-
Notifications
You must be signed in to change notification settings - Fork 746
Description
Checklist
- I've searched the issue tracker for similar bugs.
Describe the bug
I recently skimmed over the changes of a recent rustls update and noticed that there are several non-code test files included in the published packages:
That includes:
- The testdata directory: https://diff.rs/rustls/0.22.4/0.23.12/src%2Ftestdata
- The binary representation of the ffdhe_groups: https://diff.rs/rustls/0.22.4/0.23.12/src%2Fmsgs%2Fffdhe_groups
To Reproduce
Steps to reproduce the behavior:
- Download a release from crates.io and check the crates file for these folders
Applicable Version(s)
0.23.12
Expected behavior
For the testdata I would just expect that they are not included. They only seem to be needed for running the tests, which is not required for the downloaded crate from crates.io
For the ffdhe_groups I can see why they are needed. I personally would prefer defining them as constants in the rust code matching the relevant definitions in the linked RFC by using the hex representation. That would make it easier to verify that these constants are correct.
Additional context
With the recent xz accident such files became suspicious, although I explicitly do not want to imply that they are any problem.
Additionally these files increase the size of the downloaded code.