try fix

Author: flip1995

Cargo.lock

@@ -92,6 +92,7 @@ reqwest = { version = "0.13", features = [
   "rustls",
   "hickory-dns",
 ], optional = true }
+rustls-native-certs = { version = "0.8", optional = true }
 semver = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = ">=1.0, <1.0.147" # zmij (used in 1.0.147+) requires Rust 1.84+
@@ -204,6 +205,7 @@ dist-client = [
   "reqwest",
   "url",
   "sha2",
+  "rustls-native-certs",
 ]
 # Enables the sccache-dist binary
 dist-server = [
@@ -216,6 +218,7 @@ dist-server = [
   "rouille",
   "syslog",
   "version-compare",
+  "rustls-native-certs",
 ]
 # Enables dist tests with external requirements
 dist-tests = ["dist-client", "dist-server"]

Cargo.toml

@@ -367,8 +367,8 @@ mod server {
 
         // Finish the certificate
         builder
-            .sign(&privkey, openssl::hash::MessageDigest::sha1())
-            .context("failed to sign x509 with sha1")?;
+            .sign(&privkey, openssl::hash::MessageDigest::sha256())
+            .context("failed to sign x509 with sha256")?;
         let cert: openssl::x509::X509 = builder.build();
         let cert_pem = cert.to_pem().context("failed to create pem from x509")?;
         let cert_digest = cert

src/dist/http.rs

@@ -990,7 +990,14 @@ pub fn daemonize() -> Result<()> {
 /// More details could be found at https://github.com/mozilla/sccache/pull/1563
 #[cfg(any(feature = "dist-server", feature = "dist-client"))]
 pub fn new_reqwest_blocking_client() -> reqwest::blocking::Client {
-    reqwest::blocking::Client::builder()
+    let mut builder = reqwest::blocking::Client::builder();
+
+    // Query the native store; fallback if it's completely empty
+    if rustls_native_certs::load_native_certs().certs.is_empty() {
+        builder = builder.tls_certs_only(Vec::new());
+    }
+
+    builder
         .pool_max_idle_per_host(0)
         .build()
         .expect("http client must build with success")