fix: replace unapproved crypto dependencies with platform-native TLS by mohamedmansour · Pull Request #596 · microsoft/webui

Mohamed Mansour (mohamedmansour) · 2026-10-13T17:25:40Z

Why

A crypto compliance scan flagged ring 0.17.14 and sha1 0.11.0 across most of the workspace manifests (webui, webui-cli, webui-node, webui-press, webui-dev-server, and the commerce, demo, and streaming-bench examples). Microsoft's SDL requirement is that Rust code use approved cryptographic libraries per platform: CNG/SChannel on Windows, OpenSSL on Linux, and Secure Transport on macOS. native-tls wraps those platform implementations, so this PR removes the flagged dependency paths and routes TLS through approved platform libraries.

Approach

Neither flagged crate was a direct dependency, so the fix cuts the transitive paths that introduced them:

sha1 came from Actix Web's default features. The WebSocket handshake needs SHA-1 and was enabled even though the workspace does not use Actix WebSockets. Actix Web now disables default features and enables only the required features explicitly.
ring came from the previous HTTP client TLS graph. awc was replaced with reqwest configured with default-features = false, native-tls, and streaming support. The CLI and demo servers reuse fallibly constructed connection-pooled clients, do not follow upstream redirects, and preserve bounded response buffering and proxy semantics.
The commerce example moved off Rustls and rcgen. Actix Web has no built-in native-TLS HttpServer helper, so the HTTPS path composes Actix TLS's native-TLS acceptor with HttpService directly.
Linux packaging now installs OpenSSL development libraries for both native x86_64 and cross-compiled ARM64 targets. The ARM64 path verifies that openssl.pc resolves from the target pkg-config directory.

Verified with cargo tree across all targets that sha1, ring, rustls, aws-lc-rs, aws-lc-sys, and rcgen no longer appear in the dependency graph or lockfile. Full cargo xtask check passes.

Things worth a careful look

Commerce certificate migration

The commerce example previously generated a self-signed certificate at startup through rcgen. Direct HTTPS now requires --tls-cert and --tls-key pointing to a certificate and PKCS#8 private key PEM. The README and E2E setup instructions have been updated.

Commerce HTTPS protocol behavior

HTTP/2 is required for the commerce example's direct HTTPS path. On Windows and Linux, the platform-native TLS acceptor advertises both h2 and http/1.1 through ALPN. Connections negotiating h2 are dispatched to Actix as HTTP/2, while HTTP/1.1 remains the compatibility fallback. A Windows/Linux integration test loads a PKCS#8 identity, negotiates h2, and sends a request through the composed TLS and HTTP service.

Apple's native TLS backend does not support the server-side ALPN behavior required by this path, so direct HTTPS is rejected before certificate inputs are read or parsed. On macOS, run the commerce server with --no-tls behind an HTTP/2-capable TLS-terminating proxy or ingress.

Remaining advisory exceptions

RUSTSEC-2026-0258: actix-http still pins h2 0.3, while the fix is available only in h2 0.4. Actix's HTTP/2 feature is intentional and must remain enabled because the commerce example requires HTTP/2. The appropriate follow-up is upgrading the Actix HTTP/2 dependency when Actix supports a fixed compatible h2 release. HTTP/3 and QUIC remain outside this PR.
RUSTSEC-2025-0141: Syntect's bundled syntax and theme dumps still use bincode 1.x. This is an unmaintained dependency rather than a known vulnerability. There is no safe dependency override because Bincode 2 changes its API and serialized format; resolving it requires an upstream Syntect migration or replacing the highlighter.

Obsolete rand and rand_core skips that only existed for awc were removed.

Remove the ring, sha1, Rustls, AWS-LC, and rcgen dependency paths flagged by the crypto compliance scanner across the workspace. Replace the awc HTTP client with reqwest configured for native-tls, which wraps the approved platform libraries (SChannel on Windows, OpenSSL on Linux, Secure Transport on macOS). Disable Actix Web default features so the WebSocket upgrade path no longer pulls in sha1, and move the commerce example from Rustls plus generated self-signed certificates to caller-supplied certificate and PKCS#8 key PEM files served through the native-tls acceptor. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

Install the target libssl development package in the existing Linux ARM64 cross-build setup and verify pkg-config resolves openssl from the target directory. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: 558d435...136c571 | Coverage: complete 15-file three-dot diff; CI: Lint, Test, Docs, WASM, Build (Linux): success; Build (Windows), Build (macOS), E2E (Ubuntu): in progress
Challenge: 1 confirmed, 0 revised | Compatibility: see inline
Action: COMMENT | One low-severity transport compatibility finding is noted inline.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: 558d435...6dafb96 | Coverage: complete 15-file three-dot diff; CI: PR Checks failure (Build (macOS): unrelated desktop IPC test failure).
Challenge: 1 confirmed, 0 revised | Compatibility: HTTPS graceful shutdown changes from 5s to the 30s default.
Action: COMMENT | One low-severity shutdown-timeout regression is noted inline.

