chore(trust): improve unreachable branch in certificate loading (#1167)

* chore(trust): improve unreachable branch in certificate loading

* fmt

Author: 0x676e67

src/client.rs

@@ -226,7 +226,7 @@ struct Config {
     tls_sni: bool,
     tls_verify_hostname: bool,
     tls_identity: Option<Identity>,
-    tls_cert_store: CertStore,
+    tls_cert_store: Option<CertStore>,
     tls_cert_verification: bool,
     tls_min_version: Option<TlsVersion>,
     tls_max_version: Option<TlsVersion>,
@@ -312,7 +312,7 @@ impl Client {
                 tls_sni: true,
                 tls_verify_hostname: true,
                 tls_identity: None,
-                tls_cert_store: CertStore::default(),
+                tls_cert_store: None,
                 tls_cert_verification: true,
                 tls_min_version: None,
                 tls_max_version: None,
@@ -1386,7 +1386,7 @@ impl ClientBuilder {
     /// for TLS connections. By default, the system's verify certificate store is used.
     #[inline]
     pub fn tls_cert_store(mut self, store: CertStore) -> ClientBuilder {
-        self.config.tls_cert_store = store;
+        self.config.tls_cert_store = Some(store);
         self
     }
 

src/tls/conn/ext.rs

@@ -46,6 +46,24 @@ impl SslConnectorBuilderExt for SslConnectorBuilder {
         if let Some(store) = store {
             self.set_cert_store_ref(&store.0)
         } else {
+            #[cfg(feature = "webpki-roots")]
+            {
+                static LOAD_CERTS: std::sync::OnceLock<crate::Result<CertStore>> =
+                    std::sync::OnceLock::new();
+
+                if let Ok(store) = LOAD_CERTS.get_or_init(|| {
+                    CertStore::from_der_certs(webpki_root_certs::TLS_SERVER_ROOT_CERTS).map_err(
+                        |err| {
+                            warn!("Failed to load webpki root certificates: {:?}", err);
+                            err
+                        },
+                    )
+                }) {
+                    self.set_cert_store_ref(&store.0);
+                    return Ok(self);
+                }
+            }
+
             self.set_default_verify_paths().map_err(Error::tls)?;
         }
 

src/tls/trust/store.rs

@@ -8,14 +8,44 @@ use super::{
 };
 use crate::{Error, Result};
 
-/// A builder for constructing a `CertStore`.
+/// A builder for constructing a [`CertStore`].
 pub struct CertStoreBuilder {
     builder: Result<X509StoreBuilder>,
 }
 
-// ====== impl CertStoreBuilder ======
-
 impl CertStoreBuilder {
+    fn parse_cert<'c, C, P>(mut self, cert: C, parser: P) -> Self
+    where
+        C: Into<CertificateInput<'c>>,
+        P: Fn(&'c [u8]) -> Result<Certificate>,
+    {
+        if let Ok(ref mut builder) = self.builder {
+            let input = cert.into();
+            let result = input
+                .with_parser(parser)
+                .and_then(|cert| builder.add_cert(cert.0).map_err(Error::tls));
+
+            if let Err(err) = result {
+                self.builder = Err(err);
+            }
+        }
+        self
+    }
+
+    fn parse_certs<'c, I>(mut self, certs: I, parser: fn(&'c [u8]) -> Result<Certificate>) -> Self
+    where
+        I: IntoIterator,
+        I::Item: Into<CertificateInput<'c>>,
+    {
+        if let Ok(ref mut builder) = self.builder {
+            let certs = filter_map_certs(certs, parser);
+            if let Err(err) = process_certs(certs, builder) {
+                self.builder = Err(err);
+            }
+        }
+        self
+    }
+
     /// Adds a DER-encoded certificate to the certificate store.
     #[inline]
     pub fn add_der_cert<'c, C>(self, cert: C) -> Self
@@ -84,9 +114,9 @@ impl CertStoreBuilder {
         self
     }
 
