fix(deps): Update VRL and preserve TLS provider selection

Cargo.toml

@@ -482,9 +482,10 @@ rdkafka = { workspace = true, features = ["curl-static", "tokio", "libz", "ssl",
 redis = { version = "0.32.4", default-features = false, features = ["connection-manager", "sentinel", "tokio-comp", "tokio-native-tls-comp"], optional = true }
 regex.workspace = true
 roaring = { version = "0.11.2", default-features = false, features = ["std"], optional = true }
-rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-no-provider"], optional = true }
-# Keep MQTT on Ring alongside Vector's other Rustls users, including in minimal builds.
-rustls = { version = "0.23", default-features = false, features = ["logging", "ring", "std", "tls12"], optional = true }
+# Select MQTT's provider explicitly because VRL also enables Rustls's AWS-LC provider.
+rumqttc = { package = "rumqttc-v4-next", version = "0.34.0", default-features = false, features = ["use-rustls-ring"], optional = true }
+# Initialize a shared TLS provider at startup when both Ring and AWS-LC are enabled.
+rustls = { version = "0.23", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 seahash = { version = "4.1.0", default-features = false }
 smallvec = { version = "1", default-features = false, features = ["union", "serde"] }
 snap = { version = "1.1.1", default-features = false }
@@ -798,7 +799,7 @@ sources-kafka = ["dep:rdkafka"]
 sources-kubernetes_logs = ["vector-lib/file-source", "kubernetes", "transforms-reduce"]
 sources-logstash = ["sources-utils-net-tcp", "tokio-util/net"]
 sources-mongodb_metrics = ["dep:mongodb"]
-sources-mqtt = ["dep:rumqttc", "dep:rustls"]
+sources-mqtt = ["dep:rumqttc"]
 sources-nats = ["dep:async-nats", "dep:nkeys"]
 sources-nginx_metrics = ["dep:nom"]
 sources-okta = ["sources-utils-http-client"]
@@ -1007,7 +1008,7 @@ sinks-kafka = ["dep:rdkafka"]
 sinks-keep = []
 sinks-mezmo = []
 sinks-loki = ["loki-logproto"]
-sinks-mqtt = ["dep:rumqttc", "dep:rustls"]
+sinks-mqtt = ["dep:rumqttc"]
 sinks-nats = ["dep:async-nats", "dep:nkeys"]
 sinks-new_relic_logs = ["sinks-http"]
 sinks-new_relic = []

LICENSE-3rdparty.csv

@@ -72,6 +72,8 @@ atoi,https://github.com/pacman82/atoi-rs,MIT,Markus Klein
 atomic-waker,https://github.com/smol-rs/atomic-waker,Apache-2.0 OR MIT,"Stjepan Glavina <stjepang@gmail.com>, Contributors to futures-rs"
 aws-config,https://github.com/smithy-lang/smithy-rs,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-credential-types,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
+aws-lc-rs,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC),AWS-LibCrypto
+aws-lc-sys,https://github.com/aws/aws-lc-rs,ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0),AWS-LC
 aws-runtime,https://github.com/smithy-lang/smithy-rs,Apache-2.0,AWS Rust SDK Team <aws-sdk-rust@amazon.com>
 aws-sdk-cloudwatch,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"
 aws-sdk-cloudwatchlogs,https://github.com/awslabs/aws-sdk-rust,Apache-2.0,"AWS Rust SDK Team <aws-sdk-rust@amazon.com>, Russell Cohen <rcoh@amazon.com>"

src/cli.rs

@@ -335,6 +335,10 @@ impl RootOpts {
     /// # Panics
     /// Panics if global metrics initialization fails.
     pub fn init_global(&self) {
+        // VRL enables AWS-LC alongside Ring. Select a default before any clients
+        // are built; installation leaves an existing provider unchanged.
+        _ = rustls::crypto::ring::default_provider().install_default();
+
         if !self.openssl_no_probe {
             // SAFETY: Initialization runs before worker threads start.
             unsafe {
@@ -586,7 +590,6 @@ mod tests {
     #[cfg(unix)]
     use nix::sys::resource::{Resource, getrlimit, setrlimit};
 
-    #[cfg(unix)]
     fn run_in_subprocess(test_name: &str) {
         let exe = std::env::current_exe().unwrap();
         let output = std::process::Command::new(exe)
@@ -602,6 +605,64 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_init_global_installs_crypto_provider() {
+        use clap::Parser;
+
+        if std::env::var("__VECTOR_SUBPROCESS_TEST").is_err() {
+            run_in_subprocess("cli::tests::test_init_global_installs_crypto_provider");
+            return;
+        }
+
+        assert!(rustls::crypto::CryptoProvider::get_default().is_none());
+        super::RootOpts::parse_from(["vector", "--openssl-no-probe"]).init_global();
+
+        // These clients must work without another component installing a provider.
+        let _config = rustls::ClientConfig::builder()
+            .with_root_certificates(rustls::RootCertStore::empty())
+            .with_no_client_auth();
+
+        #[cfg(feature = "docker")]
+        bollard::Docker::connect_with_ssl(
+            "https://localhost:2376",
+            std::path::Path::new("tests/data/ca/intermediate_client/private/localhost.key.pem"),
+            std::path::Path::new(
+                "tests/data/ca/intermediate_client/certs/localhost-chain.cert.pem",
+            ),
+            std::path::Path::new("tests/data/ca/certs/ca.cert.pem"),
+            120,
+            bollard::API_DEFAULT_VERSION,
+        )
+        .expect("Docker HTTPS should have a crypto provider");
+
+        #[cfg(feature = "sinks-databricks_zerobus")]
+        databricks_zerobus_ingest_sdk::ProxyConnector::new("http://localhost:3128")
+            .expect("Zerobus proxy should have a crypto provider");
+    }
+
+    #[test]
+    fn test_init_global_preserves_crypto_provider() {
+        use clap::Parser;
+
+        if std::env::var("__VECTOR_SUBPROCESS_TEST").is_err() {
+            run_in_subprocess("cli::tests::test_init_global_preserves_crypto_provider");
+            return;
+        }
+
+        let mut provider = rustls::crypto::ring::default_provider();
+        provider.cipher_suites.truncate(1);
+        provider.install_default().unwrap();
+        let original =
+            std::sync::Arc::clone(rustls::crypto::CryptoProvider::get_default().unwrap());
+
+        super::RootOpts::parse_from(["vector", "--openssl-no-probe"]).init_global();
+
+        assert!(std::sync::Arc::ptr_eq(
+            &original,
+            rustls::crypto::CryptoProvider::get_default().unwrap(),
+        ));
+    }
+
     #[test]
     #[cfg(unix)]
     fn test_raise_file_descriptor_limit() {

src/common/mqtt.rs

@@ -135,10 +135,9 @@ impl MqttConnector {
 #[cfg(test)]
 mod tests {
     #[test]
-    fn tls_crypto_provider_is_unambiguous() {
-        // Rustls panics here if no provider, or both Ring and AWS-LC, are enabled.
-        let _config = rustls::ClientConfig::builder()
-            .with_root_certificates(rustls::RootCertStore::empty())
-            .with_no_client_auth();
+    fn tls_config_uses_explicit_crypto_provider() {
+        // Exercise MQTT's provider selection, including when VRL enables AWS-LC.
+        rumqttc::TlsConfiguration::try_default_rustls()
+            .expect("MQTT TLS should select Ring without a process-wide default provider");
     }
 }