From 74dfd366b4b1393e239d8e80f2f7f261354e54f5 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 19 Aug 2026 12:30:50 +0200
Subject: [PATCH] hive-forge: pin forgejo-api to 0.11.1 so it shares the
 workspace reqwest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

forgejo-api 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and
cargo unifies features per (crate, VERSION) — not per crate. So forgejo-api's
internal client was a *second* reqwest, built with neither the workspace's TLS
features nor the system trust store, and every https call it made to a gateway
name failed `invalid peer certificate: UnknownIssuer` while a client built in
this workspace succeeded against the same host.

Pinning to 0.11.1 puts one reqwest in the tree, which is what makes the
existing "feature unification gives forgejo-api our TLS backend" comment true
rather than aspirational — the claim is a fact about the lockfile, so the pin
is load-bearing and says so.

The reqwest feature list moves with it: `rustls-native-certs` and
`webpki-roots` were 0.13.1-era names that no longer exist, and `rustls` now
carries the platform verifier (OS trust store, honours SSL_CERT_FILE). Naming
a feature that is gone is a hard resolution error rather than a silent no-op,
so the list had to change in the same commit as the pin.

Refs #3391
---
 Cargo.lock            | 89 +++++++++++--------------------------------
 Cargo.toml            |  9 ++++-
 hive-forge/Cargo.toml | 30 +++++++--------
 3 files changed, 45 insertions(+), 83 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index f5c30ef2..a3710f58 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1312,18 +1312,18 @@ checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
 [[package]]
 name = "forgejo-api"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c51fffa047d5836a4d89179a20b21b7e41ad97e713104752169d819b83c9158"
+checksum = "e723c70a2a46fe0dbc2c10024218170ad9ca6ce8f98a39cee8032478ab748086"
 dependencies = [
  "base64ct",
  "bytes",
  "futures",
- "reqwest 0.12.28",
+ "reqwest",
  "serde",
  "serde_json",
  "soft_assert",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "time",
  "tokio",
  "url",
@@ -1593,7 +1593,7 @@ dependencies = [
  "hyper",
  "hyper-util",
  "libc",
- "reqwest 0.13.1",
+ "reqwest",
  "rmcp",
  "rusqlite",
  "schemars",
@@ -1619,7 +1619,7 @@ dependencies = [
  "hive-sh4re",
  "hive-sock-client",
  "hive-types",
- "reqwest 0.13.1",
+ "reqwest",
  "rmcp",
  "serde",
  "serde_json",
@@ -1691,7 +1691,7 @@ dependencies = [
  "opentelemetry_sdk",
  "petgraph",
  "problem_details",
- "reqwest 0.13.1",
+ "reqwest",
  "rusqlite",
  "serde",
  "serde_json",
@@ -1736,7 +1736,7 @@ dependencies = [
  "anyhow",
  "clap",
  "forgejo-api",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "time",
@@ -1751,7 +1751,7 @@ dependencies = [
  "forgejo-api",
  "hive-agent-sock",
  "hive-sock-client",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "time",
@@ -1809,7 +1809,7 @@ dependencies = [
  "matrix-sdk",
  "mime",
  "mime_guess",
- "reqwest 0.13.1",
+ "reqwest",
  "rmcp",
  "schemars",
  "serde",
@@ -2060,7 +2060,6 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -2661,7 +2660,7 @@ dependencies = [
  "oauth2-reqwest",
  "percent-encoding",
  "pin-project-lite",
- "reqwest 0.13.1",
+ "reqwest",
  "ruma",
  "rustls",
  "rustls-native-certs",
@@ -3039,7 +3038,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "234fb5c965bbce983ee5de636a7a51d6a3223da8067ea02f9ab2d2d78ac08be2"
 dependencies = [
  "oauth2",
- "reqwest 0.13.1",
+ "reqwest",
 ]
 
 [[package]]
@@ -3090,7 +3089,7 @@ dependencies = [
  "bytes",
  "http",
  "opentelemetry",
- "reqwest 0.13.1",
+ "reqwest",
 ]
 
 [[package]]
@@ -3105,7 +3104,7 @@ dependencies = [
  "opentelemetry-proto",
  "opentelemetry_sdk",
  "prost",
- "reqwest 0.13.1",
+ "reqwest",
  "serde_json",
  "thiserror 2.0.18",
 ]
@@ -3708,9 +3707,9 @@ checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "reqwest"
-version = "0.12.28"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64",
  "bytes",
@@ -3734,49 +3733,6 @@ dependencies = [
  "quinn",
  "rustls",
  "rustls-pki-types",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper",
- "tokio",
- "tokio-rustls",
- "tower",
- "tower-http 0.6.11",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
- "webpki-roots 1.0.8",
-]
-
-[[package]]
-name = "reqwest"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04e9018c9d814e5f30cc16a0f03271aeab3571e609612d9fe78c1aa8d11c2f62"
-dependencies = [
- "base64",
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2",
- "http",
- "http-body",
- "http-body-util",
- "hyper",
- "hyper-rustls",
- "hyper-util",
- "js-sys",
- "log",
- "mime_guess",
- "percent-encoding",
- "pin-project-lite",
- "quinn",
- "rustls",
- "rustls-native-certs",
- "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
  "serde_json",
@@ -3793,7 +3749,6 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.8",
 ]
 
