enhancement(deps)!: remove openssl legacy provider flag and update docs

Cargo.toml

@@ -385,8 +385,6 @@ nix = { git = "https://github.com/vectordotdev/nix.git", branch = "memfd/gnu/mus
 # The `heim` crates depend on `ntapi` 0.3.7 on Windows, but that version has an
 # unaligned access bug fixed in the following revision.
 ntapi = { git = "https://github.com/MSxDOS/ntapi.git", rev = "24fc1e47677fc9f6e38e5f154e6011dc9b270da6" }
-# 300.1.3+3.1.2 + a commit that re-adds force-engine flag. Can be removed after next release of openssl-src.
-openssl-src = { git = "https://github.com/alexcrichton/openssl-src-rs", ref = "26dc3c81d8ebee5f7ec40835e29bf9f37e648ab2" }
 
 [features]
 # Default features for *-unknown-linux-gnu and *-apple-darwin

src/app.rs

@@ -8,7 +8,6 @@ use futures::StreamExt;
 #[cfg(feature = "enterprise")]
 use futures_util::future::BoxFuture;
 use once_cell::race::OnceNonZeroUsize;
-use openssl::provider::Provider;
 use tokio::{
     runtime::{self, Runtime},
     sync::mpsc,
@@ -62,7 +61,6 @@ pub struct Application {
     pub require_healthy: Option<bool>,
     pub config: ApplicationConfig,
     pub signals: SignalPair,
-    pub openssl_providers: Option<Vec<Provider>>,
 }
 
 impl ApplicationConfig {
@@ -196,12 +194,6 @@ impl Application {
             debug!(message = "Disabled probing and configuration of root certificate locations on the system for OpenSSL.");
         }
 
-        let openssl_providers = opts
-            .root
-            .openssl_legacy_provider
-            .then(load_openssl_legacy_providers)
-            .transpose()?;
-
         let runtime = build_runtime(opts.root.threads, "vector-worker")?;
 
         // Signal handler for OS and provider messages.
@@ -222,7 +214,6 @@ impl Application {
                 require_healthy: opts.root.require_healthy,
                 config,
                 signals,
-                openssl_providers,
             },
         ))
     }
@@ -239,7 +230,6 @@ impl Application {
             require_healthy,
             config,
             signals,
-            openssl_providers,
         } = self;
 
         let topology_controller = SharedTopologyController::new(TopologyController {
@@ -257,7 +247,6 @@ impl Application {
             graceful_crash_receiver: config.graceful_crash_receiver,
             signals,
             topology_controller,
-            openssl_providers,
         })
     }
 }
@@ -267,7 +256,6 @@ pub struct StartedApplication {
     pub graceful_crash_receiver: mpsc::UnboundedReceiver<ShutdownError>,
     pub signals: SignalPair,
     pub topology_controller: SharedTopologyController,
-    pub openssl_providers: Option<Vec<Provider>>,
 }
 
 impl StartedApplication {
@@ -281,7 +269,6 @@ impl StartedApplication {
             graceful_crash_receiver,
             signals,
             topology_controller,
-            openssl_providers,
         } = self;
 
         let mut graceful_crash = UnboundedReceiverStream::new(graceful_crash_receiver);
@@ -313,7 +300,6 @@ impl StartedApplication {
             signal,
             signal_rx,
             topology_controller,
-            openssl_providers,
         }
     }
 }
@@ -368,7 +354,6 @@ pub struct FinishedApplication {
     pub signal: SignalTo,
     pub signal_rx: SignalRx,
     pub topology_controller: SharedTopologyController,
-    pub openssl_providers: Option<Vec<Provider>>,
 }
 
 impl FinishedApplication {
@@ -377,7 +362,6 @@ impl FinishedApplication {
             signal,
             signal_rx,
             topology_controller,
-            openssl_providers,
         } = self;
 
         // At this point, we'll have the only reference to the shared topology controller and can
@@ -392,7 +376,6 @@ impl FinishedApplication {
             SignalTo::Quit => Self::quit(),
             _ => unreachable!(),
         };
-        drop(openssl_providers);
         status
     }
 
