Reduce default workspace dependency graph

Cargo.toml

@@ -65,7 +65,7 @@ async-trait = "0.1.87"
 async_zip = { version = "0.0.17", features = ["tokio", "tokio-fs", "deflate"] }
 auditable-serde = "0.8.0"
 aws-config = "1.5.10"
-aws-sdk-s3 = "1.65.0"
+aws-sdk-s3 = { version = "1.65.0", default-features = false, features = ["default-https-client", "rt-tokio", "rustls"] }
 backtrace-on-stack-overflow = "0.3.0"
 axum = { version = "0.8", features = ["multipart"] }
 axum-jrpc = "0.9.0"
@@ -167,7 +167,6 @@ mimalloc = "0.1.52"
 minijinja = "2.7.0"
 
 nanoid = "0.4.0"
-native-tls = "=0.2.13"
 nondestructive = "0.0.26"
 nonempty-collections = "1.2.1"
 nonzero_ext = "0.3.0"
@@ -176,8 +175,6 @@ num-traits = "0.2.19"
 once_cell = "1.21.0"
 openapiv3 = "=2.0.0"
 openidconnect = "4.0.1"
-openssl = "=0.10.73"
-openssl-sys = "=0.9.109"
 opentelemetry = "0.30.0"
 opentelemetry-otlp = { version = "0.30.0" }
 opentelemetry-prometheus-text-exporter = "=0.2.0"
@@ -237,7 +234,7 @@ shell-words = "1.1.0"
 shlex = "1.3.0"
 similar = "2.7.0"
 spdx = "0.10.8"
-sqlx = { version = "0.8", features = ["runtime-tokio", "tls-rustls", "sqlite", "postgres", "mysql", "uuid", "migrate", "chrono", "json", "bigdecimal", "mac_address", "bit-vec", "ipnetwork", ] }
+sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls", "sqlite", "postgres", "mysql", "uuid", "migrate", "derive", "chrono", "json", "bigdecimal", "mac_address", "bit-vec", "ipnetwork", ] }
 sqlx-core = { version = "0.8" }
 strip-ansi-escapes = "0.2.0"
 strum = "0.27.1"
@@ -260,7 +257,7 @@ tokio-metrics = { version = "0.5.0", features = ["metrics-rs-integration"] }
 tokio-postgres = "0.7.13"
 tokio-rustls = { version = "0.26.2" }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tokio-tungstenite = { version = "0.25.0", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.27.0", features = ["rustls-tls-webpki-roots"] }
 tokio-util = "0.7.13"
 toml = "0.9.5"
 toml_edit = "0.23.3"
@@ -327,6 +324,11 @@ wasmtime-wizer = { git = "https://github.com/golemcloud/wasmtime.git", branch =
 
 [profile.dev]
 panic = "abort"
+debug = "line-tables-only"
+
+[profile.full-debug]
+inherits = "dev"
+debug = "full"
 
 # Build the Cranelift/regalloc codegen crates (the ones Wasmtime runs to compile
 # wasm -> native) at opt-level 3 even in debug builds. A debug-built Cranelift is

Makefile.toml

@@ -261,6 +261,12 @@ private = true
 condition = { env_not_set = ["CI"] }
 run_task = [{ name = ["build-registry-service"] }]
 
+[tasks.build-shard-manager-kubernetes]
+private = true
+dependencies = ["build-bins-non-ci"]
+command = "cargo"
+args = ["build", "-p", "golem-shard-manager", "--features", "kubernetes"]
+
 [tasks.build-release-full]
 dependencies = [
     "wit",
@@ -273,6 +279,8 @@ args = [
     "--release",
     "--exclude",
     "integration-tests",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release]
@@ -302,6 +310,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release-override-linux-amd64]
@@ -318,6 +328,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release-override-linux-arm64]
@@ -335,6 +347,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-sdk-ts]
@@ -1124,7 +1138,7 @@ script = { file = "./local-run/start.sh" }
 
 [tasks.generate-configs]
 description = "Generates default and example config files"
-dependencies = ["build-bins-non-ci"]
+dependencies = ["build-shard-manager-kubernetes"]
 
 script = '''
 export RUST_BACKTRACE=1

cli/golem-cli/Cargo.toml

@@ -67,7 +67,6 @@ itertools = { workspace = true }
 jsonschema = { workspace = true }
 lenient_bool = { workspace = true }
 minijinja = { workspace = true }
-native-tls = { workspace = true }
 phf = { workspace = true }
 portable-pty = { workspace = true }
 prettyplease = { workspace = true }
@@ -77,6 +76,7 @@ regex = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }
+rustls = { workspace = true }
 serde = { workspace = true }
 serde_derive = { workspace = true }
 serde_json = { workspace = true }
@@ -120,10 +120,6 @@ wasmtime-wasi = { workspace = true }
 wit-component = { workspace = true }
 wit-parser = { workspace = true }
 
