-
Notifications
You must be signed in to change notification settings - Fork 64
Commit 80d8f83
committed
feat(cli): Include the platform's CA certificates in reqwest's TLS/SSL trust store
Previously, the platform's trust store was ignored in favor of a baked
in and unconfigurable trust store provided by webpki-roots. Now the
reqwest trust store will contain both certs obtained from the platform
at run time as well as certs baked in via webpki-roots.
Obtaining certs from the platform means that Nextclade will respect
OS-level configuration to trust private CAs / self-signed certs.
Keeping webpki-roots for all platforms is a precaution that makes this
change merely additive for backwards compatibility, in case of platforms
which lack a trust store (like some Linux containers) or platforms with
out-of-date trust stores. It means that Nextclade binaries should
continue to Just Work™.
reqwest uses rustls-native-roots to obtain trusted CA certificates from
the standard trust stores for the OS/platform. See the crate's
documentation for details on each platform.¹ Notably, this does not use
the platform's standard certificate verification methods like
rustls-platform-verifier; it just extracts certificates. We may in the
future want to switch to rustls-platform-verifier (ourselves or by
waiting for reqwest to do so).
Updates reqwest because an earlier (but problematic and now reverted²)
change did so and there were some public API changes I'd like to use.
Updates wasm-bindgen as necessary for the newer reqwest (≥0.2.89) and
then a little further (0.2.93) to avoid Clippy warnings.³
¹ <https://docs.rs/crate/rustls-native-certs/0.8.0>
² <#1529 (comment)>.
³ <rustwasm/wasm-bindgen#3985>
Resolves: <#726>
Related-to: <#1529>
Related-to: <#1527>1 parent 682d144 commit 80d8f83Copy full SHA for 80d8f83
File tree
Expand file treeCollapse file tree
2 files changed
+392
-149
lines changedFilter options
Expand file treeCollapse file tree
2 files changed
+392
-149
lines changed
0 commit comments