Exclude bad test keys from the published package

[weiznich]

During a dependency review I noticed that tokio-rustls includes bad test keys in the binary pem format in the published packages. These files are not required for building tokio-rustls and make it harder to review the code.

This commit explicitly excludes these files from the published package. Before this change cargo package reported a size of 22 files, 137.1KiB (34.6KiB compressed). After this change it reports a size of 14 files, 110.6KiB (27.3KiB compressed), so this is only a rather minimal size reduction. Nevertheless given the current number of 17 million downloads per month that would result in a 118 GB/month traffic reduction for crates.io. For me personally the exclusion of the binary files is the more important outcome.

[djc]

Makes sense to me. Should we also exclude any tests that rely on these? It seems bad to ship known-broken tests.

[weiznich]

That might be a good idea, on the other hand the only group that I'm aware of running these tests are package maintainers from linux distributions and at least one of them expressed that they prefer ignoring tests with missing files to removed tests.

I personally would exclude all tests as the large majority of downloads will never ever touch the tests at all.

[djc]

That might be a good idea, on the other hand the only group that I'm aware of running these tests are package maintainers from linux distributions and at least one of them expressed that they prefer ignoring tests with missing files to removed tests.

They said:

EDIT: As an aside, fixing up tests that are broken or missing is much more work for us than just skipping some tests that don't work because of missing data / input files - the latter can very easily be worked around by passing appropriate --skip arguments to cargo test.

Which doesn't exactly compare "ignoring tests with missing files" to "removed tests".

[weiznich]

That's correct, but that still doesn't tell me what you want:

Do you want all tests to be removed or just the broken ones? For the second case: Which tests would be broken by excluding these keys?

[djc]

Let's wait for feedback from other maintainers. Personally, I agree with Sean's take that the tests are mostly for development/CI and shouldn't really be important to downstream distributors.