[PR #542] [MERGED] Switch minreq TLS from webpki-roots to native certs (fixes #541) #556

New issue

Closed

opened 2026-03-02 04:13:57 +03:00 by kerem · 0 comments

kerem commented

2026-03-02 04:13:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/git-ai-project/git-ai/pull/542
Author: @svarlamov
Created: 2/17/2026
Status: ✅ Merged
Merged: 2/17/2026
Merged by: @svarlamov

Base: main ← Head: devin/1771338878-rustls-native-certs

📝 Commits (3)

528c9d2 Switch minreq TLS from webpki-roots to native certs (fixes #541)
947b2a8 Fix cargo fmt in TLS test file
4ee6336 Update rustls-native-certs to 0.8, remove flaky/env-dependent tests

📊 Changes

4 files changed (+146 additions, -10 deletions)

View changed files

📝 Cargo.lock (+66 -9)
📝 Cargo.toml (+2 -1)
📝 src/ci/gitlab.rs (+70 -0)
➕ tests/tls_native_certs.rs (+8 -0)

📄 Description

Switch minreq TLS to native OS certificate store (fixes #541)

Summary

Changes the minreq feature flag from https-rustls to https-rustls-probe so that TLS connections use the OS certificate store (rustls-native-certs) instead of the compiled-in Mozilla root CA bundle (webpki-roots). This allows users running self-hosted GitLab with custom/internal CA certificates to use git-ai ci gitlab by installing their CA into the system trust store.

The one-line Cargo.toml change affects all minreq HTTPS calls (GitLab CI API, main API client, Sentry, PostHog, JetBrains plugin downloads).

Also adds unit tests for the GitLab CI module (MR JSON deserialization, template YAML) and an integration test verifying the native cert store can be loaded.

Updates since last revision

Updated rustls-native-certs dev-dependency from 0.6 → 0.8 (latest)
Removed all tests that hit external URLs (gitlab.com, httpbin.org, etc.) — no more network-dependent tests
Removed env-var-manipulating #[serial] tests (the unsafe set_var/remove_var tests)
Remaining tests are all pure/deterministic: 4 deserialization/template unit tests + 1 local cert store loading test

Review & Testing Checklist for Human

Verify fallback in minimal containers: webpki-roots is fully removed from the dep tree. In stripped Docker images (e.g., FROM scratch or minimal Alpine without ca-certificates), the bundled Mozilla roots were silently making things work. With https-rustls-probe, if the OS cert store is empty, TLS connections will fail. Confirm this trade-off is acceptable for your user base.
Note: two versions of rustls-native-certs in lockfile: minreq internally pulls 0.6.3 (its own dependency); the dev-dep for tests is 0.8.3. This is harmless (test-only) but worth being aware of.
Recommended manual test: In a Docker container with a self-signed CA cert installed to the system store, run git-ai ci gitlab run against a self-hosted GitLab instance and confirm the UnknownIssuer error from #541 is resolved.

Notes

No test exercises a custom/self-signed CA end-to-end — the integration test only confirms the native cert store loads successfully. The actual fix is validated by the manual test above.
Requested by: @svarlamov
Link to Devin run

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/git-ai-project/git-ai/pull/542 **Author:** [@svarlamov](https://github.com/svarlamov) **Created:** 2/17/2026 **Status:** ✅ Merged **Merged:** 2/17/2026 **Merged by:** [@svarlamov](https://github.com/svarlamov) **Base:** `main` ← **Head:** `devin/1771338878-rustls-native-certs` --- ### 📝 Commits (3) - [`528c9d2`](https://github.com/git-ai-project/git-ai/commit/528c9d23cb5c5bd1a04d245da2dcca39826a6928) Switch minreq TLS from webpki-roots to native certs (fixes #541) - [`947b2a8`](https://github.com/git-ai-project/git-ai/commit/947b2a8bebb9dfbf59493be8463fd878b7b91e0e) Fix cargo fmt in TLS test file - [`4ee6336`](https://github.com/git-ai-project/git-ai/commit/4ee633690994b4b9114570bf1d03984d9a0a394c) Update rustls-native-certs to 0.8, remove flaky/env-dependent tests ### 📊 Changes **4 files changed** (+146 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+66 -9) 📝 `Cargo.toml` (+2 -1) 📝 `src/ci/gitlab.rs` (+70 -0) ➕ `tests/tls_native_certs.rs` (+8 -0) </details> ### 📄 Description # Switch minreq TLS to native OS certificate store (fixes #541) ## Summary Changes the `minreq` feature flag from `https-rustls` to `https-rustls-probe` so that TLS connections use the OS certificate store (`rustls-native-certs`) instead of the compiled-in Mozilla root CA bundle (`webpki-roots`). This allows users running self-hosted GitLab with custom/internal CA certificates to use `git-ai ci gitlab` by installing their CA into the system trust store. The one-line `Cargo.toml` change affects **all** `minreq` HTTPS calls (GitLab CI API, main API client, Sentry, PostHog, JetBrains plugin downloads). Also adds unit tests for the GitLab CI module (MR JSON deserialization, template YAML) and an integration test verifying the native cert store can be loaded. ### Updates since last revision - Updated `rustls-native-certs` dev-dependency from `0.6` → `0.8` (latest) - Removed all tests that hit external URLs (gitlab.com, httpbin.org, etc.) — no more network-dependent tests - Removed env-var-manipulating `#[serial]` tests (the `unsafe` set_var/remove_var tests) - Remaining tests are all pure/deterministic: 4 deserialization/template unit tests + 1 local cert store loading test ## Review & Testing Checklist for Human - [ ] **Verify fallback in minimal containers**: `webpki-roots` is fully removed from the dep tree. In stripped Docker images (e.g., `FROM scratch` or minimal Alpine **without** `ca-certificates`), the bundled Mozilla roots were silently making things work. With `https-rustls-probe`, if the OS cert store is empty, TLS connections will fail. Confirm this trade-off is acceptable for your user base. - [ ] **Note: two versions of `rustls-native-certs` in lockfile**: minreq internally pulls `0.6.3` (its own dependency); the dev-dep for tests is `0.8.3`. This is harmless (test-only) but worth being aware of. - [ ] **Recommended manual test**: In a Docker container with a self-signed CA cert installed to the system store, run `git-ai ci gitlab run` against a self-hosted GitLab instance and confirm the `UnknownIssuer` error from #541 is resolved. ### Notes - No test exercises a custom/self-signed CA end-to-end — the integration test only confirms the native cert store loads successfully. The actual fix is validated by the manual test above. - Requested by: @svarlamov - [Link to Devin run](https://app.devin.ai/sessions/f44ce4708a064a9ea56868004e4789a2) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>