+          TLS_FEATURE: ${{ inputs.tls_feature }}
         run: |
-          cargo test -p llrt_modules
+          cargo test -p llrt_modules --no-default-features --features "base,$TLS_FEATURE"

.github/workflows/build.yml

@@ -18,6 +18,14 @@ on:
         required: false
         type: string
         default: "nightly"
+      cargo_features:
+        required: false
+        type: string
+        description: "Cargo features to use (e.g. --no-default-features --features crypto-ring-rust,tls-ring,macro)"
+      limited_crypto:
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   build:
@@ -81,11 +89,17 @@ jobs:
           toolchain: ${{ inputs.toolchain }}
       - name: Run tests
         if: inputs.platform != 'windows'
+        env:
+          CARGO_FEATURES: ${{ inputs.cargo_features }}
+          LLRT_LIMITED_CRYPTO: ${{ inputs.limited_crypto && '1' || '0' }}
         run: |
           make test-ci 2>&1
       - name: Run tests on windows
         if: inputs.platform == 'windows'
         shell: msys2 {0}
+        env:
+          CARGO_FEATURES: ${{ inputs.cargo_features }}
+          LLRT_LIMITED_CRYPTO: ${{ inputs.limited_crypto && '1' || '0' }}
         run: |
           make test-ci 2>&1
       - name: Build Linux binaries

.github/workflows/ci.yml

@@ -29,13 +29,68 @@ jobs:
           for i in {1..5}; do
             echo "console.log(123);" > "bundle/js/test$i.js"
           done
-          cargo clippy --all-targets --all-features -- -D warnings
+          cargo clippy --all-targets --features "lambda,macro,no-sdk,uncompressed,crypto-rust,tls-ring,openssl-vendored" -- -D warnings
+
   build:
     needs:
       - check
     strategy:
       fail-fast: ${{ startsWith(github.ref, 'refs/tags/') }}
       matrix:
+        os:
+          - windows-latest
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+          - macos-latest
+        crypto:
+          - name: default
+            features: ""
+            limited_crypto: false
+          - name: crypto-rust+tls-ring
+            features: "--no-default-features --features crypto-rust,tls-ring,macro"
+            limited_crypto: false
+          - name: crypto-rust+tls-aws-lc
+            features: "--no-default-features --features crypto-rust,tls-aws-lc,macro"
+            limited_crypto: false
+          - name: crypto-ring+tls-ring
+            features: "--no-default-features --features crypto-ring,tls-ring,macro"
+            limited_crypto: true
+          - name: crypto-ring-rust+tls-ring
+            features: "--no-default-features --features crypto-ring-rust,tls-ring,macro"
+            limited_crypto: false
+          - name: crypto-graviola+tls-graviola
+            features: "--no-default-features --features crypto-graviola,tls-graviola,macro"
+            limited_crypto: true
+          - name: crypto-graviola-rust+tls-graviola
+            features: "--no-default-features --features crypto-graviola-rust,tls-graviola,macro"
+            limited_crypto: false
+          - name: crypto-openssl+tls-openssl
+            features: "--no-default-features --features crypto-openssl,tls-openssl,macro"
+            limited_crypto: false
+        exclude:
+          # OpenSSL requires native compilation - exclude from cross-compile targets
+          - os: ubuntu-latest
+            crypto:
+              name: crypto-openssl+tls-openssl
+          - os: ubuntu-24.04-arm
+            crypto:
+              name: crypto-openssl+tls-openssl
+          - os: windows-latest
+            crypto:
+              name: crypto-openssl+tls-openssl
+          # Graviola only supports aarch64
+          - os: ubuntu-latest
+            crypto:
+              name: crypto-graviola+tls-graviola
+          - os: ubuntu-latest
+            crypto:
+              name: crypto-graviola-rust+tls-graviola
+          - os: windows-latest
+            crypto:
+              name: crypto-graviola+tls-graviola
+          - os: windows-latest
+            crypto:
+              name: crypto-graviola-rust+tls-graviola
         include:
           - os: windows-latest
             platform: windows
@@ -63,24 +118,27 @@ jobs:
       platform: ${{ matrix.platform }}
       arch: ${{ matrix.arch }}
       toolchain: ${{ matrix.toolchain }}
+      cargo_features: ${{ matrix.crypto.features }}
+      limited_crypto: ${{ matrix.crypto.limited_crypto }}
+
   modules:
     needs:
       - check
     strategy:
       matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+          - windows-latest
+        tls:
+          - tls-ring
+          - tls-aws-lc
+          - tls-graviola
         include:
           - os: ubuntu-latest
             platform: linux
             arch: x86_64
             toolchain: stable
-          - os: ubuntu-24.04-arm
-            platform: linux
-            arch: aarch64
-            toolchain: stable
-          - os: macos-latest
-            platform: darwin
-            arch: x86_64
-            toolchain: stable
           - os: macos-latest
             platform: darwin
             arch: aarch64
@@ -95,3 +153,4 @@ jobs:
       platform: ${{ matrix.platform }}
       arch: ${{ matrix.arch }}
       toolchain: ${{ matrix.toolchain }}
+      tls_feature: ${{ matrix.tls }}