Improve boring v4/v5 detection to be more future proof

.github/workflows/stable.yml

@@ -52,7 +52,7 @@ jobs:
           # Pinning to the floor (rather than the latest 4.x) catches
           # accidental use of APIs added in later 4.x point releases.
           # `quiche/src/build.rs` and `tokio-quiche/build.rs` then read
-          # the lockfile and leave `cfg(boring_v5)` off (the default).
+          # the lockfile and set `cfg(boring_v4)`.
           cargo generate-lockfile
           cargo update -p boring --precise 4.19.0
 

Cargo.toml

@@ -30,7 +30,7 @@ mem_forget = "deny"
 unexpected_cfgs = { level = "warn", check-cfg = [
   'cfg(capture_keylogs)',
   'cfg(test_invalid_len_compilation_fail)',
-  'cfg(boring_v5)',
+  'cfg(boring_v4)',
 ] }
 
 [workspace.metadata.release]
@@ -47,8 +47,8 @@ assert_matches = { version = "1" }
 # Accept both `boring` 4.x (>= 4.19, the MSRV for the APIs we use)
 # and `boring` 5.x. The active version is picked by cargo's resolver
 # based on the lockfile / downstream constraints; quiche's `build.rs`
-# detects which one was selected and emits `cfg(boring_v5)` for the
-# 5.x case so source code can switch on it. 4.x is the assumed
+# detects which one was selected and emits `cfg(boring_v4)` for the
+# 4.x case so source code can switch on it. 5.x is the assumed
 # default. `boring-sys` >= 5.2 exports `DEP_BORINGSSL_VERSION_MAJOR`,
 # which `build.rs` uses for detection. See `quiche/src/build.rs` and
 # the `boringssl-boring-crate` feature in `quiche/Cargo.toml`.

quiche/Cargo.toml

@@ -33,7 +33,7 @@ default = ["boringssl-boring-crate"]
 # picks the version based on the lockfile and downstream constraints;
 # `build.rs` detects which major version was selected at compile time
 # (via `DEP_BORINGSSL_VERSION_MAJOR` from `boring-sys` >= 5.2) and
-# emits a `cfg(boring_v5)` flag for the 5.x case. 4.x is the assumed
+# emits a `cfg(boring_v4)` flag for the 4.x case. 5.x is the assumed
 # default. The two majors differ in their default TLS curve list (5.x
 # advertises post-quantum key shares) and in their Rust API for raw
 # public keys; see `tokio-quiche/src/settings/config.rs` for the

quiche/src/build.rs

@@ -44,25 +44,25 @@ fn target_dir_path() -> std::path::PathBuf {
 }
 
 fn main() {
-    // Emit `cfg(boring_v5)` if boring version 5.x is detected. This
+    // Emit `cfg(boring_v4)` if boring version 4.x is detected. This
     // is used to pick which APIs to expect and to guide test
     // expectations. (Larger post-quantum key shares are enabled by
-    // default in boring 5.x but not boring 4.x.) 4.x is the assumed
+    // default in boring 5.x but not boring 4.x.) 5.x is the assumed
     // default.
     //
     // `boring-sys` >= 5.2 emits `cargo:version_major=<N>` from its
     // build script, which cargo surfaces here as
-    // `DEP_BORINGSSL_VERSION_MAJOR`. When absent (boring-sys < 5.2,
-    // or the `boringssl-boring-crate` feature is off) we assume 4.x.
+    // `DEP_BORINGSSL_VERSION_MAJOR`. boring 4.x predates that (it is
+    // paired with boring-sys < 5.2), so when the
+    // `boringssl-boring-crate` feature is on, an absent variable
+    // means 4.x.
     //
     // The cfg is always registered (even when the backend feature is
     // off) so rustc doesn't warn about unknown cfg names.
-    println!("cargo::rustc-check-cfg=cfg(boring_v5)");
+    println!("cargo::rustc-check-cfg=cfg(boring_v4)");
     if cfg!(feature = "boringssl-boring-crate") {
-        if std::env::var("DEP_BORINGSSL_VERSION_MAJOR").ok().as_deref() ==
-            Some("5")
-        {
-            println!("cargo:rustc-cfg=boring_v5");
+        if std::env::var("DEP_BORINGSSL_VERSION_MAJOR").is_err() {
+            println!("cargo:rustc-cfg=boring_v4");
         }
         println!("cargo:rustc-link-lib=static=ssl");
         println!("cargo:rustc-link-lib=static=crypto");

