pub fn ensure_crypto_provider()Expand description
Installs a ring-backed rustls::crypto::CryptoProvider if the process
doesn’t already have one (#440).
reqwest’s rustls-no-provider feature — deliberately chosen over
rustls so this crate stops forcing aws-lc-rs on every consumer of
cratestack-pg (see the workspace Cargo.toml’s reqwest entry) — ships
no crypto provider at all: reqwest::Client::new()/ClientBuilder::build()
PANIC at construction time if rustls::crypto::CryptoProvider::get_default()
finds nothing installed. Unlike the old rustls feature’s silent
aws-lc-rs install, that’s a worse zero-config default than what this
crate had before, not merely a neutral one.
install_default() only ever takes effect the FIRST time it succeeds
process-wide — it’s a courtesy fallback, not an override. A consumer that
installs its own provider (any backend, including aws-lc-rs) before
constructing its first CratestackClient keeps that choice; this only
fires when nobody has chosen anything yet, which is exactly the gap
rustls-no-provider otherwise turns into a panic. The Err it returns
on a race with another caller installing first (or a no-op call to this
same function from a second CratestackClient::new) is expected and
intentionally ignored.
Public since cratestack#926: CratestackClient::with_http_client
and with_middleware_client both take an already-built
reqwest::Client, so the panic happens in the caller’s code,
before this crate gets a chance to install anything. Callers on
those paths need a way to say “install the fallback now”, and this
is it — idempotent, safe to call from anywhere, and a no-op once any
provider is installed.
On wasm32 this does nothing (cratestack#1104): reqwest goes through
the browser’s fetch there, which does TLS itself, so there is no
rustls provider to install. It still exists so a caller’s code
compiles unchanged for both targets.