hive-forge: pin forgejo-api to 0.11.1 so it shares the workspace reqwest
forgejo-api 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo unifies features per (crate, VERSION) — not per crate. So forgejo-api's internal client was a *second* reqwest, built with neither the workspace's TLS features nor the system trust store, and every https call it made to a gateway name failed `invalid peer certificate: UnknownIssuer` while a client built in this workspace succeeded against the same host. Pinning to 0.11.1 puts one reqwest in the tree, which is what makes the existing "feature unification gives forgejo-api our TLS backend" comment true rather than aspirational — the claim is a fact about the lockfile, so the pin is load-bearing and says so. The reqwest feature list moves with it: `rustls-native-certs` and `webpki-roots` were 0.13.1-era names that no longer exist, and `rustls` now carries the platform verifier (OS trust store, honours SSL_CERT_FILE). Naming a feature that is gone is a hard resolution error rather than a silent no-op, so the list had to change in the same commit as the pin. Refs #3391
This commit is contained in:
atlas
parent
44a50c0df6
commit
74dfd366b4
3 changed files with 45 additions and 83 deletions
89
Cargo.lock
generated
89
Cargo.lock
generated
|
|
@ -1312,18 +1312,18 @@ checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
|
|||
|
||||
[[package]]
|
||||
name = "forgejo-api"
|
||||
version = "0.11.0"
|
||||
version = "0.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "4c51fffa047d5836a4d89179a20b21b7e41ad97e713104752169d819b83c9158"
|
||||
checksum = "e723c70a2a46fe0dbc2c10024218170ad9ca6ce8f98a39cee8032478ab748086"
|
||||
dependencies = [
|
||||
"base64ct",
|
||||
"bytes",
|
||||
"futures",
|
||||
"reqwest 0.12.28",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"soft_assert",
|
||||
"thiserror 1.0.69",
|
||||
"thiserror 2.0.18",
|
||||
"time",
|
||||
"tokio",
|
||||
"url",
|
||||
|
|
@ -1593,7 +1593,7 @@ dependencies = [
|
|||
"hyper",
|
||||
"hyper-util",
|
||||
"libc",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"rmcp",
|
||||
"rusqlite",
|
||||
"schemars",
|
||||
|
|
@ -1619,7 +1619,7 @@ dependencies = [
|
|||
"hive-sh4re",
|
||||
"hive-sock-client",
|
||||
"hive-types",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"rmcp",
|
||||
"serde",
|
||||
"serde_json",
|
||||
|
|
@ -1691,7 +1691,7 @@ dependencies = [
|
|||
"opentelemetry_sdk",
|
||||
"petgraph",
|
||||
"problem_details",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"rusqlite",
|
||||
"serde",
|
||||
"serde_json",
|
||||
|
|
@ -1736,7 +1736,7 @@ dependencies = [
|
|||
"anyhow",
|
||||
"clap",
|
||||
"forgejo-api",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"time",
|
||||
|
|
@ -1751,7 +1751,7 @@ dependencies = [
|
|||
"forgejo-api",
|
||||
"hive-agent-sock",
|
||||
"hive-sock-client",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"time",
|
||||
|
|
@ -1809,7 +1809,7 @@ dependencies = [
|
|||
"matrix-sdk",
|
||||
"mime",
|
||||
"mime_guess",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"rmcp",
|
||||
"schemars",
|
||||
"serde",
|
||||
|
|
@ -2060,7 +2060,6 @@ dependencies = [
|
|||
"tokio",
|
||||
"tokio-rustls",
|
||||
"tower-service",
|
||||
"webpki-roots 1.0.8",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -2661,7 +2660,7 @@ dependencies = [
|
|||
"oauth2-reqwest",
|
||||
"percent-encoding",
|
||||
"pin-project-lite",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"ruma",
|
||||
"rustls",
|
||||
"rustls-native-certs",
|
||||
|
|
@ -3039,7 +3038,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
|
|||
checksum = "234fb5c965bbce983ee5de636a7a51d6a3223da8067ea02f9ab2d2d78ac08be2"
|
||||
dependencies = [
|
||||
"oauth2",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -3090,7 +3089,7 @@ dependencies = [
|
|||
"bytes",
|
||||
"http",
|
||||
"opentelemetry",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -3105,7 +3104,7 @@ dependencies = [
|
|||
"opentelemetry-proto",
|
||||
"opentelemetry_sdk",
|
||||
"prost",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde_json",
|
||||
"thiserror 2.0.18",
|
||||
]
|
||||
|
|
@ -3708,9 +3707,9 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
|
|||
|
||||
[[package]]
|
||||
name = "reqwest"
|
||||
version = "0.12.28"
|
||||
version = "0.13.4"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
|
||||
checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
|
||||
dependencies = [
|
||||
"base64",
|
||||
"bytes",
|
||||
|
|
@ -3734,49 +3733,6 @@ dependencies = [
|
|||
"quinn",
|
||||
"rustls",
|
||||
"rustls-pki-types",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"serde_urlencoded",
|
||||
"sync_wrapper",
|
||||
"tokio",
|
||||
"tokio-rustls",
|
||||
"tower",
|
||||
"tower-http 0.6.11",
|
||||
"tower-service",
|
||||
"url",
|
||||
"wasm-bindgen",
|
||||
"wasm-bindgen-futures",
|
||||
"web-sys",
|
||||
"webpki-roots 1.0.8",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
name = "reqwest"
|
||||
version = "0.13.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
|
||||
dependencies = [
|
||||
"base64",
|
||||
"bytes",
|
||||
"futures-channel",
|
||||
"futures-core",
|
||||
"futures-util",
|
||||
