Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(cli): Include the platform's CA certificates in reqwest's TLS/SS…
…L trust store Previously, the platform's trust store was ignored in favor of a baked in and unconfigurable trust store provided by webpki-roots. Now the reqwest trust store will contain both certs obtained from the platform at run time as well as certs baked in via webpki-roots. Obtaining certs from the platform means that Nextclade will respect OS-level configuration to trust private CAs / self-signed certs. Keeping webpki-roots for all platforms is a precaution that makes this change merely additive for backwards compatibility, in case of platforms which lack a trust store (like some Linux containers) or platforms with out-of-date trust stores. It means that Nextclade binaries should continue to Just Work™. reqwest uses rustls-native-roots to obtain trusted CA certificates from the standard trust stores for the OS/platform. See the crate's documentation for details on each platform.¹ Notably, this does not use the platform's standard certificate verification methods like rustls-platform-verifier; it just extracts certificates. We may in the future want to switch to rustls-platform-verifier (ourselves or by waiting for reqwest to do so). Updates reqwest because an earlier (but problematic and now reverted²) change did so and there were some public API changes I'd like to use. Updates wasm-bindgen as necessary for the newer reqwest (≥0.2.89) and then a little further (0.2.93) to avoid Clippy warnings.³ ¹ <https://docs.rs/crate/rustls-native-certs/0.8.0> ² <#1529 (comment)>. ³ <rustwasm/wasm-bindgen#3985> Resolves: <#726> Related-to: <#1529> Related-to: <#1527>
- Loading branch information