@@ -562,22 +545,3 @@ pub fn init_logging(color: bool, format: LogFormat, log_level: &str, rate: u64)
     );
     info!(message = "Log level is enabled.", level = ?level);
 }
-
-/// Load the legacy OpenSSL provider.
-///
-/// The returned [Provider] must stay in scope for the entire lifetime of the application, as it
-/// will be unloaded when it is dropped.
-pub fn load_openssl_legacy_providers() -> Result<Vec<Provider>, ExitCode> {
-    warn!(message = "DEPRECATED The openssl legacy provider provides algorithms and key sizes no longer recommended for use. Set `--openssl-legacy-provider=false` or `VECTOR_OPENSSL_LEGACY_PROVIDER=false` to disable. See https://vector.dev/highlights/2023-08-15-0-32-0-upgrade-guide/#legacy-openssl for details.");
-    ["legacy", "default"].into_iter().map(|provider_name| {
-        Provider::try_load(None, provider_name, true)
-            .map(|provider| {
-                info!(message = "Loaded openssl provider.", provider = provider_name);
-                provider
-            })
-            .map_err(|error| {
-                error!(message = "Failed to load openssl provider.", provider = provider_name, %error);
-                exitcode::UNAVAILABLE
-            })
-    }).collect()
-}

src/cli.rs

@@ -198,18 +198,6 @@ pub struct RootOpts {
     )]
     pub allocation_tracing_reporting_interval_ms: u64,
 
-    /// Load the OpenSSL legacy provider.
-    #[arg(
-        long,
-        env = "VECTOR_OPENSSL_LEGACY_PROVIDER",
-        default_value = "true",
-        default_missing_value = "true",
-        num_args = 0..=1,
-        require_equals = true,
-        action = ArgAction::Set
-    )]
-    pub openssl_legacy_provider: bool,
-
     /// Disable probing and configuration of root certificate locations on the system for OpenSSL.
     ///
     /// The probe functionality manipulates the `SSL_CERT_FILE` and `SSL_CERT_DIR` environment variables

website/cue/reference/components/sinks.cue

@@ -644,7 +644,9 @@ components: sinks: [Name=string]: {
 					title: "Transport Layer Security (TLS)"
 					body:  """
 						Vector uses [OpenSSL](\(urls.openssl)) for TLS protocols due to OpenSSL's maturity. You can
-						enable and adjust TLS behavior using the [`tls.*`](#tls) options.
+						enable and adjust TLS behavior via the [`tls.*`](#tls) options and/or via the 
+						[OpenSSL configuration options](\(urls.openssl_conf)) exposed through environment variables, 
+						particularly `OPENSSL_CONF`.
 						"""
 				}
 			}

website/cue/reference/components/sources.cue

@@ -356,9 +356,11 @@ components: sources: [Name=string]: {
 		_tls: {
 			title: "Transport Layer Security (TLS)"
 			body:  """
-				  Vector uses [OpenSSL](\(urls.openssl)) for TLS protocols. You can
-				  adjust TLS behavior via the `tls.*` options.
-				  """
+				Vector uses [OpenSSL](\(urls.openssl)) for TLS protocols due to OpenSSL's maturity. You can
+				enable and adjust TLS behavior via the `tls.*` options and/or via the 
+				[OpenSSL configuration options](\(urls.openssl_conf)) exposed through environment variables, 
+				particularly `OPENSSL_CONF`.
+				"""
 		}
 
 		if features.collect != _|_ {

website/cue/reference/components/sources/opentelemetry.cue

@@ -198,9 +198,11 @@ components: sources: opentelemetry: {
 		tls: {
 			title: "Transport Layer Security (TLS)"
 			body:  """
-				  Vector uses [OpenSSL](\(urls.openssl)) for TLS protocols. You can
-				  adjust TLS behavior via the `grpc.tls.*` and `http.tls.*` options.
-				  """
+				Vector uses [OpenSSL](\(urls.openssl)) for TLS protocols due to OpenSSL's maturity. You can
+				enable and adjust TLS behavior via the `grpc.tls.*` and `http.tls.*` options and/or via the 
+				[OpenSSL configuration options](\(urls.openssl_conf)) exposed through environment variables, 
+				particularly `OPENSSL_CONF`.
+				"""
 		}
 	}
 }

website/cue/reference/urls.cue

@@ -383,6 +383,7 @@ urls: {
 	nixos:                                      "https://nixos.org/"
 	nixpkgs_9682:                               "\(github)/NixOS/nixpkgs/issues/9682"
 	openssl:                                    "https://www.openssl.org/"
+	openssl_conf:                               "https://www.openssl.org/docs/manmaster/man5/config.html"
 	opentelemetry:                              "https://opentelemetry.io"
 	opentelemetry_protocol:                     "\(opentelemetry)/docs/reference/specification/protocol/otlp/"
 	order_of_ops:                               "\(wikipedia)/wiki/Order_of_operations"