feat(deps): switch reqwest to rustls workspace-wide, drop openssl

Author: NathanFlurry

Cargo.lock

@@ -101,7 +101,7 @@ members = [
   http = "1.3.1"
   http-body = "1.0.0"
   http-body-util = "0.1.1"
-  hyper-tls = "0.6.0"
+  hyper-rustls = { version = "0.27.7", default-features = false, features = [ "http1", "http2", "native-tokio", "webpki-tokio", "ring" ] }
   hyper-tungstenite = "0.17.0"
   include_dir = "0.7.4"
   indoc = "2.0.5"
@@ -297,7 +297,8 @@ members = [
 
     [workspace.dependencies.reqwest]
     version = "0.12.22"
-    features = [ "json" ]
+    default-features = false
+    features = [ "json", "rustls-tls-native-roots", "rustls-tls-webpki-roots" ]
 
     [workspace.dependencies.schemars]
     version = "0.8.21"

Cargo.toml

@@ -16,7 +16,7 @@ http-body.workspace = true
 http.workspace = true
 # TODO: Make this use workspace version
 hyper = { version = "1.6.0", features = ["full", "http1", "http2"] }
-hyper-tls.workspace = true
+hyper-rustls.workspace = true
 hyper-tungstenite.workspace = true
 hyper-util = { workspace = true, features = ["full"] }
 indoc.workspace = true
@@ -48,4 +48,4 @@ futures-util.workspace = true
 futures.workspace = true
 reqwest.workspace = true
 tokio-stream.workspace = true
-uuid.workspace = true
+uuid.workspace = true

engine/packages/guard-core/Cargo.toml

@@ -52,7 +52,7 @@ pub struct ProxyState {
 	// NOTE: Using the hyper legacy client is the only option currently.
 	// This is what reqwest uses under the hood. Eventually we'll migrate to h3 once it's ready.
 	client: Client<
-		hyper_tls::HttpsConnector<hyper_util::client::legacy::connect::HttpConnector>,
+		hyper_rustls::HttpsConnector<hyper_util::client::legacy::connect::HttpConnector>,
 		Full<Bytes>,
 	>,
 	route_cache: RouteCache,
@@ -70,7 +70,22 @@ impl ProxyState {
 		routing_fn: RoutingFn,
 		cache_key_fn: CacheKeyFn,
 	) -> Self {
-		let https_connector = hyper_tls::HttpsConnector::new();
+		let https_connector_builder =
+			match hyper_rustls::HttpsConnectorBuilder::new().with_native_roots() {
+				Ok(builder) => builder,
+				Err(err) => {
+					tracing::warn!(
+						?err,
+						"failed to load native TLS roots; falling back to webpki roots"
+					);
+					hyper_rustls::HttpsConnectorBuilder::new().with_webpki_roots()
+				}
+			};
+		let https_connector = https_connector_builder
+			.https_or_http()
+			.enable_http1()
+			.enable_http2()
+			.build();
 		let client = Client::builder(TokioExecutor::new())
 			.pool_idle_timeout(Duration::from_secs(30))
 			.build(https_connector);

engine/packages/guard-core/src/proxy_service.rs

@@ -11,7 +11,7 @@ async-nats.workspace = true
 clickhouse.workspace = true
 futures-util.workspace = true
 governor.workspace = true
-hyper-tls.workspace = true
+hyper-rustls.workspace = true
 hyper-util.workspace = true
 lazy_static.workspace = true
 reqwest.workspace = true
@@ -33,4 +33,3 @@ uuid.workspace = true
 
 [dev-dependencies]
 divan.workspace = true
-

engine/packages/pools/Cargo.toml

@@ -14,7 +14,22 @@ pub fn setup(config: &Config) -> Result<Option<ClickHousePool>> {
 		let mut http_connector = hyper_util::client::legacy::connect::HttpConnector::new();
 		http_connector.enforce_http(false);
 		http_connector.set_keepalive(Some(Duration::from_secs(15)));
-		let https_connector = hyper_tls::HttpsConnector::new_with_connector(http_connector);
+		let https_connector_builder =
+			match hyper_rustls::HttpsConnectorBuilder::new().with_native_roots() {
+				std::result::Result::Ok(builder) => builder,
+				std::result::Result::Err(err) => {
+					tracing::warn!(
+						?err,
+						"failed to load native TLS roots; falling back to webpki roots"
+					);
+					hyper_rustls::HttpsConnectorBuilder::new().with_webpki_roots()
+				}
+			};
+		let https_connector = https_connector_builder
+			.https_or_http()
+			.enable_http1()
+			.enable_http2()
+			.wrap_connector(http_connector);
 		let http_client =
 			hyper_util::client::legacy::Client::builder(hyper_util::rt::TokioExecutor::new())
 				.pool_idle_timeout(Duration::from_secs(2))

engine/packages/pools/src/db/clickhouse.rs

@@ -32,14 +32,3 @@ napi-build = "2"
 
 [dev-dependencies]
 serde_bare.workspace = true
-
-# Statically link openssl on all Linux targets. transitive openssl-sys (via
-# reqwest/native-tls pulled in by opentelemetry-http) would otherwise pick up
-# whatever libssl the builder image happens to ship, and the resulting `.node`
-# inherits a NEEDED libssl.so.X runtime dependency that breaks on hosts with a
-# different openssl (e.g. linking to libssl.so.1.1 on Debian bullseye breaks on
-# Debian bookworm / Ubuntu 22.04+). Vendoring compiles openssl from source and
-# static-links it into the addon. darwin uses Security.framework and windows
-# uses schannel, so they don't need this.
-[target.'cfg(target_os = "linux")'.dependencies]
-openssl = { version = "0.10", features = ["vendored"] }