TLS: every stdlib/ext archive links both ring and aws-lc-rs — converge on one provider #11104

Every default libperry_stdlib.a, plus perry-ext-http and perry-ext-net, links both rustls crypto providers: ring 0.17 and aws-lc-rs/aws-lc-sys. They also link two root stores, webpki-roots 1.0 and rustls-native-certs. libperry_runtime.a has no TLS dependency. Traced on d8f24f15ed with cargo tree --workspace --all-features -i <pkg>. Without --workspace, default-members hides the ext crates.

Why aws-lc is there

1. Perry's own rustls/tokio-rustls declarations never set default-features = false, so rustls's default aws_lc_rs feature comes in:
   • root Cargo.toml:471-472
   • perry-ext-http/Cargo.toml:27-28
   • perry-ext-net/Cargo.toml:23,28
   • perry-stdlib/Cargo.toml:343-344
2. Four call sites install aws_lc_rs::default_provider(): perry-stdlib/src/tls.rs:378, perry-stdlib/src/ws.rs:48, perry-stdlib/src/net/mod.rs:665 and perry-ext-net/src/tls.rs:419. By contrast, perry-ext-http/src/server/tls.rs:323-330 and turnloop-tls use ring.
3. The legacy mongodb 3.9 driver in perry-ext-mongodb requests the rustls defaults on its own. It goes away when the mongodb binding is deleted (mongodb: TypeError "Cannot read properties of undefined (reading 'default')" on connect #11043, tokio group J).

Finishing tokio removal does not fix points 1 and 2. Those declarations back the TLS implementation that stays.

Proposed convergence on ring + webpki-roots

• Set default-features = false on every rustls/tokio-rustls declaration, the workspace ones included.
• Switch the four aws_lc_rs install sites to rustls::crypto::ring::default_provider().
• Once mongodb: TypeError "Cannot read properties of undefined (reading 'default')" on connect #11043 lands, delete perry-ext-mongodb.
• Decide on the root store deliberately. tls.connect() and the net.Socket TLS upgrade use the OS store through rustls-native-certs. Node defaults to its bundled CA list, so moving to webpki-roots would match Node more closely. That is a behaviour change and needs gap-test validation first.
• Optionally tighten deny.toml multiple-versions from warn to deny afterwards.

Sequencing

• Wait for the in-flight lanes. Do this after tokio lanes A (ext-net/ext-http), H (turnloop(P8 H): move perry-stdlib's TLS off tokio-rustls onto a sans-I/O rustls session #11102) and L land, because they touch the same tls.rs/ws.rs/net files.
• Batch the root edit. The root Cargo.toml edit changes benchmarks/public_baseline.py SOURCE_PATHS, so it forces the ~2h baseline regeneration. Put it in the same commit as another regen.

Size

Not measured yet. Measure with:

cargo build --profile perry-dev -p perry-stdlib-static -p perry-runtime-static
nm --size-sort -S <target>/libperry_stdlib.a | grep -i aws_lc

webpki-roots 0.26 comes only from perry-ui-android's tungstenite 0.24 pin, which is Android-only and ships in none of the runtime, stdlib or ext archives.