fix(app): explicitly use ring crypto provider

Cargo.toml

@@ -182,7 +182,7 @@ rust-s3 = { version = "0.38.0", default-features = false, features = [
   "tags",
   "tokio-rustls-tls",
 ] }
-rustls = "0.23.46"
+rustls = { version = "0.23.46", default-features = false }
 rustrict = { version = "0.7.39", default-features = false, features = ["censor"] }
 rusty-money = "0.5.1"
 same-file = "1.0.6"

apps/app-playground/src/main.rs

@@ -39,6 +39,7 @@ pub async fn authenticate_run() -> theseus::Result<Credentials> {
 async fn main() -> theseus::Result<()> {
     println!("Starting.");
 
+    theseus::install_crypto_provider();
     let _log_guard = theseus::start_logger("ModrinthApp");
 
     // Initialize state

apps/app/Cargo.toml

@@ -52,6 +52,9 @@ zip = { workspace = true }
 workspace = true
 features = ["devtools", "macos-private-api", "protocol-asset"]
 
+[dev-dependencies]
+rustls = { workspace = true, features = ["std"] }
+
 [build-dependencies]
 tauri-build = { workspace = true, features = ["codegen"] }
 

apps/app/package.json

@@ -6,6 +6,7 @@
 		"dev": "tauri dev --features export-app-events",
 		"lint": "cargo clippy --all-targets --features updater",
 		"lint:ancillary": "prettier --check .",
+		"test": "cargo nextest run --all-targets --no-fail-fast --locked --features updater",
 		"fix": "cargo clippy --all-targets --features updater --fix --allow-dirty",
 		"fix:ancillary": "prettier --write ."
 	},

apps/app/src/main.rs

@@ -115,6 +115,8 @@ async fn set_restart_after_pending_update(
 // if Tauri app is called with arguments, then those arguments will be treated as commands
 // ie: deep links or filepaths for .mrpacks
 fn main() {
+    theseus::install_crypto_provider();
+
     let runtime = tokio::runtime::Builder::new_multi_thread()
         .enable_all()
         .build()
@@ -491,3 +493,16 @@ fn main() {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    /// Builds a TLS config the way crates relying on rustls's process-level
+    /// provider do (e.g. async-tungstenite for the friends socket), with the
+    /// app's full dependency graph. This only fails here, not in app-lib's
+    /// own tests, because a conflicting provider feature can come from
+    /// unifying app-lib's dependencies with the Tauri plugins'.
+    #[test]
+    fn rustls_process_provider_is_resolvable() {
+        let _ = rustls::ClientConfig::builder();
+    }
+}

apps/labrinth/Cargo.toml

@@ -95,7 +95,13 @@ regex = { workspace = true }
 reqwest = { workspace = true, features = ["http2", "json", "multipart", "rustls"] }
 rust_decimal = { workspace = true, features = ["serde-with-float", "serde-with-str"] }
 rust_iso3166 = { workspace = true }
-rustls.workspace = true
+rustls = { workspace = true, features = [
+  "aws_lc_rs",
+  "logging",
+  "prefer-post-quantum",
+  "std",
+  "tls12",
+] }
 rustrict = { workspace = true }
 rusty-money = { workspace = true }
 scalar_api_reference = { workspace = true, features = ["actix-web"] }

packages/app-lib/Cargo.toml

@@ -71,11 +71,12 @@ reqwest = { workspace = true, features = [
   "http2",
   "json",
   "multipart",
-  "rustls",
+  "rustls-no-provider",
   "stream",
   "system-proxy",
 ] }
 rgb = { workspace = true }
+rustls = { workspace = true, features = ["logging", "ring", "std", "tls12"] }
 same-file = { workspace = true }
 serde = { workspace = true, features = ["derive", "rc"] }
 serde-binhum = { workspace = true }

packages/app-lib/src/lib.rs

@@ -30,6 +30,14 @@ pub use logger::start_logger;
 pub use state::State;
 pub use util::fetch::DownloadReason;
 
+/// Installs `ring` as the process-wide rustls crypto provider.
+///
+/// Must be called before any TLS connection is made: reqwest is built with
+/// `rustls-no-provider` and the friends socket relies on the process default.
+pub fn install_crypto_provider() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+}
+
 pub fn launcher_user_agent() -> String {
     const LAUNCHER_BASE_USER_AGENT: &str =
         concat!("modrinth/theseus/", env!("CARGO_PKG_VERSION"),);