fix(stm): stop forcing rustls in the future_snark feature

.github/workflows/test-rust.yml

@@ -19,7 +19,7 @@ jobs:
             test-args: --features full,unstable --workspace
             cargo-profile: ci-tests
           - os: ubuntu-24.04
-            test-args: --features future_snark -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
+            test-args: --features future_snark,rustls -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
             artifact-suffix: -future-snark
             # Default to the fast profile; the `prepare` step upgrades to `slow-cargo-profile`
             # only when the slow SNARK tests are actually in scope for this run (so we don't pay

demo/protocol-demo/Cargo.toml

@@ -9,8 +9,11 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [features]
+default = ["rustls"]
 # Enable experimental SNARK support in mithril-stm and mithril-common.
 future_snark = ["mithril-stm/future_snark", "mithril-common/future_snark"]
+# Enable the TLS features of mithril-stm.
+rustls = ["mithril-stm/rustls"]
 
 [dependencies]
 clap = { workspace = true }

docs/runbook/update-circuit-keys/README.md

@@ -29,13 +29,13 @@ Reviewers:
 Commands to run the integrity tests:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_non_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_non_recursive_production_key -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release integrity_test_for_recursive_production_key -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release integrity_test_for_recursive_production_key -- --ignored
 ```
 
 Release manager:
@@ -52,13 +52,13 @@ The author needs to update the golden value of the verification keys in the gold
 To update the production circuit verification keys, one needs to run the following commands:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_non_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 and
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
+cargo test -p mithril-stm --features future_snark,rustls --release write_recursive_circuit_verification_key_for_production_to_file -- --ignored
 ```
 
 that will update the files holding the values of the production keys, `mithril-stm/src/circuits/halo2/non_recursive_circuit_verification_key_for_production.bin` and `mithril-stm/src/circuits/halo2_ivc/recursive_circuit_verification_key_for_production.bin`.

mithril-aggregator/Cargo.toml

@@ -11,7 +11,7 @@ repository = { workspace = true }
 
 [features]
 default = ["rustls"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 future_snark = ["mithril-common/future_snark", "dep:ciborium"]
 

mithril-client/Cargo.toml

@@ -30,13 +30,13 @@ unstable = []
 
 # These features are for support of dependent crates only.
 # They do not change the operation of the main crate.
-native-tls = ["reqwest/native-tls"]
-native-tls-no-alpn = ["reqwest/native-tls-no-alpn"]
-native-tls-vendored = ["reqwest/native-tls-vendored"]
-native-tls-vendored-no-alpn = ["reqwest/native-tls-vendored-no-alpn"]
+native-tls = ["mithril-common/native-tls", "reqwest/native-tls"]
+native-tls-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-no-alpn"]
+native-tls-vendored = ["mithril-common/native-tls", "reqwest/native-tls-vendored"]
+native-tls-vendored-no-alpn = ["mithril-common/native-tls", "reqwest/native-tls-vendored-no-alpn"]
 
-rustls = ["reqwest/rustls"]
-rustls-no-provider = ["reqwest/rustls-no-provider"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
+rustls-no-provider = ["mithril-common/rustls", "reqwest/rustls-no-provider"]
 
 # Support compressed traffic with `reqwest`
 enable-http-compression = ["reqwest/gzip", "reqwest/zstd", "reqwest/deflate", "reqwest/brotli"]

mithril-common/Cargo.toml

@@ -32,6 +32,11 @@ allow_skip_signer_certification = []
 # Enables the future SNARK implementation for the `mithril-stm` dependency
 future_snark = ["mithril-stm/future_snark"]
 
+# Enables the TLS features for the `mithril-stm` dependency
+# Exactly one of these must be enabled together with `future_snark`
+native-tls = ["mithril-stm/native-tls"]
+rustls = ["mithril-stm/rustls"]
+
 [dependencies]
 anyhow = { workspace = true }
 async-trait = { workspace = true }

mithril-relay/Cargo.toml

@@ -13,7 +13,7 @@ repository = { workspace = true }
 default = ["rustls"]
 # For activating snark features
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }

mithril-signer/Cargo.toml

@@ -16,7 +16,7 @@ ignored = ["reqwest"]
 [features]
 default = ["rustls"]
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }

mithril-stm/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.11.5 (07-28-2026)
+
+### Changed
+
+- The `future_snark` feature no longer enables the `rustls` feature: the TLS backend of the SRS download is now selected by the caller, which makes the `native-tls` feature usable.
+
 ## 0.11.4 (07-27-2026)
 
 ### Added

mithril-stm/Cargo.toml

@@ -31,8 +31,6 @@ future_snark = [
     "dep:sha2",
     "dep:rand_chacha",
     "dep:reqwest",
-    # Temporarily activate rustls before it is activated in the caller
-    "rustls",
 ]
 # TLS backend for the SRS download client (used by `future_snark`).
 # Exactly one of these must be enabled together with `future_snark`.

mithril-stm/README.md

@@ -43,6 +43,14 @@ cd mithril-stm
 cargo build --release
 ```
 
+## TLS backend
+
+The `future_snark` feature downloads the SRS of the trusted setup over HTTPS and lets the caller pick the TLS backend. Enable exactly one of the `rustls` or `native-tls` features along with it:
+
+```shell
+cargo build --release --features future_snark,rustls
+```
+
 ## Running the tests
 
 For running rust tests, simply run (to run the tests faster, the use of `--release` flag is recommended):
@@ -247,15 +255,15 @@ Three metrics are measured per tier: VK/PK setup time, proof generation time, an
 Small and medium tiers use Criterion (10 samples, flat sampling — one iteration per sample):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/small
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/medium
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/small
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/medium
 ```
 
