Skip to main content

max / makenotwork

Move the Stripe client off native-tls onto rustls async-stripe's default `default-tls` feature is native-tls, which pulled openssl-sys in through hyper-tls. cargo-deny bans openssl-sys: pure-Rust crypto is the standing choice. rustls-tls-native keeps the system trust store, matching the platform verifier reqwest already uses in this tree, and carries the `__hyper` feature the client needs. The provider has to be named separately or async-stripe's connector.rs refuses to compile. Drops hyper-tls, native-tls and tokio-native-tls from the lock. openssl-sys is still in the tree via webauthn-rs 0.5, which depends on it unconditionally.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-08-08 14:12 UTC
Signed with PGP, not checked
Commit: dfaaa9e3f504270d13e1920bc7e44432ac870c75
Parent: 0eaf28f
2 files changed, +11 insertions, -47 deletions
M server/Cargo.lock +5 -46
@@ -495,7 +495,7 @@
495 495 "bytes",
496 496 "http-body-util",
497 497 "hyper",
498 - "hyper-tls",
498 + "hyper-rustls",
499 499 "hyper-util",
500 500 "miniserde",
501 501 "thiserror 2.0.18",
@@ -4399,6 +4399,7 @@
4399 4399 "http 1.4.2",
4400 4400 "hyper",
4401 4401 "hyper-util",
4402 + "log",
4402 4403 "rustls",
4403 4404 "rustls-native-certs 0.8.4",
4404 4405 "tokio",
@@ -4420,22 +4421,6 @@
4420 4421 "tower-service",
4421 4422 ]
4422 4423
4423 - [[package]]
4424 - name = "hyper-tls"
4425 - version = "0.6.0"
4426 - source = "registry+https://github.com/rust-lang/crates.io-index"
4427 - checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
4428 - dependencies = [
4429 - "bytes",
4430 - "http-body-util",
4431 - "hyper",
4432 - "hyper-util",
4433 - "native-tls",
4434 - "tokio",
4435 - "tokio-native-tls",
4436 - "tower-service",
4437 - ]
4438 -
4439 4424 [[package]]
4440 4425 name = "hyper-util"
4441 4426 version = "0.1.20"
@@ -5544,23 +5529,6 @@
5544 5529 "pxfm",
5545 5530 ]
5546 5531
5547 - [[package]]
5548 - name = "native-tls"
5549 - version = "0.2.18"
5550 - source = "registry+https://github.com/rust-lang/crates.io-index"
5551 - checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
5552 - dependencies = [
5553 - "libc",
5554 - "log",
5555 - "openssl",
5556 - "openssl-probe 0.2.1",
5557 - "openssl-sys",
5558 - "schannel",
5559 - "security-framework 3.7.0",
5560 - "security-framework-sys",
5561 - "tempfile",
5562 - ]
5563 -
5564 5532 [[package]]
5565 5533 name = "new_debug_unreachable"
5566 5534 version = "1.0.6"
@@ -7130,6 +7098,7 @@
7130 7098 checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
7131 7099 dependencies = [
7132 7100 "aws-lc-rs",
7101 + "log",
7133 7102 "once_cell",
7134 7103 "ring",
7135 7104 "rustls-pki-types",
@@ -8376,16 +8345,6 @@
8376 8345 "syn 2.0.118",
8377 8346 ]
8378 8347
8379 - [[package]]
8380 - name = "tokio-native-tls"
8381 - version = "0.3.1"
8382 - source = "registry+https://github.com/rust-lang/crates.io-index"
8383 - checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
8384 - dependencies = [
8385 - "native-tls",
8386 - "tokio",
8387 - ]
8388 -
8389 8348 [[package]]
8390 8349 name = "tokio-rustls"
8391 8350 version = "0.26.4"
@@ -10475,8 +10434,8 @@
10475 10434
10476 10435 [[patch.unused]]
10477 10436 name = "synckit-client"
10478 - version = "0.7.0"
10437 + version = "0.8.0"
10479 10438
10480 10439 [[patch.unused]]
10481 10440 name = "synckit-config"
10482 - version = "0.1.2"
10441 + version = "0.2.0"
M server/Cargo.toml +6 -1
@@ -152,7 +152,12 @@
152 152 # required to derive `serde::Deserialize` on Subscription, Invoice, etc: we
153 153 # parse them from webhook payloads ourselves (no built-in webhook helper in the
154 154 # rc line; see `payments::webhooks::verify_signature` for our HMAC check).
155 - async-stripe = { version = "1.0.0-rc.6", features = ["default-tls"] }
155 + # `default-tls` is native-tls, which drags openssl-sys in through hyper-tls;
156 + # cargo-deny bans it. rustls-tls-native keeps the system trust store (matching
157 + # reqwest's platform verifier elsewhere in the tree) and carries the `__hyper`
158 + # feature the client needs; the provider must be named separately or
159 + # async-stripe's connector.rs refuses to compile.
160 + async-stripe = { version = "1.0.0-rc.6", default-features = false, features = ["rustls-tls-native", "rustls-aws-lc-rs"] }
156 161 async-stripe-shared = { version = "1.0.0-rc.6", features = ["deserialize"] }
157 162 async-stripe-billing = { version = "1.0.0-rc.6", features = ["deserialize", "subscription", "billing_portal_session"] }
158 163 async-stripe-checkout = { version = "1.0.0-rc.6", features = ["deserialize", "checkout_session"] }