kit: Switch reqwest from rustls to native-tls - #322
Conversation
reqwest 0.13 changed its default TLS backend from native-tls (OpenSSL) to rustls backed by aws-lc-rs. The aws-lc-sys build system does not pass -fPIE when compiling its test binaries, which is incompatible with Fedora/CentOS hardened RPM linker specs that require PIE — breaking all packit builds. Switch to native-tls explicitly. The RPM spec already requires openssl-devel, so no new build dependencies are needed. Closes: #321 Assisted-by: AI Signed-off-by: gursewak1997 <gursmangat@gmail.com>
cgwalters
left a comment
cgwalters
left a comment
There was a problem hiding this comment.
The aws-lc-sys build system does not pass -fPIE when compiling its test binaries
How does this relate to "test binaries"? Hmm, like something being built from build.rs?
reqwest 0.13 changed its default TLS backend from native-tls (OpenSSL) to rustls backed by aws-lc-rs.
Ah. That's a big change. Right now we need openssl for FIPS, which is its own side thread. In theory...perhaps we need to make this configurable too via a feature flag on our side, but for now this looks right.
|
Yeah, aws-lc-sys's |
The kernel detection rewrite (ac5d74a) changed the error from "Failed to read kernel modules directory" to "No kernel found", but the broken image cleanup test was not updated. Depending on timing, the test can hit this path and fail the assertion. Assisted-by: AI Signed-off-by: gursewak1997 <gursmangat@gmail.com>
1b4a634 to
4550cf1
Compare
2 participants
reqwest 0.13 changed its default TLS backend from native-tls (OpenSSL) to rustls backed by aws-lc-rs. The aws-lc-sys build system does not pass -fPIE when compiling its test binaries, which is incompatible with Fedora/CentOS hardened RPM linker specs that require PIE — breaking all packit builds.
Switch to native-tls explicitly. The RPM spec already requires openssl-devel, so no new build dependencies are needed.
Closes: #321