Copilot

🟡 Changes recommended

The Reqwest migration changes redirect semantics and removes response-size limits, causing correctness and memory regressions.

11 open findings

Restore bounded response-body buffering · New
Reuse a fallible no-redirect client for proxying · New
Disable redirect following for proxied responses · New
Install libssl-dev for x86_64 native builds · New
Reuse a fallible Reqwest client across state fetches · New
Return Apple TLS rejection before parsing inputs · New
Update E2E setup instructions for disabled TLS · New
Remove unused direct tokio-native-tls dependencies · New
Report both HTTP/2 and HTTP/1.1 support · New
Add end-to-end TLS acceptor integration coverage · New
Align HTTPS protocol claims with HTTP/2 support · New

What changed in this PR

Replaces Rustls/AWC crypto paths with platform-native TLS and removes flagged transitive cryptography dependencies.

Changes:

Disables unused Actix WebSocket features and migrates HTTP clients to Reqwest/native-tls.
Adds native-TLS HTTPS support and certificate requirements to the commerce example.
Updates dependencies, lockfile, Linux cross-build setup, tests, and documentation.

File	Description
`Cargo.toml`	Configures Actix features and native-TLS dependencies.
`Cargo.lock`	Updates the resolved dependency graph.
`deny.toml`	Removes obsolete AWC-related exceptions.
`scripts/setup-linux-desktop-target.sh`	Adds ARM64 OpenSSL prerequisites.
`crates/webui/Cargo.toml`	Replaces the benchmark HTTP client dependency.
`crates/webui/examples/streaming_e2e_ttfb_bench.rs`	Migrates benchmark streaming to Reqwest.
`crates/webui-cli/Cargo.toml`	Replaces AWC with Reqwest.
`crates/webui-cli/src/commands/serve.rs`	Migrates API fetching and proxying.
`crates/webui-cli/src/commands/serve/streaming_api.rs`	Generalizes stream content-type detection.
`examples/demo/server/Cargo.toml`	Adds Reqwest streaming dependencies.
`examples/demo/server/src/main.rs`	Creates a shared proxy client.
`examples/demo/server/src/proxy.rs`	Migrates the streaming reverse proxy.
`examples/app/commerce/server/Cargo.toml`	Adds native-TLS server dependencies.
`examples/app/commerce/server/src/main.rs`	Implements platform-native HTTPS service composition.
`examples/app/commerce/README.md`	Documents certificate and platform requirements.

🧠 Review effort: Balanced

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

Reuse fallibly constructed Reqwest clients with redirect following disabled, restore bounded response buffering, and preserve reverse-proxy semantics. Complete native-TLS packaging and commerce HTTP/2 coverage across supported platforms while keeping documentation and E2E instructions aligned. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: 558d435...d04f3a8 | Coverage: complete 16-file three-dot diff; CI: PR Checks success, CodeQL failure (new alert in test-only TLS client).
Challenge: 0 confirmed, 1 revised | Compatibility: AWC's five-second request timeout removed.
Action: COMMENT | One timeout regression is noted inline.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

Apply the prior five-second response deadline to buffered state and proxy requests while limiting streaming acquisition only until response headers arrive. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: 558d435...70af10a | Coverage: complete 16-file three-dot diff; CI: PR Checks, Test, Lint, Build (Linux/Windows/macOS), CodeQL passed; Desktop npm native (x86_64-apple-darwin) in progress
Challenge: 1 confirmed, 0 revised | Compatibility: startup now requires API-client TLS/resolver initialization
Action: COMMENT | One medium static-serving startup regression; avoid initializing an unused client.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: 558d435...11cfd02 | Coverage: complete; CI: PR Checks, CodeQL, Test, Lint, Docs, E2E (Ubuntu), Build (Linux/macOS/Windows): success
Challenge: 1 confirmed, 0 revised | Compatibility: Windows direct HTTPS with PEM certificate chains
Action: COMMENT | The high-severity Windows certificate-chain regression needs a fix before merge.

mddinbox

Target: 558d435...11cfd02 | Coverage: complete 16-file three-dot diff; CI: PR Checks, Lint, Test, Build (Linux/macOS/Windows), E2E (Ubuntu), CodeQL — success
Challenge: 1 confirmed, 0 revised | Compatibility: forwarded client identity is trusted by commerce rate limiting
Action: COMMENT | A caller can spoof the commerce app's per-IP rate-limit key through the demo proxy.