quiche/src/tests.rs

@@ -40,15 +40,15 @@ use rstest::rstest;
 /// handshake-adjacent assertions below. `boring` 4.x doesn't, so each
 /// such assertion has two flavours. Wrap them in this macro so the
 /// per-version values stay side-by-side at the call site. The active
-/// version is detected by `build.rs` (see `cfg(boring_v5)`); 4.x is
+/// version is detected by `build.rs` (see `cfg(boring_v4)`); 5.x is
 /// the assumed default.
 macro_rules! by_boring {
     (b4: $b4:expr, b5: $b5:expr $(,)?) => {{
-        #[cfg(not(boring_v5))]
+        #[cfg(boring_v4)]
         {
             $b4
         }
-        #[cfg(boring_v5)]
+        #[cfg(not(boring_v4))]
         {
             $b5
         }

tokio-quiche/build.rs

@@ -1,16 +1,16 @@
 fn main() {
-    // Emit `cfg(boring_v5)` if boring version 5.x is detected. This
+    // Emit `cfg(boring_v4)` if boring version 4.x is detected. This
     // is used to pick which APIs to expect and to guide test
     // expectations. (Larger post-quantum key shares are enabled by
-    // default in boring 5.x but not boring 4.x.) 4.x is the assumed
+    // default in boring 5.x but not boring 4.x.) 5.x is the assumed
     // default. Mirrors `quiche/src/build.rs`.
     //
     // `boring-sys` >= 5.2 emits `cargo:version_major=<N>` from its
     // build script, which cargo surfaces here as
     // `DEP_BORINGSSL_VERSION_MAJOR`. When absent (boring-sys < 5.2)
     // we assume 4.x.
-    println!("cargo::rustc-check-cfg=cfg(boring_v5)");
-    if std::env::var("DEP_BORINGSSL_VERSION_MAJOR").ok().as_deref() == Some("5") {
-        println!("cargo:rustc-cfg=boring_v5");
+    println!("cargo::rustc-check-cfg=cfg(boring_v4)");
+    if std::env::var("DEP_BORINGSSL_VERSION_MAJOR").is_err() {
+        println!("cargo:rustc-cfg=boring_v4");
     }
 }

tokio-quiche/src/settings/config.rs

@@ -243,9 +243,9 @@ fn quiche_config_with_tls(
             // TODO: Gate this variant on the `rpk` feature.
             panic!("Can't use RPK when compiled without rpk feature");
         },
-        #[cfg(all(feature = "rpk", not(boring_v5)))]
+        #[cfg(all(feature = "rpk", boring_v4))]
         CertificateKind::RawPublicKey => {
-            // boring 4.x (the default) exposes a dedicated
+            // boring 4.x exposes a dedicated
             // `SslContextBuilder::new_rpk()` constructor plus
             // `set_rpk_certificate` / `set_null_chain_private_key`.
             let mut ssl_ctx_builder = boring::ssl::SslContextBuilder::new_rpk()?;
@@ -262,12 +262,13 @@ fn quiche_config_with_tls(
                 ssl_ctx_builder,
             )?)
         },
-        #[cfg(all(feature = "rpk", boring_v5))]
+        #[cfg(all(feature = "rpk", not(boring_v4)))]
         CertificateKind::RawPublicKey => {
-            // boring 5.x replaced the dedicated `SslContextBuilder::new_rpk()`
-            // entry point with a credential-based API: build an
-            // `SslCredential` configured for raw public keys and add it
-            // to a regular `SslContextBuilder` via `add_credential`.
+            // boring 5.x replaced the dedicated
+            // `SslContextBuilder::new_rpk()` entry point with a
+            // credential-based API: build an `SslCredential`
+            // configured for raw public keys and add it to a regular
+            // `SslContextBuilder` via `add_credential`.
             let raw_public_key = read_file(tls.cert)?;
             let raw_private_key = read_file(tls.private_key)?;
             let pkey =