k-ap 0.5.1; reqwest ring-only, sqlx no tls; bootstrap installs ring provider

crates/bootstrap/src/tls.rs

@@ -0,0 +1,34 @@
+//! Process-wide rustls crypto provider.
+//!
+//! Every HTTPS client in the graph (reqwest, object_store, async-nats,
+//! k-ap) is built without a bundled provider so the binaries link `ring`
+//! only. rustls therefore needs one installed before the first client is
+//! built, or client construction panics.
+
+use std::sync::Once;
+
+/// Installs `ring` as the process default. Idempotent; a provider installed
+/// earlier by someone else is left in place.
+pub fn install_crypto_provider() {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Runs alone in the lib test binary, so no other code (k-ap included)
+    /// has installed a provider first.
+    #[test]
+    fn https_client_builds_after_install() {
+        install_crypto_provider();
+        install_crypto_provider();
+        reqwest::Client::builder()
+            .build()
+            .expect("reqwest client builds");
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+    }
+}