kumo_http_client/
lib.rs

1//! A reqwest client builder pinned to the OS certificate store.
2
3/// Returns a reqwest `ClientBuilder` that trusts only the OS certificate store.
4/// Callers add their own settings, then `build`. This is the one sanctioned
5/// place to construct a reqwest client. A clippy `disallowed-methods` lint
6/// forbids reqwest `Client::builder`/`Client::new` elsewhere.
7#[allow(clippy::disallowed_methods)]
8pub fn builder() -> reqwest::ClientBuilder {
9    // reqwest also accepts certificates signed by a Mozilla root set compiled
10    // into the binary whenever its rustls-tls-webpki-roots feature is on,
11    // which a transitive dependency (vaultrs' rustify) forces on build-wide.
12    // A CA pulled from the OS store would still be vouched for by that
13    // compiled-in set. We disable it here, leaving the OS store as the only
14    // trust source.
15    reqwest::Client::builder().tls_built_in_webpki_certs(false)
16}