nordisk/Skidbladnir

src/http_tls.rs

//! The ONE reqwest TLS setup every blocking HTTP client in the crate is built with
//! (download, harvest, Vault/OpenBao, Redfish, Vault PKI).

/// reqwest 0.13 with reqwest 0.12 `rustls-tls` behaviour (2026-10-02): the ring
/// provider and the bundled Mozilla roots (webpki), not 0.13's aws-lc-rs + OS
/// trust store. Roots added later on the builder are merged in, as in 0.12.
pub(crate) fn tls_roots_blocking(
    b: reqwest::blocking::ClientBuilder,
) -> reqwest::blocking::ClientBuilder {
    let _ = rustls::crypto::ring::default_provider().install_default();
    b.tls_certs_only(
        webpki_root_certs::TLS_SERVER_ROOT_CERTS
            .iter()
            .filter_map(|c| reqwest::Certificate::from_der(c).ok()),
    )
}