fix(deps): Update VRL and preserve TLS provider selection

Cargo.toml

@@ -220,6 +220,7 @@ rand_distr = { version = "0.6.0", default-features = false }
 rdkafka = { version = "0.39.0", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
 reqwest = { version = "0.11", features = ["json"] }
+rustls = { version = "0.23", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 semver = { version = "1.0.28", default-features = false, features = ["serde", "std"] }
 serde = { version = "1.0.219", default-features = false, features = ["alloc", "derive", "rc"] }
 serde_json = { version = "1.0.150", default-features = false, features = ["preserve_order", "raw_value", "std"] }
@@ -482,9 +483,8 @@ rdkafka = { workspace = true, features = ["curl-static", "tokio", "libz", "ssl",
 redis = { version = "0.32.4", default-features = false, features = ["connection-manager", "sentinel", "tokio-comp", "tokio-native-tls-comp"], optional = true }
 regex.workspace = true
 roaring = { version = "0.11.2", default-features = false, features = ["std"], optional = true }
-rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-no-provider"], optional = true }
-# Keep MQTT on Ring alongside Vector's other Rustls users, including in minimal builds.
-rustls = { version = "0.23", default-features = false, features = ["logging", "ring", "std", "tls12"], optional = true }
+# Select MQTT's provider explicitly because VRL also enables Rustls's AWS-LC provider.
+rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-ring"], optional = true }
 seahash = { version = "4.1.0", default-features = false }
 smallvec = { version = "1", default-features = false, features = ["union", "serde"] }
 snap = { version = "1.1.1", default-features = false }
@@ -557,6 +557,7 @@ proptest.workspace = true
 quickcheck.workspace = true
 reqwest.workspace = true
 rstest = { version = "0.26.1" }
+rustls.workspace = true
 serial_test.workspace = true
 similar-asserts.workspace = true
 tempfile.workspace = true
@@ -798,7 +799,7 @@ sources-kafka = ["dep:rdkafka"]
 sources-kubernetes_logs = ["vector-lib/file-source", "kubernetes", "transforms-reduce"]
 sources-logstash = ["sources-utils-net-tcp", "tokio-util/net"]
 sources-mongodb_metrics = ["dep:mongodb"]
-sources-mqtt = ["dep:rumqttc", "dep:rustls"]
+sources-mqtt = ["dep:rumqttc"]
 sources-nats = ["dep:async-nats", "dep:nkeys"]
 sources-nginx_metrics = ["dep:nom"]
 sources-okta = ["sources-utils-http-client"]
@@ -1007,7 +1008,7 @@ sinks-kafka = ["dep:rdkafka"]
 sinks-keep = []
 sinks-mezmo = []
 sinks-loki = ["loki-logproto"]
-sinks-mqtt = ["dep:rumqttc", "dep:rustls"]
+sinks-mqtt = ["dep:rumqttc"]
 sinks-nats = ["dep:async-nats", "dep:nkeys"]
 sinks-new_relic_logs = ["sinks-http"]
 sinks-new_relic = []

LICENSE-3rdparty.csv

@@ -72,6 +72,8 @@ atoi,https://github.com/pacman82/atoi-rs,MIT,Markus Klein
 atomic-waker,https://github.com/smol-rs/atomic-waker,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, Contributors to futures-rs"
 aws-config,https://github.com/smithy-lang/smithy-rs,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-credential-types,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
+aws-lc-rs,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC),AWS-LibCrypto
+aws-lc-sys,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0),AWS-LC
 aws-runtime,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
 aws-sdk-cloudwatch,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-sdk-cloudwatchlogs,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"

lib/vector-core/Cargo.toml

@@ -43,6 +43,7 @@ prost-types.workspace = true
 prost.workspace = true
 quanta = { version = "0.12.6", default-features = false }
 regex = { version = "1.12.3", default-features = false, features = ["std", "perf"] }
+rustls.workspace = true
 zmij = { version = "1", default-features = false }
 serde.workspace = true
 serde_json.workspace = true

lib/vector-core/src/tls/mod.rs

@@ -27,6 +27,16 @@ pub use settings::{
     TlsConfig, TlsEnableableConfig, TlsSettings, TlsSourceConfig,
 };
 
