vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

hive-forge: pin forgejo-api to 0.11.1 so it shares the workspace reqwest

Browse source 
forgejo-api 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and
cargo unifies features per (crate, VERSION) — not per crate. So forgejo-api's
internal client was a *second* reqwest, built with neither the workspace's TLS
features nor the system trust store, and every https call it made to a gateway
name failed `invalid peer certificate: UnknownIssuer` while a client built in
this workspace succeeded against the same host.

Pinning to 0.11.1 puts one reqwest in the tree, which is what makes the
existing "feature unification gives forgejo-api our TLS backend" comment true
rather than aspirational — the claim is a fact about the lockfile, so the pin
is load-bearing and says so.

The reqwest feature list moves with it: `rustls-native-certs` and
`webpki-roots` were 0.13.1-era names that no longer exist, and `rustls` now
carries the platform verifier (OS trust store, honours SSL_CERT_FILE). Naming
a feature that is gone is a hard resolution error rather than a silent no-op,
so the list had to change in the same commit as the pin.

Refs #3391
This commit is contained in:
atlas 2026-08-19 12:30:50 +02:00
commit 74dfd366b4
3 changed files with 45 additions and 83 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Cargo.toml
View file

@ -128,7 +128,14 @@ reqwest = { version = "0.13", default-features = false, features = [
hyper = { version = "1", features = ["client", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }
http-body-util = "0.1"
forgejo-api = { version = "0.11", default-features = false, features = [
# ⚠️ Keep at 0.11.1 or newer, and keep it on the SAME reqwest as everything
# else. 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo
# resolves features per (crate, VERSION): that older client got neither the
# workspace's TLS features nor the system trust store, so every https call to
# a gateway name died with `invalid peer certificate: UnknownIssuer` while
# clients built here worked (#3391). One version of reqwest in the tree is
# what keeps that class impossible rather than merely fixed.
forgejo-api = { version = "0.11.1", default-features = false, features = [
"rustls-tls",
] }
url = "2"