tink-tests: add boringssl feature

Author: daviddrysdale

.github/workflows/ci.yml

@@ -126,7 +126,7 @@ jobs:
           profile: minimal
           toolchain: stable
       - run: rustc --version
-      - run: cargo doc --no-deps --document-private-items --all-features
+      - run: cargo doc --no-deps --document-private-items --all-features --workspace --exclude tink-tests
 
   udeps:
     runs-on: ubuntu-latest

tests/Cargo.toml

@@ -10,6 +10,17 @@ keywords = ["cryptography", "tink", "testing"]
 categories = ["cryptography"]
 publish = false
 
+[features]
+default = ["kms"]
+# The `tink-awskms` crates indirectly depend on OpenSSL, which cannot be linked at the
+# same time as BoringSSL.  Switch to BoringSSL mode with
+#   --no-default-features --features boringssl
+#
+# Note that this means that the features of this crate are *not* additive; turning on
+# --all-features results in link failures.
+boringssl = ["tink-daead/boringssl"]
+kms = ["tink-awskms", "tink-gcpkms"]
+
 [dependencies]
 base64 = "^0.13"
 ed25519-dalek = "^1.0.1"
@@ -21,9 +32,11 @@ rand = "^0.7"
 regex = "^1.5.4"
 serde = { version = "^1.0.126", features = ["derive"] }
 serde_json = "^1.0.64"
-tink-core = { version = "^0.2", features = ["insecure", "json"] }
 tink-aead = "^0.2"
+tink-awskms = { version = "^0.2", optional = true }
+tink-core = { version = "^0.2", features = ["insecure", "json"] }
 tink-daead = "^0.2"
+tink-gcpkms = { version = "^0.2", optional = true }
 tink-mac = "^0.2"
 tink-proto = "^0.2"
 
@@ -34,10 +47,11 @@ lazy_static = "^1.4"
 maplit = "^1.0.2"
 tempfile = "^3.2"
 tink-aead = "^0.2"
-tink-awskms = "^0.2"
 tink-daead = "^0.2"
-tink-gcpkms = "^0.2"
 tink-mac = "^0.2"
 tink-prf = "^0.2"
 tink-signature = "^0.2"
 tink-streaming-aead = "^0.2"
+
+[package.metadata.cargo-udeps.ignore]
+normal = ["tink-awskms", "tink-gcpkms"]

tests/src/lib.rs

@@ -18,6 +18,9 @@
 
 #![deny(broken_intra_doc_links)]
 
+#[cfg(all(feature = "boringssl", feature = "kms"))]
+compile_error!("features \"boringssl\" and \"kms\" cannot co-exist due to linker clashes between BoringSSL and OpenSSL");
+
 use generic_array::typenum::Unsigned;
 use p256::elliptic_curve;
 use serde::{Deserialize, Serialize};

tests/tests/aead/mod.rs

@@ -22,6 +22,7 @@ mod aes_gcm_siv_key_manager_test;
 mod chacha20poly1305_key_manager_test;
 mod integration_test;
 mod kms_envelope_aead_test;
+#[cfg(feature = "kms")]
 mod kms_envelope_key_manager_test;
 mod xchacha20poly1305_key_manager_test;
 

tests/tests/awskms_test.rs

@@ -14,4 +14,5 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
+#[cfg(feature = "kms")]
 mod awskms;

tests/tests/gcpkms_test.rs

@@ -14,4 +14,5 @@
 //
 ////////////////////////////////////////////////////////////////////////////////
 
+#[cfg(feature = "kms")]
 mod gcpkms;