k-ap 0.5.1; reqwest ring-only, sqlx no tls; bootstrap installs ring provider

crates/bootstrap/Cargo.toml

@@ -37,12 +37,14 @@ tokio = { workspace = true }
 futures = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 
 nats = { workspace = true, optional = true }
 activitypub = { workspace = true, optional = true }
 sqlite-federation = { workspace = true, optional = true }
 
 [dev-dependencies]
+reqwest = { workspace = true }
 chrono = { workspace = true }
 uuid = { workspace = true }
 serde_json = { workspace = true }

crates/bootstrap/src/lib.rs

@@ -13,11 +13,13 @@ mod follow_backfill_handler;
 pub mod outbox_relay;
 pub mod repositories;
 mod server;
+mod tls;
 mod tracing_setup;
 mod worker;
 
 pub use build::build_deps;
 pub use repositories::Repositories;
 pub use server::{ServerApp, build_server, build_server_on};
+pub use tls::install_crypto_provider;
 pub use tracing_setup::init_tracing;
 pub use worker::{WorkerApp, build_worker, build_worker_on};

crates/bootstrap/src/server.rs

@@ -54,6 +54,7 @@ async fn assemble(
     db: DatabaseOutput,
     instance: InstanceIdentity,
 ) -> anyhow::Result<axum::Router> {
+    crate::tls::install_crypto_provider();
     let app_config = AppSettings::from(config);
 
     let (auth_service, password_hasher) = database::build_auth_adapters(&config.auth)?;

crates/bootstrap/src/tls.rs

@@ -0,0 +1,34 @@
+//! Process-wide rustls crypto provider.
+//!
+//! Every HTTPS client in the graph (reqwest, object_store, async-nats,
+//! k-ap) is built without a bundled provider so the binaries link `ring`
+//! only. rustls therefore needs one installed before the first client is
+//! built, or client construction panics.
+
+use std::sync::Once;
+
+/// Installs `ring` as the process default. Idempotent; a provider installed
+/// earlier by someone else is left in place.
+pub fn install_crypto_provider() {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Runs alone in the lib test binary, so no other code (k-ap included)
+    /// has installed a provider first.
+    #[test]
+    fn https_client_builds_after_install() {
+        install_crypto_provider();
+        install_crypto_provider();
+        reqwest::Client::builder()
+            .build()
+            .expect("reqwest client builds");
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+    }
+}

crates/bootstrap/src/worker.rs

@@ -99,6 +99,7 @@ async fn assemble(
     db: DatabaseOutput,
     #[cfg_attr(not(feature = "federation"), allow(unused_variables))] instance: InstanceIdentity,
 ) -> anyhow::Result<WorkerApp> {
+    crate::tls::install_crypto_provider();
     let metadata_client = metadata::create(&config.metadata)?;
     let poster_fetcher = poster_fetcher::create(&config.metadata)?;
     let object_storage = object_storage::create(&config.storage)?;