1e39a6c12b
Enable reqwest's rustls-tls-native-roots feature for hive-forge so its HTTP client validates against the OS/system CA store (rustls-native-certs) in addition to the bundled webpki roots. Once the hive CA is embedded into agent system trust stores (via the meta flake's security.pki.certificateFiles wiring), hive-forge validates the gateway's self-signed leaf with no extra env plumbing. Additive: the bundled webpki roots stay enabled, so public CAs still validate; the native store adds the hive CA. On NixOS the system store already includes the Mozilla bundle, so the effective trust set is a superset. Cargo unifies features across the build, so native-root loading is enabled for every reqwest client — harmless, since it only widens the root set. Final piece of the self-signed agent-trust chain (host CA + gateway leaf, then CA embedded into agent flakes, now the forge client honouring it).
33 lines
1 KiB
TOML
33 lines
1 KiB
TOML
[package]
|
|
name = "hive-forge"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
|
|
[[bin]]
|
|
name = "hive-forge"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true }
|
|
reqwest = { workspace = true, features = [
|
|
"json",
|
|
# Trust the OS/system CA store (rustls-native-certs), not only the
|
|
# bundled webpki roots, so hive-forge validates the hive gateway's
|
|
# self-signed leaf once the hive CA is in the agent's trust store
|
|
# (embedded into agent flakes via security.pki.certificateFiles). The
|
|
# bundled webpki roots stay enabled (workspace `rustls-tls`), so this is
|
|
# additive — public CAs still validate; the native store adds the hive
|
|
# CA. Cargo unifies features across the build, so native-root loading is
|
|
# enabled for every reqwest client; harmless (a superset of roots, and
|
|
# on NixOS the system store already includes the Mozilla bundle).
|
|
"rustls-tls-native-roots",
|
|
"rustls-tls",
|
|
"blocking",
|
|
"multipart",
|
|
] }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|