[GH-ISSUE #1940] `dns-over-quic` pulls in `rustls-native-certs` by default #825

New issue

Closed

opened 2026-03-16 00:26:55 +03:00 by kerem · 3 comments

kerem commented

2026-03-16 00:26:55 +03:00

Owner

Originally created by @daxpedda on GitHub (May 20, 2023).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1940

I'm not entirely sure, but it seems to me that dns-over-quic uses webpki by default:
github.com/bluejekyll/trust-dns@41b6e33c51/crates/proto/src/quic/quic_client_stream.rs (L275-L282)

But because the quinn dependency is used with default-features, it pulls in rustls-native-certs.

Would a PR be acceptable that changes quinn to use default-features = false?

Originally created by @daxpedda on GitHub (May 20, 2023). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/1940 I'm not entirely sure, but it seems to me that `dns-over-quic` uses `webpki` by default: https://github.com/bluejekyll/trust-dns/blob/41b6e33c51e99db50d873d165d52d70e38f33a34/crates/proto/src/quic/quic_client_stream.rs#L275-L282 But because the `quinn` dependency is used with `default-features`, it pulls in `rustls-native-certs`. Would a PR be acceptable that changes `quinn` to use `default-features = false`?

kerem closed this issue

2026-03-16 00:27:01 +03:00

kerem commented

2026-03-16 00:27:07 +03:00

Author

Owner

@djc commented on GitHub (May 21, 2023):

Yeah... although maybe it makes more sense to switch trust-dns to use native-certs everywhere by default?

@djc commented on GitHub (May 21, 2023): Yeah... although maybe it makes more sense to switch trust-dns to use native-certs everywhere by default?

kerem commented

2026-03-16 00:27:12 +03:00

Author

Owner

@daxpedda commented on GitHub (May 21, 2023):

Yeah... although maybe it makes more sense to switch trust-dns to use native-certs everywhere by default?

If you like I could tackle that as well, but I would like to keep the ability to drop the rustls-native-certs dependency when not needed.

So one suggestion would be to just introduce a bunch of new features:

dns-over-rustls-native-certs
dns-over-rustls-webpki
dns-over-https-rustls-native-certs
dns-over-https-rustls-webpki
dns-over-quic-native-certs
dns-over-quic-webpki

Or alternatively having to select between the two separately, but having no default at all:

Leave the old ones:
- dns-over-rustls
- dns-over-https-rustls
- dns-over-quic
Introduce two new features:
- native-certs
- webpki

@daxpedda commented on GitHub (May 21, 2023): > Yeah... although maybe it makes more sense to switch trust-dns to use native-certs everywhere by default? If you like I could tackle that as well, but I would like to keep the ability to drop the `rustls-native-certs` dependency when not needed. So one suggestion would be to just introduce a bunch of new features: - `dns-over-rustls-native-certs` - `dns-over-rustls-webpki` - `dns-over-https-rustls-native-certs` - `dns-over-https-rustls-webpki` - `dns-over-quic-native-certs` - `dns-over-quic-webpki` Or alternatively having to select between the two separately, but having no default at all: - Leave the old ones: - `dns-over-rustls` - `dns-over-https-rustls` - `dns-over-quic` - Introduce two new features: - `native-certs` - `webpki`

kerem commented

2026-03-16 00:27:17 +03:00

Author

Owner

@djc commented on GitHub (May 22, 2023):

It seems like it would be better to have orthogonal feature flags rather than a combinatorial explosion of them. Presumably downstream crates would want to pick either rustls-native-certs (or maybe soon rustls-platform-verifier) or webpki-roots, but generally not mix and match. If you'd be interested in improving on that, would be great!

@djc commented on GitHub (May 22, 2023): It seems like it would be better to have orthogonal feature flags rather than a combinatorial explosion of them. Presumably downstream crates would want to pick either rustls-native-certs (or maybe soon rustls-platform-verifier) or webpki-roots, but generally not mix and match. If you'd be interested in improving on that, would be great!

kerem referenced this issue

2026-03-16 02:21:40 +03:00

[PR #825] [MERGED] Bump log from 0.4.6 to 0.4.7 #1717