Library reqwest depends on OpenSSL 1.1 causing packaging issues for some distributions

[dreamer]

Usage of reqwest library was quick and easy way to introduce package downloads, but it had unwanted consequences, as our official builds now started to depend on libssl ABI 1.1.

While OpenSSL 1.1 is widely packaged throughout distros already (it's in Fedora, Debian, Arch, Ubuntu, etc), there are still some OSes stuck on 1.0, namely:

• Ubuntu 16.04, older and derivatives
• Mint
• Solus

Steam Runtime also includes only 1.0.

At the same time, new distributions do not provide ABI 1.0 by default any more; depending on old build bundled with SR for new software is not a good idea.

Solution

Dependency reqwest will be replaced by libcurl-rust. There are several reasons for this decision:

• We don't need full functionality of reqwest, only a tiny subset
• Using curl-rust reduces number of dependencies from 202 to 115
• … in result cutting clean build time from 60s to ~38s (on my machine); incremental builds are as fast as they were before (~2s).
• curl-rust is able to dynamically load libcurl, which is pretty neat considering Steam already pins the system-installed version for better compatibility. It also provides an easy option for statically bundling libcurl if needed, so that's neat.

[ghost]

This is currently an issue on NixOS.