We had a few places where we were importing native-tls (which pulls openssl in linux boxes) unintentionally. First was reqwest, where we enable the rustls-tls feature in a couple of places, but it was a no-op in one but since we did call use_rustls_tls in our tokenserver browserid verifier that used rustls properly. The second place was sentry, where even though we were using the curl feature, the transport feature is enabled by default, which pulls in request again, with the native-tls feature
Regardless, having both rustls and native-tls in our dependency tree could be a future foot gun, so this PR removes native-tls (alternatively, we can go the route of removing rustls but we seem to have consciously chose that, where native-tls snuck in with reqwest and sentry)
What this PR does not touch, is boring-ssl that is pulled in using grpc-io.
One possible improvement we can make to this, that fits well with https://mozilla-hub.atlassian.net/browse/SYNC-4127 is to setup rust features, where we can support multiple tls backends... but I'm struggling to see the value from that (i.e why do we need to support multiple backends in a binary?)
Description
We had a few places where we were importing native-tls (which pulls openssl in linux boxes) unintentionally. First was
reqwest
, where we enable therustls-tls
feature in a couple of places, but it was a no-op in one but since we did calluse_rustls_tls
in our tokenserver browserid verifier that used rustls properly. The second place was sentry, where even though we were using thecurl
feature, thetransport
feature is enabled by default, which pulls in request again, with thenative-tls
featureRegardless, having both rustls and native-tls in our dependency tree could be a future foot gun, so this PR removes native-tls (alternatively, we can go the route of removing rustls but we seem to have consciously chose that, where native-tls snuck in with
reqwest
andsentry
)What this PR does not touch, is
boring-ssl
that is pulled in using grpc-io.One possible improvement we can make to this, that fits well with https://mozilla-hub.atlassian.net/browse/SYNC-4127 is to setup rust features, where we can support multiple tls backends... but I'm struggling to see the value from that (i.e why do we need to support multiple backends in a binary?)