Option to use `ring` as `rustls` provider

[fenhl]

Summary 💡

Currently, the blocking-http-transport-reqwest-rust-tls-trust-dns feature uses aws-lc-rs as the cryptography provider for rustls. I would like to request the ability (either as the default or as an alternative crate feature) to use ring instead.

Motivation 🔦

aws-lc-rs has nontrivial C dependencies and as a result it has a history of builds breaking in various configurations, e.g. it currently fails to compile for Android. While ring is not technically pure Rust as it extensively uses assembly code, it does not have these build problems in my experience.

[stormshield-gt]

Maybe a feature that doesn't set any provider would be more future proof ?
That way, any provider can be chosen. For instance, https://github.com/ctz/graviola/ which is also really easy and fast to compile

Some other libraries have gone that way, for instance bollards and testcontainers. The next release of rustls (rustls/rustls#2400) has also removed the built-in provider.

[Byron]

Thanks for sharing.

While I think that the most common features of reqwest should be forwarded via the gix crate, it should also always be possible to not select any feature, and instead depend on reqwest yourself and set it up as needed.

Is there anything that you'd like to do that doesn't work?

[EliahKagan]

Related: #2338

[fenhl]

Is there anything that you'd like to do that doesn't work?

It wasn't obvious from the documentation, but the blocking-http-transport-reqwest feature doesn't configure any TLS backend, and therefore doesn't pull in aws-lc-rs. So using that feature and configuring reqwest and rustls separately works. I could send a small docs PR to clarify this if you'd like.

[Byron]

Yes, please do!

Does that mean you brought ring back that way? Somehow I thought it disappeared from reqwest completely, but if not I'd also love to have the pure Rust build back and use ring there instead.

And that docs PR would definitely be welcome, go for it :).

[fenhl]

Does that mean you brought ring back that way? Somehow I thought it disappeared from reqwest completely, but if not I'd also love to have the pure Rust build back and use ring there instead.

Yes, by specifying the following dependencies and features:

[dependencies]
gix = { version = "0.78", features = ["blocking-http-transport-reqwest"] }
reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider"] }
rustls = { version = "0.23", default-features = false, features = ["ring"] }

And then configuring rustls to use ring by default:

fn main() {
    let _ = rustls::crypto::ring::default_provider().install_default();
    gix::prepare_clone("https://github.com/GitoxideLabs/gitoxide.git", "gix-test-repo").unwrap()
        .fetch_then_checkout(gix::progress::Discard, &gix::interrupt::IS_INTERRUPTED).unwrap();
}