Boring 5 Roadmap

[nox]

Now that boring 4 is pretty old (I'm just joking), let's keep track of what we should do for boring 5:

• hyper-boring: update to hyper 1.0.0 #194
• Rename replace_ex_data to set_ex_data, as keeping the leaking versions is a footgun Deprecate set_ex_data on v4 #423 Fix leak in set_ex_data in v5 #424
• Rename Ssl::new_from_ref to Ssl::new 8abba36
• Rename X509Builder::append_extension2 to X509Builder::append_extension
• Make boring::ssl::SslStream::new infallible, its current return type is Result<_, ErrorStack> but it returns Ok(_) always. It calls bio::new(), which is fallible.
• Remove obsolete X509CheckFlags values Remove deprecated X509CheckFlags flag #425
• Decouple "fips-compat" from "fips": Remove "fips-no-compat", decouple "fips-compat" from "fips" #333
• Revisit Clone impl for X509Store #362 is mostly solved; Final fix: Safe clone for X509Store #426
• SslContextBuilder::from_ptr should not have a different signature depending on rpk feature #363 Fixed in 4ce1308
• SslCipher's DerefMut fixed in 7a0021e

[howardjohn]

Any alternative (or addition, I suppose) to hyper 1.0 support could be #165, which lets the rest of the rustls ecosystem handle things like tokio, hyper, etc integration

[nox]

Added bullet point about Clone for X509Store.

[cjpatton]

One suggestion here would be to move "fips-precompiled" to "fips". The latter implies "fips-compat", which is only needed for very old builds of boringSSL.

[kornelski]

We could unify interface for keys to match #364

[nox]

Boring 5 was not released yet so reopening this.

We should probably remove DerefMut for SslCipher, as it serves no purpose.

[nox]

And we could probably remove SslCipher altogether and keep only &'static SslCipherRef.