lfsx_server/tls.rs
1// rustls needs a process-wide crypto provider before the first TLS connection,
2// and reqwest is built without one on purpose so the choice is this project's
3// rather than whatever the default happens to be in a given release. ring is
4// what 0.12 used; aws-lc, the new default, wants a C toolchain at build time on
5// exactly the musl and cross-compiled aarch64 targets the releases ship.
6//
7// It goes where the clients are built rather than in `main`, because `app()` is
8// a library entry point: anything that builds a client without going through a
9// binary would otherwise panic on its first request.
10pub fn install_crypto_provider() {
11 static ONCE: std::sync::Once = std::sync::Once::new();
12
13 ONCE.call_once(|| {
14 // An error here means something already installed one, which is an
15 // embedder's decision to make and not ours to override.
16 let _ = rustls::crypto::ring::default_provider().install_default();
17 });
18}