Skip to content

add aws-smithy-http-client - #940

Open
sky1122 wants to merge 4 commits into
bottlerocket-os:developfrom
sky1122:aws-smithy-http-client
Open

add aws-smithy-http-client#940
sky1122 wants to merge 4 commits into
bottlerocket-os:developfrom
sky1122:aws-smithy-http-client

Conversation

@sky1122

@sky1122 sky1122 commented Jun 2, 2026

Copy link
Copy Markdown
Contributor

Description of changes:
This PR adds a local carry of aws-smithy-http-client from aws-sdk-rs and migrates pluto and cfsignal from the deprecated
aws-smithy-experimental crate. The old aws-smithy-experimental crate is removed from the workspace.

The carry makes modifications from upstream:

  1. remote unstable feature

A full diff against upstream is available in this gist

Note: The first three commits will disappear after the previous PR is merged.

Testing done:

  • test1: build a k8s variant and it join the cluster and success boot
root@admin]# apiclient get os
{
  "os": {
    "arch": "x86_64",
    "build_id": "9ebb2db5-dirty",
    "pretty_name": "Bottlerocket OS 1.63.0 (aws-k8s-1.33)",
    "variant_id": "aws-k8s-1.33",
    "version_id": "1.63.0"
  }
[root@admin]#
  • test2: api call success
sh-5.2# export HTTPS_PROXY=https://192.168.61.113:8443
bash-5.2# /usr/bin/cfsignal
00:04:16 [INFO] System status is: running [0]
00:04:16 [INFO] Connecting to IMDS
00:04:16 [INFO] Received meta-data/instance-id
00:04:16 [INFO] Received dynamic/instance-identity/document
00:04:16 [INFO] Region: "us-west-2" - InstanceID: "i-0" - Signal: "SUCCESS"
00:04:16 [ERROR] Error while sending signal: SignalResource request failed: service error
bash-5.2#
  • test3: proxcy
    setting bottlerocket with
apiclient set --json '{
  "network": {
    "https-proxy": "https://192.168.61.113:8888",
    "no-proxy": ["169.254.169.254"]
  }
}'
-5.2$ sudo tail -f /var/log/squid/access.log | grep 192.168.53.250
1783988273.318  89178 192.168.53.250 TCP_TUNNEL/200 6381 CONNECT 328549459982.dkr.ecr.us-west-2.amazonaws.com:443 - HIER_DIRECT/35.83.11.234 -
1783988273.450  20016 192.168.53.250 TCP_TUNNEL/200 6074 CONNECT ec2messages.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.254.113.229 -
1783988289.760  60063 192.168.53.250 TCP_TUNNEL/200 10135 CONNECT api.ecr.us-west-2.amazonaws.com:443 - HIER_DIRECT/34.223.26.175 -
1783988293.384  60081 192.168.53.250 TCP_TUNNEL/200 6480 CONNECT ssm.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.248.101.66 -
1783988293.566  20015 192.168.53.250 TCP_TUNNEL/200 6074 CONNECT ec2messages.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.254.113.229 -
1783988299.711   6044 192.168.53.250 TCP_TUNNEL/200 6098 CONNECT ec2messages.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.254.15.12 -
1783988308.361  75031 192.168.53.250 TCP_TUNNEL/200 6700 CONNECT ssmmessages.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.254.15.95 -
1783988314.007  75038 192.168.53.250 TCP_TUNNEL/200 6668 CONNECT ssmmessages.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.254.15.95 -
1783988314.530  60089 192.168.53.250 TCP_TUNNEL/200 8267 CONNECT ssm.us-west-2.amazonaws.com:443 - HIER_DIRECT/44.248.101.66 -
1783988319.830  90085 192.168.53.250 TCP_TUNNEL/200 6381 CONNECT 328549459982.dkr.ecr.us-west-2.amazonaws.com:443 - HIER_DIRECT/35.83.11.234 -



Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

@sky1122
sky1122 force-pushed the aws-smithy-http-client branch 3 times, most recently from b9e6362 to d559d7b Compare June 3, 2026 00:02
@sky1122
sky1122 marked this pull request as ready for review June 3, 2026 17:55
@jpculp
jpculp self-requested a review June 6, 2026 00:22

@jpculp jpculp left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks like it's on the right track, but don't forget to update the COPYRIGHT both in the commit where you add aws-smithy-http-client and the commit you remove aws-smithy-experimental.

@sky1122
sky1122 force-pushed the aws-smithy-http-client branch from d559d7b to cc85b99 Compare June 16, 2026 16:30
@sky1122

sky1122 commented Jun 16, 2026

Copy link
Copy Markdown
Contributor Author

forced pushed to change the copy right and I also drop the bloodhound commit from this PR.

@sky1122
sky1122 force-pushed the aws-smithy-http-client branch from cc85b99 to b2dfcc6 Compare July 11, 2026 00:16
@sky1122

sky1122 commented Jul 11, 2026

Copy link
Copy Markdown
Contributor Author

force pushed to

  • rebase
  • make minimal change to upstream aws-smithy-http-client

@sky1122
sky1122 force-pushed the aws-smithy-http-client branch 2 times, most recently from 3fa14e9 to 9b1afbd Compare July 14, 2026 19:44
@sky1122

sky1122 commented Jul 14, 2026

Copy link
Copy Markdown
Contributor Author

forced push to fix the cargo deny issue

@sky1122
sky1122 force-pushed the aws-smithy-http-client branch from 9b1afbd to ea9502a Compare July 15, 2026 22:17
@sky1122

sky1122 commented Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

forced push to

  • fix wrongly update dependency
  • fix cargo deney

Comment thread sources/api/apiclient/src/lib.rs
Comment thread sources/api/pluto/Cargo.toml Outdated
Comment thread sources/cfsignal/Cargo.toml Outdated
@sky1122
sky1122 force-pushed the aws-smithy-http-client branch from ea9502a to 98d5140 Compare July 17, 2026 00:16
@sky1122
sky1122 requested a review from jpculp July 17, 2026 17:28
sky1122 added 4 commits July 31, 2026 18:45
Add a local carry of the aws-smithy-http-client crate from smithy-rs
with support for custom CryptoProvider injection. This enables
Bottlerocket binaries to configure TLS at runtime rather than relying
on compile-time feature flags for FIPS crypto selection.

This replaces aws-smithy-experimental as the HTTP client abstraction
for binaries that need explicit control over TLS configuration.

Signed-off-by: Jingwei Wang <jweiw@amazon.com>
Replace the deprecated aws-smithy-experimental crate with
aws-smithy-http-client for HTTP client construction in pluto. The new
crate provides explicit TLS provider selection and proxy configuration
through the ConnectorBuilder API.

Signed-off-by: Jingwei Wang <jweiw@amazon.com>
Replace aws-smithy-experimental with aws-smithy-http-client for
CloudFormation signal HTTP client construction. The new crate provides
explicit TLS provider selection and proxy configuration through the
ConnectorBuilder API.

Signed-off-by: Jingwei Wang <jweiw@amazon.com>
Remove the deprecated aws-smithy-experimental crate from the workspace.
This crate has been superseded by aws-smithy-http-client which provides
the same HTTP client functionality with support for custom CryptoProvider
injection.

No binaries depend on aws-smithy-experimental after the pluto and
cfsignal migrations to aws-smithy-http-client.

Signed-off-by: Jingwei Wang <jweiw@amazon.com>
@Sparksssj
Sparksssj force-pushed the aws-smithy-http-client branch from 98d5140 to f8ed8dc Compare July 31, 2026 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants