Skip to content

Commit

Permalink
feat(cli): Include the platform's CA certificates in reqwest's TLS/SS…
Browse files Browse the repository at this point in the history
…L trust store

Previously, the platform's trust store was ignored in favor of a baked
in and unconfigurable trust store provided by webpki-roots.  Now the
reqwest trust store will contain both certs obtained from the platform
at run time as well as certs baked in via webpki-roots.

Obtaining certs from the platform means that Nextclade will respect
OS-level configuration to trust private CAs / self-signed certs.
Keeping webpki-roots for all platforms is a precaution that makes this
change merely additive for backwards compatibility, in case of platforms
which lack a trust store (like some Linux containers) or platforms with
out-of-date trust stores.  It means that Nextclade binaries should
continue to Just Work™.

reqwest uses rustls-native-roots to obtain trusted CA certificates from
the standard trust stores for the OS/platform.  See the crate's
documentation for details on each platform.¹  Notably, this does not use
the platform's standard certificate verification methods like
rustls-platform-verifier; it just extracts certificates.  We may in the
future want to switch to rustls-platform-verifier (ourselves or by
waiting for reqwest to do so).

Updates reqwest because an earlier (but problematic and now reverted²)
change did so and there were some public API changes I'd like to use.
Updates wasm-bindgen as necessary for the newer reqwest (≥0.2.89) and
then a little further (0.2.93) to avoid Clippy warnings.³

¹ <https://docs.rs/crate/rustls-native-certs/0.8.0>
² <#1529 (comment)>.
³ <rustwasm/wasm-bindgen#3985>

Resolves: <#726>
Related-to: <#1529>
Related-to: <#1527>
  • Loading branch information
tsibley committed Oct 16, 2024
1 parent 682d144 commit 80d8f83
Show file tree
Hide file tree
Showing 2 changed files with 392 additions and 149 deletions.
Loading

0 comments on commit 80d8f83

Please sign in to comment.