pub fn ensure_crypto_provider()Expand description
The client TLS configuration: the bundled Mozilla roots, plus any extra root the operator
names in LOGOS_TLS_EXTRA_ROOT (a PEM file).
★ PUBLIC BECAUSE BOTH TIERS MUST SHARE IT. The interpreter and VM drive sockets through tokio and the AOT tier drives them synchronously, so there are two socket registries — but there must be exactly ONE set of trusted roots and one verification policy. Two copies would drift, and the direction they drift in is “which certificates are accepted”.
★ BUNDLED ROOTS, NOT THE OS STORE, so a compiled binary trusts the same authorities wherever it runs — the same reason every other input here is pinned. An OS store makes a build’s behaviour depend on the machine it happens to execute on.
★ AND THE EXTRA ROOT IS A REAL FEATURE, not test scaffolding: a private CA is how a
self-hosted PostgreSQL or an internal API is reached, and without a seam for it those are
simply unreachable. It also lets the socket tests stand up a hermetic TLS server rather than
proving TLS against the internet.
Install the process-level rustls CryptoProvider, once, idempotently.
★ IT HAS TO BE CALLABLE FROM BOTH SIDES, and it used to be reachable only from one.
rustls refuses to guess when more than one crypto backend is compiled in and PANICS at the
first handshake — and Cargo feature unification makes that unavoidable by declaration alone,
since another crate in this workspace’s graph enables aws-lc-rs and a feature enabled
anywhere is enabled everywhere.
The install used to live inside tls_config’s cache, which only runs on the CLIENT path. A
process that builds a ServerConfig first therefore panicked. Under cargo test that never
showed: every test shares one process, so whichever test connected first installed the provider
and every later server builder inherited it. Under nextest — one process PER TEST — the test
that only ever builds a server got a process with no provider, and died. The ordering was doing
the work, and the ordering is not a guarantee.