Skip to content

Update MIR Rust documentation with TLS requirements #353

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rmcnew wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Update MIR Rust documentation with TLS requirements #353

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e805e30
Update MIR Rust documentation with TLS requirements
rmcnew Dec 9, 2025
69a4760
Remove bold formatting from Rust TLS requirements
rmcnew Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions docs/MIR/mir-rust.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ rather than rely on the individual package versions.
See [`cpaelzer/ubuntu-mir#3`](https://github.com/cpaelzer/ubuntu-mir/pull/3) for
some background on the issue.

Additionally, Rust code that needs Transport Layer Security (TLS) [must use OpenSSL](#rust-tls-requirements)
to ensure that system cryptography policies are followed. This requirement will
change as the Rust TLS ecosystem matures.

## Vendoring Rust dependencies

It's a simple matter of running `cargo vendor debian/rust-vendor/` where you're
Expand Down Expand Up @@ -273,3 +277,22 @@ git add debian/control
git commit -m "Update XS-Vendored-Sources-Rust field"
git reset --hard # restore Cargo.toml
```

## Rust TLS Requirements

[`rustls`](https://github.com/rustls/rustls) is a popular Rust TLS implementation,
but currently it [does not support system-wide policies](https://github.com/rustls/rustls/issues/2402).
Ubuntu [announced a partnership with rustls](https://discourse.ubuntu.com/t/addressing-linuxs-missing-pki-infrastructure/73314) to build a centralized PKI system written in Rust.

Until the needed cryptographic infrastructure and system-wide policies are operational,
Rust code in `main` that uses TLS must use OpenSSL with the system-wide OpenSSL configuration.

This may require significant changes to some Rust code, but it is required for now to
ensure that system-wide cryptographic policies are followed as described by the MIR
reporter's rule ["Check for security relevant binaries, services and behavior"](https://documentation.ubuntu.com/project/MIR/mir-reporters-template/).

### OpenSSL crate configuration
The [`openssl` crate](https://docs.rs/openssl/latest/openssl/) provides a safe Rust
interface for the system OpenSSL package. The `vendored` Cargo feature MUST NOT
be used to ensure that the system OpenSSL package and corresponding policy are used.