+/// Install Ring as the process-wide Rustls provider if none is already installed.
+///
+/// Call before constructing TLS clients when multiple providers are enabled.
+/// Repeated or concurrent calls preserve the first installed provider.
+pub fn install_default_crypto_provider() {
+    if rustls::crypto::CryptoProvider::get_default().is_none() {
+        _ = rustls::crypto::ring::default_provider().install_default();
+    }
+}
+
 pub type Result<T> = std::result::Result<T, TlsError>;
 
 pub type MaybeTlsStream<S> = MaybeTls<S, SslStream<S>>;

src/cli.rs

@@ -335,6 +335,8 @@ impl RootOpts {
     /// # Panics
     /// Panics if global metrics initialization fails.
     pub fn init_global(&self) {
+        vector_lib::tls::install_default_crypto_provider();
+
         if !self.openssl_no_probe {
             // SAFETY: Initialization runs before worker threads start.
             unsafe {
@@ -586,7 +588,6 @@ mod tests {
     #[cfg(unix)]
     use nix::sys::resource::{Resource, getrlimit, setrlimit};
 
-    #[cfg(unix)]
     fn run_in_subprocess(test_name: &str) {
         let exe = std::env::current_exe().unwrap();
         let output = std::process::Command::new(exe)
@@ -602,6 +603,64 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_init_global_installs_crypto_provider() {
+        use clap::Parser;
+
+        if std::env::var("__VECTOR_SUBPROCESS_TEST").is_err() {
+            run_in_subprocess("cli::tests::test_init_global_installs_crypto_provider");
+            return;
+        }
+
+        assert!(rustls::crypto::CryptoProvider::get_default().is_none());
+        super::RootOpts::parse_from(["vector", "--openssl-no-probe"]).init_global();
+
+        // These clients must work without another component installing a provider.
+        let _config = rustls::ClientConfig::builder()
+            .with_root_certificates(rustls::RootCertStore::empty())
+            .with_no_client_auth();
+
+        #[cfg(feature = "docker")]
+        bollard::Docker::connect_with_ssl(
+            "https://localhost:2376",
+            std::path::Path::new("tests/data/ca/intermediate_client/private/localhost.key.pem"),
+            std::path::Path::new(
+                "tests/data/ca/intermediate_client/certs/localhost-chain.cert.pem",
+            ),
+            std::path::Path::new("tests/data/ca/certs/ca.cert.pem"),
+            120,
+            bollard::API_DEFAULT_VERSION,
+        )
+        .expect("Docker HTTPS should have a crypto provider");
+
+        #[cfg(feature = "sinks-databricks_zerobus")]
+        databricks_zerobus_ingest_sdk::ProxyConnector::new("http://localhost:3128")
+            .expect("Zerobus proxy should have a crypto provider");
+    }
+
+    #[test]
+    fn test_init_global_preserves_crypto_provider() {
+        use clap::Parser;
+
+        if std::env::var("__VECTOR_SUBPROCESS_TEST").is_err() {
+            run_in_subprocess("cli::tests::test_init_global_preserves_crypto_provider");
+            return;
+        }
+
+        let mut provider = rustls::crypto::ring::default_provider();
+        provider.cipher_suites.truncate(1);
+        provider.install_default().unwrap();
+        let original =
+            std::sync::Arc::clone(rustls::crypto::CryptoProvider::get_default().unwrap());
+
+        super::RootOpts::parse_from(["vector", "--openssl-no-probe"]).init_global();
+
+        assert!(std::sync::Arc::ptr_eq(
+            &original,
+            rustls::crypto::CryptoProvider::get_default().unwrap(),
+        ));
+    }
+
     #[test]
     #[cfg(unix)]
     fn test_raise_file_descriptor_limit() {