codex_utils_rustls_provider/
lib.rs

1use std::sync::Once;
2
3const REQUIRED_SIGNATURE_SCHEME: rustls::SignatureScheme =
4    rustls::SignatureScheme::ECDSA_NISTP521_SHA512;
5
6/// Ensures a process-wide rustls crypto provider is installed.
7///
8/// rustls cannot auto-select a provider when both `ring` and `aws-lc-rs`
9/// features are enabled in the dependency graph.
10pub fn ensure_rustls_crypto_provider() {
11    static RUSTLS_PROVIDER_INIT: Once = Once::new();
12    RUSTLS_PROVIDER_INIT.call_once(|| {
13        // aws-lc-rs supports a broader WebPKI signature set than ring, including
14        // ECDSA P-521/SHA-512 certs used by some enterprise TLS proxies.
15        if rustls::crypto::aws_lc_rs::default_provider()
16            .install_default()
17            .is_err()
18        {
19            // Preserve the previous best-effort behavior for embedded hosts that
20            // install a process-global provider before Codex can install one.
21            return;
22        }
23
24        let Some(provider) = rustls::crypto::CryptoProvider::get_default() else {
25            panic!("aws-lc-rs rustls crypto provider should be installed");
26        };
27        assert!(
28            provider_supports_required_signature_scheme(provider),
29            "installed rustls crypto provider must support {REQUIRED_SIGNATURE_SCHEME:?}"
30        );
31    });
32}
33
34fn provider_supports_required_signature_scheme(provider: &rustls::crypto::CryptoProvider) -> bool {
35    provider
36        .signature_verification_algorithms
37        .supported_schemes()
38        .contains(&REQUIRED_SIGNATURE_SCHEME)
39}
codex_utils_rustls_provider/lib.rs

codex_utils_rustls_provider/
lib.rs