"h2",
|
||||
"http",
|
||||
"http-body",
|
||||
"http-body-util",
|
||||
"hyper",
|
||||
"hyper-rustls",
|
||||
"hyper-util",
|
||||
"js-sys",
|
||||
"log",
|
||||
"mime_guess",
|
||||
"percent-encoding",
|
||||
"pin-project-lite",
|
||||
"quinn",
|
||||
"rustls",
|
||||
"rustls-native-certs",
|
||||
"rustls-pki-types",
|
||||
"rustls-platform-verifier",
|
||||
"serde",
|
||||
"serde_json",
|
||||
|
|
@ -3793,7 +3749,6 @@ dependencies = [
|
|||
"wasm-bindgen-futures",
|
||||
"wasm-streams",
|
||||
"web-sys",
|
||||
"webpki-roots 1.0.8",
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
|
@ -4574,7 +4529,7 @@ version = "0.1.0"
|
|||
dependencies = [
|
||||
"anyhow",
|
||||
"axum",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"serde_norway",
|
||||
|
|
@ -4607,7 +4562,7 @@ dependencies = [
|
|||
"hive-types",
|
||||
"hmac 0.13.0",
|
||||
"problem_details",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"sha2 0.11.0",
|
||||
|
|
@ -4632,7 +4587,7 @@ dependencies = [
|
|||
"futures-util",
|
||||
"nats-jwt",
|
||||
"nkeys",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"sha2 0.11.0",
|
||||
|
|
@ -4647,7 +4602,7 @@ name = "swarm-queue-client"
|
|||
version = "0.1.0"
|
||||
dependencies = [
|
||||
"async-nats",
|
||||
"reqwest 0.13.1",
|
||||
"reqwest",
|
||||
"serde",
|
||||
"serde_json",
|
||||
"thiserror 2.0.18",
|
||||
|
|
@ -5483,9 +5438,9 @@ dependencies = [
|
|||
|
||||
[[package]]
|
||||
name = "wasm-streams"
|
||||
version = "0.4.2"
|
||||
version = "0.5.0"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
|
||||
checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
|
||||
dependencies = [
|
||||
"futures-util",
|
||||
"js-sys",
|
||||
|
|
|
|||
|
|
@ -128,7 +128,14 @@ reqwest = { version = "0.13", default-features = false, features = [
|
|||
hyper = { version = "1", features = ["client", "http1"] }
|
||||
hyper-util = { version = "0.1", features = ["tokio"] }
|
||||
http-body-util = "0.1"
|
||||
forgejo-api = { version = "0.11", default-features = false, features = [
|
||||
# ⚠️ Keep at 0.11.1 or newer, and keep it on the SAME reqwest as everything
|
||||
# else. 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo
|
||||
# resolves features per (crate, VERSION): that older client got neither the
|
||||
# workspace's TLS features nor the system trust store, so every https call to
|
||||
# a gateway name died with `invalid peer certificate: UnknownIssuer` while
|
||||
# clients built here worked (#3391). One version of reqwest in the tree is
|
||||
# what keeps that class impossible rather than merely fixed.
|
||||
forgejo-api = { version = "0.11.1", default-features = false, features = [
|
||||
"rustls-tls",
|
||||
] }
|
||||
url = "2"
|
||||
|
|
|
|||
|
|
@ -11,28 +11,28 @@ path = "src/main.rs"
|
|||
[dependencies]
|
||||
anyhow = { workspace = true }
|
||||
clap = { workspace = true }
|
||||
# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend
|
||||
# comes from workspace feature unification on reqwest: the
|
||||
# `rustls-tls-native-roots` feature below applies to forgejo-api's
|
||||
# internal client too (same compiled reqwest), so the hive-CA trust
|
||||
# note keeps holding.
|
||||
# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend comes
|
||||
# from feature unification on reqwest — which only works because forgejo-api
|
||||
# and this crate now resolve to the SAME reqwest version; cargo unifies
|
||||
# features per (crate, version), so the claim is a fact about the lockfile,
|
||||
# not about the workspace. See the pin note on `forgejo-api` in the root
|
||||
# `Cargo.toml`.
|
||||
forgejo-api = { workspace = true, features = ["sync"] }
|
||||
url.workspace = true
|
||||
time.workspace = true
|
||||
reqwest = { workspace = true, features = [
|
||||
"json",
|
||||
# Trust the OS/system CA store (`rustls-native-certs`), plus the bundled
|
||||
# Mozilla roots (`webpki-roots`), so hive-forge validates the hive
|
||||
# `rustls` carries the platform verifier, which reads the OS trust store
|
||||
# (and honours `SSL_CERT_FILE`), so hive-forge validates the hive
|
||||
# gateway's self-signed leaf once the hive CA is in the agent's trust
|
||||
# store (embedded into agent flakes via security.pki.certificateFiles)
|
||||
# AND public CAs still validate. Cargo unifies features across the build,
|
||||
# so both root sources are enabled for every reqwest client; harmless (a
|
||||
# superset of roots, and on NixOS the system store already includes the
|
||||
# Mozilla bundle). (reqwest 0.13 renamed the 0.12 `rustls-tls` /
|
||||
# `rustls-tls-native-roots` features to `rustls` / `rustls-native-certs`.)
|
||||
# store — embedded into agent flakes via `security.pki.certificateFiles`
|
||||
# — while public CAs still validate.
|
||||
#
|
||||
# The separate `rustls-native-certs` / `webpki-roots` features this entry
|
||||
# used to name were 0.13.1-era and no longer exist; naming a feature that
|
||||
# is gone is a hard resolution error, not a silent no-op, so this list has
|
||||
# to move with the pin.
|
||||
"rustls",
|
||||
"rustls-native-certs",
|
||||
"webpki-roots",
|
||||
"blocking",
|
||||
"multipart",
|
||||
] }
|
||||
|
|
|
|||
Loading…
Reference in a new issue