From c332323b01c500750270377bf6bda944912781ed Mon Sep 17 00:00:00 2001
From: Chris Lu <chrislusf@users.noreply.github.com>
Date: Sun, 5 Jul 2026 09:55:41 -0700
Subject: [PATCH] rust volume: pin rustls to aws-lc-rs so TLS gRPC startup
 doesn't panic (#10233)

aws-lc-rs and ring both get linked transitively, so rustls can't
auto-select a crypto provider and tonic's client TLS panics the moment
the volume server dials a master over TLS. Install aws-lc-rs as the
process default in main(), matching the provider the server config
already uses.
---
 seaweed-volume/src/main.rs               |  4 +++-
 seaweed-volume/src/security/tls.rs       |  7 +++++++
 seaweed-volume/src/server/grpc_client.rs | 15 +++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/seaweed-volume/src/main.rs b/seaweed-volume/src/main.rs
index fa7a7d083..044193ea4 100644
--- a/seaweed-volume/src/main.rs
+++ b/seaweed-volume/src/main.rs
@@ -7,7 +7,7 @@ use seaweed_volume::metrics;
 use seaweed_volume::pb::volume_server_pb::volume_server_server::VolumeServerServer;
 use seaweed_volume::security::tls::{
     build_rustls_server_config, build_rustls_server_config_with_grpc_client_auth,
-    GrpcClientAuthPolicy, TlsPolicy,
+    install_default_crypto_provider, GrpcClientAuthPolicy, TlsPolicy,
 };
 use seaweed_volume::security::{Guard, SigningKey};
 #[cfg(unix)]
@@ -39,6 +39,8 @@ const GRPC_MAX_HEADER_LIST_SIZE: u32 = 8 * 1024 * 1024;
 const GRPC_MAX_CONCURRENT_STREAMS: u32 = 1000;
 
 fn main() {
+    install_default_crypto_provider();
+
     // Initialize tracing
     tracing_subscriber::fmt()
         .with_env_filter(
diff --git a/seaweed-volume/src/security/tls.rs b/seaweed-volume/src/security/tls.rs
index 8f8cb2403..21de7a646 100644
--- a/seaweed-volume/src/security/tls.rs
+++ b/seaweed-volume/src/security/tls.rs
@@ -118,6 +118,13 @@ impl ClientCertVerifier for CommonNameVerifier {
     }
 }
 
+// aws-lc-rs and ring both get linked transitively, so rustls can't auto-select
+// a provider and tonic's client TLS panics on first use. Pin the default to
+// aws-lc-rs, matching the server config. Idempotent.
+pub fn install_default_crypto_provider() {
+    let _ = aws_lc_rs::default_provider().install_default();
+}
+
 pub fn build_rustls_server_config(
     cert_path: &str,
     key_path: &str,
diff --git a/seaweed-volume/src/server/grpc_client.rs b/seaweed-volume/src/server/grpc_client.rs
index 40caf8b59..6a2f44964 100644
--- a/seaweed-volume/src/server/grpc_client.rs
+++ b/seaweed-volume/src/server/grpc_client.rs
@@ -164,6 +164,21 @@ mod tests {
     use crate::config::{NeedleMapKind, ReadMode, VolumeServerConfig};
     use crate::security::tls::TlsPolicy;
 
+    const TEST_CERT_PEM: &str = "-----BEGIN CERTIFICATE-----\nMIIBPDCB76ADAgECAhRuRPQgeAu43BT/M7EfAWSdapVdYDAFBgMrZXAwFDESMBAG\nA1UEAwwJbG9jYWxob3N0MB4XDTI2MDcwNTE2MTUyOVoXDTM2MDcwMjE2MTUyOVow\nFDESMBAGA1UEAwwJbG9jYWxob3N0MCowBQYDK2VwAyEAr/3bNIFI+8V32oCiY6y+\nXRFmZpdNQ2g//VtRkT+nQg+jUzBRMB0GA1UdDgQWBBTsy9tLf1zPiXCQfgci6zNi\ndEzRSjAfBgNVHSMEGDAWgBTsy9tLf1zPiXCQfgci6zNidEzRSjAPBgNVHRMBAf8E\nBTADAQH/MAUGAytlcANBAIvsdw0IbvOBBkb9cd7BfMJfIP9pQQrAL03pCRWJFnFh\nSysaLVgFXI4T078IiaM874oO+iB+5vNbWEpc7CkGow4=\n-----END CERTIFICATE-----\n";
+    const TEST_KEY_PEM: &str = "-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEIHbyn71Kk+Y7KT3sBctit7uZpErpoH6qDbFj6P8qGaZH\n-----END PRIVATE KEY-----\n";
+
+    #[test]
+    fn test_build_grpc_endpoint_with_tls_resolves_crypto_provider() {
+        crate::security::tls::install_default_crypto_provider();
+        let tls = super::OutgoingGrpcTlsConfig {
+            cert_pem: TEST_CERT_PEM.to_string(),
+            key_pem: TEST_KEY_PEM.to_string(),
+            ca_pem: TEST_CERT_PEM.to_string(),
+        };
+        let endpoint = build_grpc_endpoint("127.0.0.1:19333", Some(&tls)).unwrap();
+        assert_eq!(endpoint.uri().scheme_str(), Some("https"));
+    }
+
     fn sample_config() -> VolumeServerConfig {
         VolumeServerConfig {
             port: 8080,