chore: add clippy rule for reqwest::Client::builder

Author: apiarian-datadog

clippy.toml

@@ -0,0 +1,3 @@
+disallowed-methods = [
+  { path = "reqwest::Client::builder", reason = "prefer the FIPS-compatible adapter", replacement = "datadog_serverless_fips::reqwest_adapter::create_reqwest_client_builder" },
+]

crates/datadog-serverless-fips/README.md

@@ -1,3 +1,12 @@
-# Datadog Serverless FIPS
+# Datadog FIPS for Serverless
 
-A package to support FIPS builds for serverless tools. Currently tested with the datadog-lambda-extension, but it may be useful in other environments.
+A package to support FIPS builds for serverless tools. Currently tested with
+the datadog-lambda-extension, but it may be useful in other environments.
+
+Please add the following to your `clippy.toml`:
+
+```
+disallowed-methods = [
+  { path = "reqwest::Client::builder", reason = "prefer the FIPS-compatible adapter", replacement = "datadog_serverless_fips::reqwest_adapter::create_reqwest_client_builder" },
+]
+```

crates/datadog-serverless-fips/src/reqwest_adapter.rs

@@ -8,7 +8,9 @@ use tracing::debug;
 /// Otherwise, it uses reqwest's default rustls TLS implementation.
 #[cfg(not(feature = "fips"))]
 pub fn create_reqwest_client_builder() -> Result<ClientBuilder, Box<dyn Error>> {
-    // Just return the default builder with rustls TLS
+    // Just return the default builder with rustls TLS. This is the one place we should be okay
+    // to call reqwest::Client::builder().
+    #[allow(clippy::disallowed_methods)]
     Ok(reqwest::Client::builder().use_rustls_tls())
 }
 
@@ -55,5 +57,7 @@ pub fn create_reqwest_client_builder() -> Result<ClientBuilder, Box<dyn Error>>
     }
     debug!("Client builder is configured with FIPS.");
 
+    // This is the one place that it is okay to call reqwest::Client::builder().
+    #[allow(clippy::disallowed_methods)]
     Ok(reqwest::Client::builder().use_preconfigured_tls(config))
 }