 [[package]]
@@ -4574,7 +4529,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "axum",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "serde_norway",
@@ -4607,7 +4562,7 @@ dependencies = [
  "hive-types",
  "hmac 0.13.0",
  "problem_details",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -4632,7 +4587,7 @@ dependencies = [
  "futures-util",
  "nats-jwt",
  "nkeys",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "sha2 0.11.0",
@@ -4647,7 +4602,7 @@ name = "swarm-queue-client"
 version = "0.1.0"
 dependencies = [
  "async-nats",
- "reqwest 0.13.1",
+ "reqwest",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -5483,9 +5438,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-streams"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
 dependencies = [
  "futures-util",
  "js-sys",
diff --git a/Cargo.toml b/Cargo.toml
index cd4cfce6..f7445c9a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -128,7 +128,14 @@ reqwest = { version = "0.13", default-features = false, features = [
 hyper = { version = "1", features = ["client", "http1"] }
 hyper-util = { version = "0.1", features = ["tokio"] }
 http-body-util = "0.1"
-forgejo-api = { version = "0.11", default-features = false, features = [
+# ⚠️ Keep at 0.11.1 or newer, and keep it on the SAME reqwest as everything
+# else. 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo
+# resolves features per (crate, VERSION): that older client got neither the
+# workspace's TLS features nor the system trust store, so every https call to
+# a gateway name died with `invalid peer certificate: UnknownIssuer` while
+# clients built here worked (#3391). One version of reqwest in the tree is
+# what keeps that class impossible rather than merely fixed.
+forgejo-api = { version = "0.11.1", default-features = false, features = [
   "rustls-tls",
 ] }
 url = "2"
diff --git a/hive-forge/Cargo.toml b/hive-forge/Cargo.toml
index 746d6b14..e8bae060 100644
--- a/hive-forge/Cargo.toml
+++ b/hive-forge/Cargo.toml
@@ -11,28 +11,28 @@ path = "src/main.rs"
 [dependencies]
 anyhow = { workspace = true }
 clap = { workspace = true }
-# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend
-# comes from workspace feature unification on reqwest: the
-# `rustls-tls-native-roots` feature below applies to forgejo-api's
-# internal client too (same compiled reqwest), so the hive-CA trust
-# note keeps holding.
+# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend comes
+# from feature unification on reqwest — which only works because forgejo-api
+# and this crate now resolve to the SAME reqwest version; cargo unifies
+# features per (crate, version), so the claim is a fact about the lockfile,
+# not about the workspace. See the pin note on `forgejo-api` in the root
+# `Cargo.toml`.
 forgejo-api = { workspace = true, features = ["sync"] }
 url.workspace = true
 time.workspace = true
 reqwest = { workspace = true, features = [
   "json",
-  # Trust the OS/system CA store (`rustls-native-certs`), plus the bundled
-  # Mozilla roots (`webpki-roots`), so hive-forge validates the hive
+  # `rustls` carries the platform verifier, which reads the OS trust store
+  # (and honours `SSL_CERT_FILE`), so hive-forge validates the hive
   # gateway's self-signed leaf once the hive CA is in the agent's trust
-  # store (embedded into agent flakes via security.pki.certificateFiles)
-  # AND public CAs still validate. Cargo unifies features across the build,
-  # so both root sources are enabled for every reqwest client; harmless (a
-  # superset of roots, and on NixOS the system store already includes the
-  # Mozilla bundle). (reqwest 0.13 renamed the 0.12 `rustls-tls` /
-  # `rustls-tls-native-roots` features to `rustls` / `rustls-native-certs`.)
+  # store — embedded into agent flakes via `security.pki.certificateFiles`
+  # — while public CAs still validate.
+  #
+  # The separate `rustls-native-certs` / `webpki-roots` features this entry
+  # used to name were 0.13.1-era and no longer exist; naming a feature that
+  # is gone is a hard resolution error, not a silent no-op, so this list has
+  # to move with the pin.
   "rustls",
-  "rustls-native-certs",
-  "webpki-roots",
   "blocking",
   "multipart",
 ] }