Resolve dependency conflicts while retaining main's 3.0.2 release updates and the branch's crypto-compliant HTTP/2 configuration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: eca3d26...a0a0cf9 | Coverage: complete 17-file three-dot diff; CI: PR Checks, Lint, Test, Build (Linux/macOS/Windows), CodeQL — success; ADO release pipeline not checked
Challenge: 1 confirmed, 0 revised | Compatibility: blocks ADO Linux ARM64 portable release artifacts
Action: COMMENT | A high-severity release-build blocker needs a fix before merge.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: eca3d26...063d2ca | Coverage: complete 17-file pinned diff; CI: license/cla success, CodeQL neutral; Test, Lint, Build (Linux/macOS/Windows), Analyze (Rust) in progress
Challenge: 1 confirmed, 0 revised | Compatibility: direct HTTPS removed on Apple
Action: COMMENT | See inline finding on macOS direct HTTPS startup failure.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox

Target: eca3d26...c4c37fe | Coverage: complete 17-file three-dot diff; CI: PR Checks, Lint, Test, Docs, WASM, FFI, E2E (Ubuntu), Build (Linux/macOS/Windows), Python wheels, CodeQL: success
Challenge: 1 confirmed, 0 revised | Compatibility: Linux CLI packages gain a shared OpenSSL runtime prerequisite
Action: COMMENT | One medium-severity Linux packaging compatibility finding is inline.

mddinbox · 2026-10-21T06:13:59Z

 serde_json = { workspace = true }
 actix-web = { workspace = true }
-awc = { workspace = true }
+reqwest = { workspace = true }


Medium — Linux CLI packages gain an undocumented OpenSSL runtime dependency. The base AWC/rustls client did not require OpenSSL; this Reqwest native-tls dependency resolves through openssl-sys on Linux. The Linux publish path stages the CLI binary without its OpenSSL shared libraries, so a glibc-compatible host without the matching OpenSSL 3 runtime cannot launch webui at all, even for commands that never make a request. Please make this runtime requirement explicit and ensure the Linux install/package path provides or validates the compatible library.

Mohamed Mansour (mohamedmansour) requested review from Akrosh Gandhi (akroshg), mcritzjam and mddinbox October 13, 2026 17:26

mddinbox reviewed Oct 13, 2026

View reviewed changes

Comment thread examples/app/commerce/server/src/main.rs Outdated

fix: preserve HTTP/2 with native TLS

6dafb96

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox reviewed Oct 13, 2026

View reviewed changes

Comment thread examples/app/commerce/server/src/main.rs Outdated

mddinbox requested a balanced review from Copilot October 13, 2026 20:20

Copilot started reviewing on behalf of mddinbox October 13, 2026 20:27

View session

Copilot AI reviewed Oct 13, 2026

View reviewed changes

Mohamed Mansour (mohamedmansour) and others added 2 commits October 13, 2026 13:41

fix: preserve HTTPS shutdown timeout

1db6005

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

github-advanced-security Bot found potential problems Oct 13, 2026

View reviewed changes

Comment thread examples/app/commerce/server/src/main.rs Fixed

mddinbox reviewed Oct 13, 2026

View reviewed changes

Comment thread crates/webui-cli/src/commands/serve.rs

Mohamed Mansour (mohamedmansour) added 2 commits October 13, 2026 15:24

fix: validate commerce test certificate

dbe847c

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox reviewed Oct 13, 2026

View reviewed changes

Comment thread crates/webui-cli/src/commands/serve.rs Outdated

fix: initialize serve API client conditionally

11cfd02

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox reviewed Oct 14, 2026

View reviewed changes

Comment thread examples/app/commerce/server/src/main.rs

Mohamed Mansour (mohamedmansour) marked this pull request as draft October 14, 2026 05:53

mddinbox reviewed Oct 14, 2026

View reviewed changes

Comment thread examples/demo/server/src/proxy.rs

mddinbox reviewed Oct 16, 2026

View reviewed changes

Comment thread Cargo.toml

Provision OpenSSL for Linux ARM64 assets

063d2ca

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

mddinbox reviewed Oct 20, 2026

View reviewed changes

Comment thread examples/app/commerce/server/src/main.rs

Mohamed Mansour (mohamedmansour) and others added 2 commits October 20, 2026 11:17

Strip untrusted forwarding headers in demo proxy

bf89010

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

Clarify Commerce direct HTTPS platform support

c4c37fe

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a09d1a39-a596-4cdf-b413-b823dc3b7104

Mohamed Mansour (mohamedmansour) marked this pull request as ready for review October 20, 2026 19:24

mddinbox reviewed Oct 21, 2026

View reviewed changes

Conversation

Mohamed Mansour (mohamedmansour) commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

Approach

Things worth a careful look

Commerce certificate migration

Commerce HTTPS protocol behavior

Remaining advisory exceptions

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mddinbox left a comment

Choose a reason for hiding this comment

Uh oh!

mddinbox Oct 21, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mohamed Mansour (mohamedmansour) commented Oct 13, 2026 •

edited

Loading