upki: add feature fetch-native-tls

.github/workflows/build.yml

@@ -70,6 +70,10 @@ jobs:
         run: cargo test -p revoke-test -p rustls-upki -p upki
       - name: Without features
         run: cargo check --locked -p upki --no-default-features
+      - name: CLI without features
+        run: cargo check --locked -p upki-cli --no-default-features
+      - name: CLI with native-tls
+        run: cargo check --locked -p upki-cli --no-default-features --features fetch-native-tls
 
       - name: Build FFI
         run: cargo cbuild --locked -p upki

Cargo.toml

@@ -23,7 +23,7 @@ http = "1"
 insta = { version = "1.44.3", features = ["filters"] }
 insta-cmd = "0.7"
 openssl-sys = "0.9"
-reqwest = { version = "0.13", default-features = false, features = ["charset", "default-tls", "h2", "http2", "json"] }
+reqwest = { version = "0.13", default-features = false, features = ["charset", "h2", "http2", "json"] }
 rand = "0.10"
 regex = "1.12"
 rustls = { version = "0.23", default-features = false }

revoke-test/Cargo.toml

@@ -6,6 +6,9 @@ edition.workspace = true
 repository.workspace = true
 publish = false
 
+[features]
+__bench_codspeed = ["dep:codspeed-criterion-compat"]
+
 [dependencies]
 aws-lc-rs.workspace = true
 base64.workspace = true
@@ -32,9 +35,6 @@ upki = { path = "../upki", features = ["capi", "fetch"] }
 openssl-sys.workspace = true
 upki-openssl = { path = "../upki-openssl" }
 
-[features]
-__bench_codspeed = ["dep:codspeed-criterion-compat"]
-
 [[bench]]
 name = "bench"
 harness = false

upki-cli/Cargo.toml

@@ -8,11 +8,17 @@ license.workspace = true
 readme = "README.md"
 description = "Platform-independent browser-grade certificate infrastructure"
 
+[features]
+default = ["fetch"]
+fetch = ["upki/fetch", "__fetch"]
+fetch-native-tls = ["upki/fetch-native-tls", "__fetch"]
+__fetch = ["upki/__fetch"]
+
 [dependencies]
 clap.workspace = true
 eyre.workspace = true
 rustls-pki-types.workspace = true
-upki = { version = "=1.0.0-beta.2", path = "../upki", features = ["fetch"] }
+upki = { version = "=1.0.0-beta.2", path = "../upki" }
 tokio.workspace = true
 toml.workspace = true
 tracing.workspace = true

upki-cli/src/bin/upki.rs

@@ -12,7 +12,9 @@ use tracing::level_filters::LevelFilter;
 use tracing_subscriber::EnvFilter;
 use tracing_subscriber::layer::SubscriberExt;
 use tracing_subscriber::util::SubscriberInitExt;
-use upki::revocation::{Index, Manifest, RevocationCheckInput, fetch};
+use upki::revocation::{Index, RevocationCheckInput};
+#[cfg(feature = "__fetch")]
+use upki::revocation::{Manifest, fetch};
 use upki::{Config, ConfigPath};
 
 #[tokio::main(flavor = "current_thread")]
@@ -44,7 +46,9 @@ async fn main() -> Result<ExitCode, Report> {
     let config = Config::from_file_or_user_default(&config_path)?;
 
     Ok(match args.command {
+        #[cfg(feature = "__fetch")]
         Command::Fetch { dry_run } => fetch(dry_run, &config).await?,
+        #[cfg(feature = "__fetch")]
         Command::Verify => Manifest::from_config(&config)?.verify(&config)?,
         Command::ShowConfigPath => unreachable!(),
         Command::ShowConfig => {
@@ -93,6 +97,7 @@ enum Command {
     /// If the `revocation.cache_dir` path does not exist, this tool creates it and parent directories.
     ///
     /// This also deletes filters that become unreferenced.
+    #[cfg(feature = "__fetch")]
     Fetch {
         /// Download the new manifest, and then describe what actions are needed to
         /// synchronize with the remote server.
@@ -107,6 +112,7 @@ enum Command {
     /// Exits non-zero if the manifest if any filter file is missing or corrupt.
     ///
     /// This command does no network I/O.  It does not say anything whether the files are up-to-date or recent.
+    #[cfg(feature = "__fetch")]
     Verify,
 
     /// Checks the revocation status of a certificate.

upki-mirror/Cargo.toml

@@ -12,7 +12,7 @@ clap.workspace = true
 csv.workspace = true
 eyre.workspace = true
 hex.workspace = true
-reqwest.workspace = true
+reqwest = { workspace = true, features = ["default-tls"] }
 rustls-pki-types.workspace = true
 serde.workspace = true
 serde_json.workspace = true

upki-openssl/Cargo.toml

@@ -6,6 +6,9 @@ rust-version.workspace = true
 edition.workspace = true
 repository.workspace = true
 