-[target.'cfg(not(any(target_os = "windows", target_vendor = "apple")))'.dependencies]
-openssl = { workspace = true }
-openssl-sys = { workspace = true }
-
 [target.'cfg(windows)'.dependencies]
 windows-sys = { workspace = true }
 

cli/golem-cli/src/command_handler/agent/stream.rs

@@ -24,7 +24,10 @@ use futures_util::{SinkExt, StreamExt, TryStreamExt, future, pin_mut};
 use golem_common::model::auth::TokenSecret;
 use golem_common::model::component::ComponentId;
 use golem_common::model::{AgentEvent, AgentId, IdempotencyKey, LogLevel, Timestamp};
-use native_tls::TlsConnector;
+use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
+use rustls::crypto::WebPkiSupportedAlgorithms;
+use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
+use rustls::{DigitallySignedStruct, SignatureScheme};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
@@ -41,6 +44,46 @@ use tracing::{debug, error, info, trace};
 use url::Url;
 use uuid::Uuid;
 
+#[derive(Debug)]
+struct InsecureServerCertVerifier {
+    signature_algorithms: WebPkiSupportedAlgorithms,
+}
+
+impl ServerCertVerifier for InsecureServerCertVerifier {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: UnixTime,
+    ) -> Result<ServerCertVerified, rustls::Error> {
+        Ok(ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> Result<HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls12_signature(message, cert, dss, &self.signature_algorithms)
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> Result<HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls13_signature(message, cert, dss, &self.signature_algorithms)
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        self.signature_algorithms.supported_schemes()
+    }
+}
+
 pub struct AgentConnection {
     request: Request,
     connector: Option<Connector>,
@@ -184,12 +227,16 @@ impl AgentConnection {
         }
 
         let connector = if allow_insecure {
-            Some(Connector::NativeTls(
-                TlsConnector::builder()
-                    .danger_accept_invalid_certs(true)
-                    .danger_accept_invalid_hostnames(true)
-                    .build()?,
-            ))
+            let provider = Arc::new(rustls::crypto::ring::default_provider());
+            let verifier = InsecureServerCertVerifier {
+                signature_algorithms: provider.signature_verification_algorithms,
+            };
+            let tls_config = rustls::ClientConfig::builder_with_provider(provider)
+                .with_safe_default_protocol_versions()?
+                .dangerous()
+                .with_custom_certificate_verifier(Arc::new(verifier))
+                .with_no_client_auth();
+            Some(Connector::Rustls(Arc::new(tls_config)))
         } else {
             None
         };
@@ -208,9 +255,7 @@ impl AgentConnection {
             interval.tick().await;
 
             let ping_result = write
-                .send(Message::Ping(
-                    Bytes::from(cnt.to_ne_bytes().to_vec()).into(),
-                ))
+                .send(Message::Ping(Bytes::from(cnt.to_ne_bytes().to_vec())))
                 .await
                 .context("Failed to send ping");
 
@@ -414,8 +459,7 @@ impl AgentConnection {
                 }
             }
             Message::Binary(data) => {
-                let parsed: serde_json::Result<AgentEvent> =
-                    serde_json::from_slice(data.as_slice());
+                let parsed: serde_json::Result<AgentEvent> = serde_json::from_slice(data.as_ref());
                 match parsed {
                     Ok(parsed) => Some(parsed),
                     Err(err) => {

golem-debugging-service/tests/debug_mode/debug_worker_executor.rs

@@ -12,7 +12,6 @@ use tokio::net::TcpStream;
 use tokio::task::JoinSet;
 use tokio_tungstenite::tungstenite::Message;
 use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tokio_tungstenite::tungstenite::protocol::frame::Utf8Payload;
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};
 
 pub type DebugServiceClient = WebSocketStream<MaybeTlsStream<TcpStream>>;
@@ -55,9 +54,7 @@ impl DebugWorkerExecutorClient {
         let id = Id::Str(uuid.to_string());
 
         self.write_msg
-            .send(Message::Text(Utf8Payload::from(serde_json::to_string(
-                &jrpc_request,
-            )?)))
+            .send(Message::Text(serde_json::to_string(&jrpc_request)?.into()))
             .await?;
 
