{"record":{"id":"9d73d176b3c62432","repo":"cloudflare/quiche","slug":"can-t-use-rpk-when-compiled-without-rpk-feature","errorCode":null,"errorMessage":"Can't use RPK when compiled without rpk feature","messagePattern":"Can't use RPK when compiled without rpk feature","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tokio-quiche/src/settings/config.rs","lineNumber":240,"sourceCode":"    if should_log_keys {\n        config.log_keys();\n    }\n\n    Ok(config)\n}\n\nfn quiche_config_with_tls(\n    tls_cert: Option<TlsCertificatePaths>,\n) -> QuicResult<quiche::Config> {\n    let Some(tls) = tls_cert else {\n        return Ok(quiche::Config::new(quiche::PROTOCOL_VERSION).unwrap());\n    };\n\n    match tls.kind {\n        #[cfg(not(feature = \"rpk\"))]\n        CertificateKind::RawPublicKey => {\n            // TODO: Gate this variant on the `rpk` feature.\n            panic!(\"Can't use RPK when compiled without rpk feature\");\n        },\n        #[cfg(feature = \"rpk\")]\n        CertificateKind::RawPublicKey => {\n            let mut ssl_ctx_builder = boring::ssl::SslContextBuilder::new_rpk()?;\n            let raw_public_key = read_file(tls.cert)?;\n            ssl_ctx_builder.set_rpk_certificate(&raw_public_key)?;\n\n            let raw_private_key = read_file(tls.private_key)?;\n            let pkey =\n                boring::pkey::PKey::private_key_from_pem(&raw_private_key)?;\n            ssl_ctx_builder.set_null_chain_private_key(&pkey)?;\n\n            Ok(quiche::Config::with_boring_ssl_ctx_builder(\n                quiche::PROTOCOL_VERSION,\n                ssl_ctx_builder,\n            )?)\n        },\n        CertificateKind::X509 => {","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/cloudflare/quiche/blob/9f96daa2c22a4468b0036fb0a0a3894eee6498b8/tokio-quiche/src/settings/config.rs#L222-L258","documentation":"tokio-quiche's quiche_config_with_tls panics when a TlsConfig with CertificateKind::RawPublicKey is used but the crate was compiled without the \"rpk\" feature. Raw public key TLS requires the BoringSSL RPK API, which is only compiled in behind the feature flag, so the configuration cannot be honored at runtime.","triggerScenarios":"Building tokio-quiche without --features rpk (default) and then supplying settings::TlsConfig with kind: CertificateKind::RawPublicKey, e.g. via make_quiche_config at server/client startup.","commonSituations":"Deploying a binary built with default features to an environment configured for raw public key certs; copying TLS config (YAML/env) that enables RPK into a build lacking the feature; CI builds that omit the feature flag used in production.","solutions":["Rebuild with the feature enabled: add \"rpk\" to tokio-quiche's features (cargo build --features rpk or add it under [features] in your crate that depends on tokio-quiche)","Switch the TlsConfig to a standard CertificateKind (e.g. X.509 certificate/key paths) if RPK is not actually needed","Fail fast at config-parse time by validating tls.kind against compiled features before calling make_quiche_config"],"exampleFix":"// Cargo.toml\n// before\ntokio-quiche = \"0.x\"\n// after\ntokio-quiche = { version = \"0.x\", features = [\"rpk\"] }","handlingStrategy":"validation","validationCode":"// Fail fast before building the quiche config\nif !cfg!(feature = \"rpk\")\n    && matches!(tls.kind, CertificateKind::RawPublicKey)\n{\n    return Err(anyhow!(\n        \"RPK requested but tokio-quiche built without rpk feature\"\n    ));\n}","typeGuard":"fn rpk_supported(tls: &TlsConfig) -> bool {\n    !matches!(tls.kind, CertificateKind::RawPublicKey) || cfg!(feature = \"rpk\")\n}","tryCatchPattern":"// This is a panic, not a Result; avoid it by validating at config load:\nlet config = make_quiche_config(&params)\n    .unwrap_or_else(|e| panic!(\"invalid TLS config: {e}\"));\n// Better: reject RPK configs when the feature is off, before this call.","preventionTips":["Enable the \"rpk\" feature wherever CertificateKind::RawPublicKey is configured","Validate TLS settings at startup, before make_quiche_config","Keep deployment builds' feature flags identical to CI/test builds","Document required features next to any RPK configuration in your service"],"tags":["tokio-quiche","tls","feature-flag","rpk","panic"],"backgroundTag":"feature-not-enabled","analyzedSha":"9f96daa2c22a4468b0036fb0a0a3894eee6498b8","analyzedAt":"2026-09-08T11:27:09.536Z","contentChangedAt":"2026-09-08T11:27:09.536Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}