 Large and production tiers run a single timed measurement (Criterion's 10-sample minimum is impractical at this scale):
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/large
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/production
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/large
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/production
 ```
 
 ## CI Parameter Benchmarks
@@ -294,5 +302,5 @@ All tiers complete in under 15 minutes on any developer machine with at least 4
 ### Running the benchmarks
 
 ```bash
-cargo bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_prover_modes
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_prover_modes
 ```

mithril-stm/benches/README.md

@@ -18,16 +18,16 @@ front-ends.
 
 ## Prerequisites
 
-- **Toolchain:** the crate's dev-dependencies require `rustc ≥ 1.88`. The commands below pin `+1.88.0`; use
-  any installed toolchain `≥ 1.88`, or set it as the default and drop the `+1.88.0`.
-- **Features:** all circuit benches require `--features future_snark,benchmark-internals`.
+- **Toolchain:** the crate's dev-dependencies require the latest stable Rust toolchain.
+- **Features:** all circuit benches require `--features future_snark,rustls,benchmark-internals`. `future_snark`
+  downloads the SRS over HTTPS and needs a TLS backend: pick either `rustls` or `native-tls`.
 - **Resources:** the recursive circuit runs at degree 19 (GB-scale RAM, minutes per proof); the non-recursive
   `production` tier needs ≥ 70 GB RAM (server-class). Scope your run accordingly.
 
 General invocation:
 
 ```bash
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench <name> -- <args>
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench <name> -- <args>
 ```
 
 Everything after `--` is passed to the benchmark binary.
@@ -64,24 +64,24 @@ never silently trigger a multi-minute key generation). Arguments go after `--`:
 
 ```bash
 # List every benchmark id — no benchmark setup or key generation (Cargo may still compile the target):
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- --list
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- --list
 
 # Show usage:
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- --help
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- --help
 
 # Run everything (tens of minutes; performs TWO recursive key generations — the shared per-path
 # environment and the cold setup/keys measurement — then all proofs):
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark
 
 # Run a subset: pass ONE literal id or prefix (substring match against the ids from --list).
 # One transition path (prove + verify + fold):
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- ivc/same_epoch
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- ivc/same_epoch
 # One path's verification only:
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- ivc/genesis/verify
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- ivc/genesis/verify
 # SRS cold vs warm (no key generation):
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- ivc/setup/srs
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- ivc/setup/srs
 # Keys cold vs warm (cold performs a full recursive key generation):
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench ivc_halo2_snark -- ivc/setup/keys
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench ivc_halo2_snark -- ivc/setup/keys
 ```
 
 The filter is a **literal** substring, not a regex. The parser rejects (rather than silently ignores):
@@ -119,10 +119,10 @@ Criterion's list/filter modes do **not** gate the manually-timed `large`/`produc
 positional `certificate/<tier>` filter does.
 
 ```bash
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/small
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/medium
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/large
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_snark -- certificate/production
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/small
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/medium
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/large
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_snark -- certificate/production
 ```
 
 | Tier         | Quorum | `k` | Measurement           |
@@ -141,5 +141,5 @@ Takes no arguments — it sweeps a range of `k` tiers and prints, for each, the
 timings projected onto a standard e2e run (~80 certificates):
 
 ```bash
-cargo +1.88.0 bench -p mithril-stm --features future_snark,benchmark-internals --bench halo2_prover_modes
+cargo bench -p mithril-stm --features future_snark,rustls,benchmark-internals --bench halo2_prover_modes
 ```

mithril-stm/src/circuits/halo2_ivc/tests/assets/README.md

@@ -69,15 +69,15 @@ assets are not expected to be byte-identical across regenerations.
 Run these commands from the repository root in order:
 
 ```bash
-cargo test -p mithril-stm --features future_snark --release generate_golden_recursive_circuit_verification_key_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_verification_context_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_genesis_step_output_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_recursive_chain_state_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_same_epoch_step_output_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_recursive_step_output_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_first_step_cert_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_recursive_step_output_accumulator_bytes_only -- --ignored --nocapture
-cargo test -p mithril-stm --features future_snark --release generate_recursive_proof_accumulator_bytes_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_golden_recursive_circuit_verification_key_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_verification_context_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_genesis_step_output_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_recursive_chain_state_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_same_epoch_step_output_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_recursive_step_output_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_first_step_cert_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_recursive_step_output_accumulator_bytes_only -- --ignored --nocapture
+cargo test -p mithril-stm --features future_snark,rustls --release generate_recursive_proof_accumulator_bytes_only -- --ignored --nocapture
 ```
 
 These commands intentionally use `--release` because asset generation is a

mithril-test-lab/mithril-end-to-end/Cargo.toml

@@ -18,7 +18,7 @@ bench = false
 default = ["rustls"]
 allow_skip_signer_certification = []
 future_snark = ["mithril-common/future_snark"]
-rustls = ["reqwest/rustls"]
+rustls = ["mithril-common/rustls", "reqwest/rustls"]
 
 [dependencies]
 anyhow = { workspace = true }