         Ok(id)

golem-registry-service/Cargo.toml

@@ -27,8 +27,6 @@ anyhow = { workspace = true }
 applying = { workspace = true }
 async-trait = { workspace = true }
 async_zip = { workspace = true, features = ["tokio", "tokio-fs", "deflate"] }
-aws-config = { workspace = true }
-aws-sdk-s3 = { workspace = true }
 bigdecimal = { workspace = true }
 blake3 = { workspace = true }
 bytes = { workspace = true }

golem-shard-manager/Cargo.toml

@@ -65,5 +65,5 @@ uuid = { workspace = true }
 tempfile = { workspace = true }
 
 [features]
-default = ["kubernetes"]
+default = []
 kubernetes = ["dep:kube", "dep:k8s-openapi"]

golem-shard-manager/src/config.rs

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#[cfg(feature = "kubernetes")]
 use crate::config::HealthCheckMode::K8s;
 use golem_common::SafeDisplay;
 use golem_common::config::{
@@ -121,19 +122,27 @@ impl Default for ShardManagerConfig {
 
 impl HasConfigExamples<ShardManagerConfig> for ShardManagerConfig {
     fn examples() -> Vec<ConfigExample<ShardManagerConfig>> {
-        vec![(
-            "with k8s healthcheck",
-            Self {
-                health_check: HealthCheckConfig {
-                    delay: Duration::from_secs(1),
-                    mode: K8s(HealthCheckK8sConfig {
-                        namespace: "namespace".to_string(),
-                    }),
-                    silent: false,
+        #[cfg(feature = "kubernetes")]
+        {
+            vec![(
+                "with k8s healthcheck",
+                Self {
+                    health_check: HealthCheckConfig {
+                        delay: Duration::from_secs(1),
+                        mode: K8s(HealthCheckK8sConfig {
+                            namespace: "namespace".to_string(),
+                        }),
+                        silent: false,
+                    },
+                    ..Self::default()
                 },
-                ..Self::default()
-            },
-        )]
+            )]
+        }
+
+        #[cfg(not(feature = "kubernetes"))]
+        {
+            Vec::new()
+        }
     }
 }
 

golem-shard-manager/src/lib.rs

@@ -20,7 +20,9 @@ mod registry_event_subscriber;
 pub(crate) mod sharding;
 
 use self::grpc::ShardManagerServiceImpl;
-use crate::config::{HealthCheckK8sConfig, HealthCheckMode};
+#[cfg(feature = "kubernetes")]
+use crate::config::HealthCheckK8sConfig;
+use crate::config::HealthCheckMode;
 use crate::quota::{DbQuotaRepo, GrpcResourceDefinitionFetcher, QuotaService};
 use crate::registry_event_subscriber::ShardManagerRegistryInvalidationHandler;
 use crate::sharding::healthcheck::GrpcHealthCheck;

golem-shard-manager/src/sharding/error.rs

@@ -70,16 +70,22 @@ pub enum HealthCheckError {
     GrpcTransportError(#[source] tonic::transport::Error),
     #[error("gRPC: {0}")]
     GrpcOther(&'static str),
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: connect error: {0}")]
     K8sConnectError(#[source] kube::Error),
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod not found")]
     K8sPodNotFound,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod terminated")]
     K8sPodTerminated,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod is not ready")]
     K8sPodNotReady,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: no pod status")]
     K8sNoPodStatus,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: no pod name")]
     K8sNoPodName,
 }
@@ -90,11 +96,17 @@ impl IsRetriableError for HealthCheckError {
             HealthCheckError::GrpcError(status) => status.is_retriable(),
             HealthCheckError::GrpcTransportError(_) => true,
             HealthCheckError::GrpcOther(_) => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sConnectError(_) => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodNotFound => false,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodTerminated => false,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodNotReady => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sNoPodStatus => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sNoPodName => false,
         }
     }

golem-test-framework/Cargo.toml

@@ -50,7 +50,7 @@ testcontainers = { workspace = true }
 testcontainers-modules = { workspace = true }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
-tokio-tungstenite = { workspace = true, features = ["native-tls"] }
+tokio-tungstenite = { workspace = true }
 tonic = { workspace = true }
 tracing = { workspace = true }
 tracing-core = { workspace = true }