From dfac9af1d96702f451b9d48ec7127455c3a1c560 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 30 Oct 2026 16:03:02 +0100
Subject: use rustls with ring for reqwest

---
 Cargo.toml                    | 7 +++++--
 src/transport/mycelium/mod.rs | 3 +++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 45ae47c..f1e7539 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -9,7 +9,7 @@ edition = "2024"
 tokio-console = ["dep:console-subscriber"]
 # The Mycelium transport (`--transports mycelium`, the default where built): through a
 # Mycelium daemon's API, one it supervises or one running elsewhere.
-mycelium = ["dep:reqwest", "dep:libc"]
+mycelium = ["dep:reqwest", "dep:rustls", "dep:libc"]
 # The libp2p transport (`--transports libp2p`).
 libp2p = ["dep:libp2p", "dep:libp2p-stream", "dep:futures"]
 # The Tor transport (`--transports tor`): onion services, with arti.
@@ -51,7 +51,10 @@ ed25519-dalek = "3"
 getrandom = "0.4"
 libc = { version = "0.2", optional = true }
 password-hash = "0.6"
-reqwest = { version = "0.13", optional = true, features = ["json", "query"] }
+# Its TLS (only for a Mycelium daemon elsewhere, over https) is rustls with ring, which
+# libp2p's QUIC uses too, rather than reqwest's default aws-lc (a C library, cmake).
+reqwest = { version = "0.13", optional = true, default-features = false, features = ["json", "query", "http2", "charset", "system-proxy", "rustls-no-provider"] }
+rustls = { version = "0.23", optional = true, default-features = false, features = ["ring", "std", "tls12", "logging"] }
 rmp-serde = "1.3"
 serde = { version = "1.0", features = ["derive"] }
 serde_bytes = "0.11"
diff --git a/src/transport/mycelium/mod.rs b/src/transport/mycelium/mod.rs
index 836eca9..10121bb 100644
--- a/src/transport/mycelium/mod.rs
+++ b/src/transport/mycelium/mod.rs
@@ -158,6 +158,9 @@ async fn admin_info(client: &reqwest::Client, url: Url) -> Result<MyceliumAdminI
 impl MyceliumTransport {
     pub(crate) async fn connect(setup: MyceliumSetup) -> Result<Self> {
         let rest_url = setup.rest_url.clone();
+        // reqwest's TLS has no crypto provider of its own (`Cargo.toml`): ring, for the
+        // whole process, unless one is installed already.
+        let _ = rustls::crypto::ring::default_provider().install_default();
 
         let client = reqwest::Client::builder()
             .timeout(REQUEST_TIMEOUT)
-- 
cgit v1.3.1