-    /// Constructs the `CertStore`.
+    /// Constructs the [`CertStore`].
     ///
-    /// This method finalizes the builder and constructs the `CertStore`
+    /// This method finalizes the builder and constructs the [`CertStore`]
     /// containing all the added certificates.
     #[inline]
     pub fn build(self) -> Result<CertStore> {
@@ -97,40 +127,6 @@ impl CertStoreBuilder {
     }
 }
 
-impl CertStoreBuilder {
-    fn parse_cert<'c, C, P>(mut self, cert: C, parser: P) -> Self
-    where
-        C: Into<CertificateInput<'c>>,
-        P: Fn(&'c [u8]) -> Result<Certificate>,
-    {
-        if let Ok(ref mut builder) = self.builder {
-            let input = cert.into();
-            let result = input
-                .with_parser(parser)
-                .and_then(|cert| builder.add_cert(cert.0).map_err(Error::tls));
-
-            if let Err(err) = result {
-                self.builder = Err(err);
-            }
-        }
-        self
-    }
-
-    fn parse_certs<'c, I>(mut self, certs: I, parser: fn(&'c [u8]) -> Result<Certificate>) -> Self
-    where
-        I: IntoIterator,
-        I::Item: Into<CertificateInput<'c>>,
-    {
-        if let Ok(ref mut builder) = self.builder {
-            let certs = filter_map_certs(certs, parser);
-            if let Err(err) = process_certs(certs, builder) {
-                self.builder = Err(err);
-            }
-        }
-        self
-    }
-}
-
 /// A thread-safe certificate store for TLS connections.
 ///
 /// [`CertStore`] manages a collection of trusted certificates used for verifying peer identities.
@@ -147,18 +143,16 @@ impl CertStoreBuilder {
 #[derive(Clone)]
 pub struct CertStore(pub(in crate::tls) Arc<X509Store>);
 
-// ====== impl CertStore ======
-
 impl CertStore {
-    /// Creates a new `CertStoreBuilder`.
+    /// Creates a new [`CertStoreBuilder`].
     #[inline]
     pub fn builder() -> CertStoreBuilder {
         CertStoreBuilder {
             builder: X509StoreBuilder::new().map_err(Error::builder),
         }
     }
 
-    /// Creates a new `CertStore` from a collection of DER-encoded certificates.
+    /// Creates a new [`CertStore`] from a collection of DER-encoded certificates.
     #[inline]
     pub fn from_der_certs<'c, C>(certs: C) -> Result<CertStore>
     where
@@ -170,7 +164,7 @@ impl CertStore {
             .map(CertStore)
     }
 
-    /// Creates a new `CertStore` from a collection of PEM-encoded certificates.
+    /// Creates a new [`CertStore`] from a collection of PEM-encoded certificates.
     #[inline]
     pub fn from_pem_certs<'c, C>(certs: C) -> Result<CertStore>
     where
@@ -182,7 +176,7 @@ impl CertStore {
             .map(CertStore)
     }
 
-    /// Creates a new `CertStore` from a PEM-encoded certificate stack.
+    /// Creates a new [`CertStore`] from a PEM-encoded certificate stack.
     #[inline]
     pub fn from_pem_stack<C>(certs: C) -> Result<CertStore>
     where
@@ -193,26 +187,3 @@ impl CertStore {
             .map(CertStore)
     }
 }
-
-impl Default for CertStore {
-    fn default() -> Self {
-        #[cfg(feature = "webpki-roots")]
-        static LOAD_CERTS: std::sync::LazyLock<CertStore> = std::sync::LazyLock::new(|| {
-            CertStore::builder()
-                .add_der_certs(webpki_root_certs::TLS_SERVER_ROOT_CERTS)
-                .build()
-                .expect("failed to load default cert store")
-        });
-
-        #[cfg(not(feature = "webpki-roots"))]
-        {
-            CertStore::builder()
-                .set_default_paths()
-                .build()
-                .expect("failed to load default cert store")
-        }
-
-        #[cfg(feature = "webpki-roots")]
-        LOAD_CERTS.clone()
-    }
-}