max / makenotwork

Drop openssl from the server: webauthn-rs 0.6, and an explicit rustls provider Three things, all in service of getting openssl-sys out of the tree, which cargo-deny bans on the pure-Rust crypto standing choice. webauthn-rs 0.5 depended on openssl and openssl-sys unconditionally, with no feature gate, so it was the last root. 0.6 replaces that with crypto-glue (RustCrypto). The stored credential format does not move: a Passkey written by 0.5 round-trips through 0.6 byte-identically, and 0.5 still reads what 0.6 writes, so user_passkeys.credential_json needs no migration and a rollback stays open. Verified against the 0.5 test suite's own serialised credential. Upstream has no stable 0.6 yet, so the version is pinned exactly rather than left to float. WebauthnAuthenticator became a trait in 0.6, blanket-implemented on every AuthenticatorBackend, so the passkey workflow tests hold a SoftPasskey directly. The rustls provider is a bug the previous commit introduced and the Stripe webhook tests caught. Moving async-stripe onto rustls put a second rustls consumer in the tree that builds its connector from the process-wide default provider, and rustls refuses to choose when both aws-lc-rs and ring are compiled in. Both are. It panicked lazily, at the first connector build, which put the failure on the money path. StripeClient::new now installs a named provider, so no construction order can get it wrong, and main does it at boot so the choice is visible where it is made. Also drops the direct openssl dependency, which existed only to force `vendored` onto the openssl webauthn-rs pulled in. Nothing pulls it now. fw13 and astra both carry system OpenSSL 3.0.13, and the release build links clean without it. cargo-deny bans and licenses both pass under the sweep policy. 3421 tests pass.