about summary refs log tree commit diff
path: root/tvix/store
diff options
context:
space:
mode:
authorFlorian Klink <flokli@flokli.de>2024-03-03T14·47+0200
committerflokli <flokli@flokli.de>2024-03-03T15·32+0000
commit1c16dee2078999f61e31194bbe793790facf0e98 (patch)
tree33414d2fd63aab562db4eaca67a67e72d98a25a4 /tvix/store
parent4b4443240e45c5200d3135acccd4e52ffa8d706c (diff)
feat(tvix/store): use reqwests' rustls-native-roots feature r/7642
This makes reqwest honor `SSL_CERT_FILE` - previously it was using the
chain bundled in webpki-roots.

`object_store` pulls in `reqwest` with this feature, and the cargo
solver will enable that feature globally as soon as we pull it in, as it
assumes features are additive.

This requires setting `SSL_CERT_FILE` when running tests, otherwise
they'll fail with the unhelpful "NotFound" error.

This was quite some fun to debug, why adding `object_store` to
tvix-castore suddenly made tvix-store tests fail!

Change-Id: I64fc82b4d994715480efdb1ffecb279716456ab9
Reviewed-on: https://cl.tvl.fyi/c/depot/+/11090
Reviewed-by: raitobezarius <tvl@lahfa.xyz>
Tested-by: BuildkiteCI
Diffstat (limited to 'tvix/store')
-rw-r--r--tvix/store/Cargo.toml2
-rw-r--r--tvix/store/default.nix4
2 files changed, 5 insertions, 1 deletions
diff --git a/tvix/store/Cargo.toml b/tvix/store/Cargo.toml
index bf0d3413609c..ec7acbd562be 100644
--- a/tvix/store/Cargo.toml
+++ b/tvix/store/Cargo.toml
@@ -36,7 +36,7 @@ tvix-castore = { path = "../castore" }
 url = "2.4.0"
 walkdir = "2.4.0"
 async-recursion = "1.0.5"
-reqwest = { version = "0.11.22", features = ["rustls-tls", "stream"], default-features = false }
+reqwest = { version = "0.11.22", features = ["rustls-tls-native-roots", "stream"], default-features = false }
 xz2 = "0.1.7"
 
 [dependencies.tonic-reflection]
diff --git a/tvix/store/default.nix b/tvix/store/default.nix
index 35d2a22bb2ce..2c07cdf2b31f 100644
--- a/tvix/store/default.nix
+++ b/tvix/store/default.nix
@@ -24,6 +24,10 @@ in
 
 (depot.tvix.crates.workspaceMembers.tvix-store.build.override {
   runTests = true;
+  testPreRun = ''
+    export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt;
+  '';
+
   # virtiofs feature currently fails to build on Darwin.
   # we however can ship it for non-darwin.
   features = if pkgs.stdenv.isDarwin then [ "default" ] else [ "default" "virtiofs" ];