RSCBC-265: Replace rustls-pemfile with rustls-pki-types

[chvck]

No description provided.

[Copilot]

Pull request overview

Updates the Rust SDK’s TLS/PEM handling to remove the rustls-pemfile dependency and use rustls-pki-types instead, aligning certificate/key parsing with rustls’ newer PKI type APIs.

Changes:

• Swaps the rustls-tls feature dependency from rustls-pemfile to rustls-pki-types.
• Updates Capella root CA loading logic in the rustls trust-store setup.
• Updates the mTLS authenticator rustdoc example to use rustls-pki-types parsing APIs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
sdk/couchbase/src/options/cluster_options.rs	Adjusts rustls TLS trust-store setup, including Capella root CA parsing.
sdk/couchbase/src/authenticator.rs	Updates documentation example for certificate-based authentication parsing.
sdk/couchbase/Cargo.toml	Replaces rustls-pemfile dependency/feature wiring with rustls-pki-types.

Comments suppressed due to low confidence (1)

sdk/couchbase/src/options/cluster_options.rs:576

• CAPELLA_CERT is a PEM-encoded certificate string (see capella_ca.rs), but this code uses CertificateDer::from_slice(CAPELLA_CERT.as_bytes()), which is intended for DER bytes. This will either fail to parse or treat the PEM text as DER, so Capella root CA won’t be added correctly. Use the rustls-pki-types PEM parsing iterator (e.g., the CertificateDer PEM slice/reader iterator) to extract one or more CertificateDer values from the PEM text before calling add_parsable_certificates.

                debug!("Adding Capella root CA to trust store");
                let certs = CertificateDer::from_slice(CAPELLA_CERT.as_bytes())
                    .map(|item| {
                        item.map_err(|e| {
                            error::Error::other_failure(format!("failed to add capella cert: {e}"))
                        })
                    })
                    .collect::<error::Result<Vec<CertificateDer>>>()?;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

sdk/couchbase/src/options/cluster_options.rs:43

• SectionKind and PrivateKeyDer are imported under the rustls-tls cfg but are not used anywhere in this module (only CertificateDer/RootCertStore are used in the TLS config path). Consider removing these unused imports to keep the cfg import block minimal.

    tokio_rustls::rustls::pki_types::pem::{PemObject, SectionKind},
    tokio_rustls::rustls::pki_types::{CertificateDer, PrivateKeyDer},
    tokio_rustls::rustls::RootCertStore,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[github-actions]

Bencher Report

Branch	rscbc265-22866583662-138-1
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result microseconds (µs) (Result Δ%)	Upper Boundary microseconds (µs) (Limit %)
query	📈 view plot 🚷 view threshold	423.08 µs (+0.90%) Baseline: 419.29 µs	482.18 µs (87.74%)
upsert_and_get	📈 view plot 🚷 view threshold	430.16 µs (+7.88%) Baseline: 398.74 µs	458.56 µs (93.81%)

🐰 View full continuous benchmarking report in Bencher

[github-actions]

Bencher Report

Branch	rscbc265-22866898952-139-1
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result microseconds (µs) (Result Δ%)	Upper Boundary microseconds (µs) (Limit %)
query	📈 view plot 🚷 view threshold	439.58 µs (+4.84%) Baseline: 419.29 µs	482.18 µs (91.16%)
upsert_and_get	📈 view plot 🚷 view threshold	438.18 µs (+9.89%) Baseline: 398.74 µs	458.56 µs (95.56%)

🐰 View full continuous benchmarking report in Bencher

[github-actions]

Bencher Report

Branch	rscbc265-22867156553-141-1
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result microseconds (µs) (Result Δ%)	Upper Boundary microseconds (µs) (Limit %)
query	📈 view plot 🚷 view threshold	450.35 µs (+7.41%) Baseline: 419.29 µs	482.18 µs (93.40%)
upsert_and_get	📈 view plot 🚷 view threshold	419.39 µs (+5.18%) Baseline: 398.74 µs	458.56 µs (91.46%)

🐰 View full continuous benchmarking report in Bencher