+[features]
+capi = []
+
 [dependencies]
 openssl-sys = { workspace = true }
 rustls-pki-types.workspace = true
@@ -18,9 +21,6 @@ similar-asserts.workspace = true
 [lints]
 workspace = true
 
-[features]
-capi = []
-
 [package.metadata.capi.header]
 generation = false
 

upki/Cargo.toml

@@ -8,6 +8,13 @@ license.workspace = true
 readme = "README.md"
 description = "Platform-independent browser-grade certificate infrastructure"
 
+[features]
+default = []
+capi = []
+fetch = ["reqwest/default-tls", "__fetch"]
+fetch-native-tls = ["reqwest/native-tls", "__fetch"]
+__fetch = ["dep:reqwest", "dep:serde_json", "dep:tempfile"]
+
 [dependencies]
 base64.workspace = true
 chrono.workspace = true
@@ -28,11 +35,6 @@ cbindgen.workspace = true
 similar-asserts.workspace = true
 tempfile.workspace = true
 
-[features]
-default = []
-capi = []
-fetch = ["dep:reqwest", "dep:serde_json", "dep:tempfile"]
-
 [lints]
 workspace = true
 

upki/src/revocation/fetch.rs

@@ -38,8 +38,12 @@ pub async fn fetch(dry_run: bool, config: &Config) -> Result<ExitCode, Error> {
     );
 
     let manifest_url = format!("{}{MANIFEST_JSON}", config.revocation.fetch_url);
-    let client = reqwest::Client::builder()
-        .use_rustls_tls()
+    #[cfg(feature = "fetch")]
+    let builder = reqwest::Client::builder().use_rustls_tls();
+    #[cfg(all(feature = "fetch-native-tls", not(feature = "fetch")))]
+    let builder = reqwest::Client::builder().use_native_tls();
+
+    let client = builder
         .timeout(Duration::from_secs(REQUEST_TIMEOUT))
         .user_agent(format!(
             "{}/{} ({})",

upki/src/revocation/index.rs

@@ -1,18 +1,18 @@
 use core::cmp::Ordering;
 use core::{fmt, str};
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use std::collections::BTreeMap;
 use std::fs::{self, File};
 use std::io::{Read, Seek, SeekFrom};
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use std::path::Path;
 use std::path::PathBuf;
 
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use clubcard_crlite::TimestampInterval;
 use clubcard_crlite::{CRLiteClubcard, CRLiteStatus, LogId, Timestamp};
 
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use super::Manifest;
 use super::{Error, RevocationCheckInput, RevocationStatus};
 use crate::Config;
@@ -102,7 +102,7 @@ impl Index {
     /// Build index bytes by reading filter files from `dir` and extracting universe metadata.
     ///
     /// Returns `None` if any filter file cannot be read or decoded.
-    #[cfg(feature = "fetch")]
+    #[cfg(feature = "__fetch")]
     pub(super) fn write(manifest: &Manifest, dir: &Path) -> Option<Vec<u8>> {
         let mut by_log_id: BTreeMap<LogId, Vec<(u8, TimestampInterval)>> = BTreeMap::new();
 

upki/src/revocation/mod.rs

@@ -1,10 +1,10 @@
 use core::error::Error as StdError;
 use core::str::FromStr;
 use core::{fmt, str};
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use std::fs::File;
 use std::io;
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use std::io::BufReader;
 use std::path::PathBuf;
 use std::process::ExitCode;
@@ -18,15 +18,15 @@ use rustls_pki_types::{CertificateDer, TrustAnchor};
 use serde::{Deserialize, Serialize};
 use tracing::info;
 
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use crate::Config;
 use crate::sha256;
 
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 mod fetch;
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 use fetch::Plan;
-#[cfg(feature = "fetch")]
+#[cfg(feature = "__fetch")]
 pub use fetch::fetch;
 
 mod index;
@@ -50,7 +50,7 @@ pub struct Manifest {
 
 impl Manifest {
     /// Load the revocation manifest from the cache directory specified in the configuration.
-    #[cfg(feature = "fetch")]
+    #[cfg(feature = "__fetch")]
     pub fn from_config(config: &Config) -> Result<Self, Error> {
         let mut file_name = config.revocation_cache_dir();
         file_name.push("manifest.json");
@@ -74,7 +74,7 @@ impl Manifest {
     /// Verify the current contents of the cache against this manifest.
     ///
     /// This performs disk IO but does not perform network IO.
-    #[cfg(feature = "fetch")]
+    #[cfg(feature = "__fetch")]
     pub fn verify(&self, config: &Config) -> Result<ExitCode, Error> {
         self.introduce()?;
         let plan = Plan::construct(self, &None, "https://.../", &config.revocation_cache_dir())?;