74dfd366b4
forgejo-api 0.11.0 links reqwest 0.12 while the workspace is on 0.13, and cargo unifies features per (crate, VERSION) — not per crate. So forgejo-api's internal client was a *second* reqwest, built with neither the workspace's TLS features nor the system trust store, and every https call it made to a gateway name failed `invalid peer certificate: UnknownIssuer` while a client built in this workspace succeeded against the same host. Pinning to 0.11.1 puts one reqwest in the tree, which is what makes the existing "feature unification gives forgejo-api our TLS backend" comment true rather than aspirational — the claim is a fact about the lockfile, so the pin is load-bearing and says so. The reqwest feature list moves with it: `rustls-native-certs` and `webpki-roots` were 0.13.1-era names that no longer exist, and `rustls` now carries the platform verifier (OS trust store, honours SSL_CERT_FILE). Naming a feature that is gone is a hard resolution error rather than a silent no-op, so the list had to change in the same commit as the pin. Refs #3391
43 lines
1.5 KiB
TOML
43 lines
1.5 KiB
TOML
[package]
|
|
name = "hive-forge"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[[bin]]
|
|
name = "hive-forge"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
anyhow = { workspace = true }
|
|
clap = { workspace = true }
|
|
# `sync` = blocking client (hive-forge is a blocking CLI). TLS backend comes
|
|
# from feature unification on reqwest — which only works because forgejo-api
|
|
# and this crate now resolve to the SAME reqwest version; cargo unifies
|
|
# features per (crate, version), so the claim is a fact about the lockfile,
|
|
# not about the workspace. See the pin note on `forgejo-api` in the root
|
|
# `Cargo.toml`.
|
|
forgejo-api = { workspace = true, features = ["sync"] }
|
|
url.workspace = true
|
|
time.workspace = true
|
|
reqwest = { workspace = true, features = [
|
|
"json",
|
|
# `rustls` carries the platform verifier, which reads the OS trust store
|
|
# (and honours `SSL_CERT_FILE`), so hive-forge validates the hive
|
|
# gateway's self-signed leaf once the hive CA is in the agent's trust
|
|
# store — embedded into agent flakes via `security.pki.certificateFiles`
|
|
# — while public CAs still validate.
|
|
#
|
|
# The separate `rustls-native-certs` / `webpki-roots` features this entry
|
|
# used to name were 0.13.1-era and no longer exist; naming a feature that
|
|
# is gone is a hard resolution error, not a silent no-op, so this list has
|
|
# to move with the pin.
|
|
"rustls",
|
|
"blocking",
|
|
"multipart",
|
|
] }
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|