0003-Patch-code-to-use-native-tls-instead-of-rustls.patch

From c84ef27423275d1de3688322d04ccf0f863fbead Mon Sep 17 00:00:00 2001
From: Rodolfo Olivieri <rodolfo.olivieri3@gmail.com>
Date: Tue, 10 Feb 2026 12:07:23 -0300
Subject: [PATCH 3/4] Patch code to use native-tls instead of rustls

* Remove rustls default provider installation from lapstone tunnel
* Patched providers/api_cilent.rs to allow using from_pkcs8_pem due to
  native-tls
---
 crates/goose-server/src/tunnel/lapstone.rs |  2 --
 crates/goose/src/providers/api_client.rs   | 10 ++++------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/crates/goose-server/src/tunnel/lapstone.rs b/crates/goose-server/src/tunnel/lapstone.rs
index c824a39af..8449abc42 100644
--- a/crates/goose-server/src/tunnel/lapstone.rs
+++ b/crates/goose-server/src/tunnel/lapstone.rs
@@ -477,8 +477,6 @@ async fn run_single_connection(
     server_secret: String,
     restart_tx: mpsc::Sender<()>,
 ) {
-    let _ = rustls::crypto::ring::default_provider().install_default();
-
     let worker_url = get_worker_url();
     let ws_url = worker_url
         .replace("https://", "wss://")
diff --git a/crates/goose/src/providers/api_client.rs b/crates/goose/src/providers/api_client.rs
index 9f4feefe8..e4ebef458 100644
--- a/crates/goose/src/providers/api_client.rs
+++ b/crates/goose/src/providers/api_client.rs
@@ -119,12 +119,10 @@ impl TlsConfig {
             let key_pem = read_to_string(&cert_key_pair.key_path)
                 .map_err(|e| anyhow::anyhow!("Failed to read client private key: {}", e))?;
 
-            // Create a combined PEM file with certificate and private key
-            let combined_pem = format!("{}\n{}", cert_pem, key_pem);
-
-            let identity = Identity::from_pem(combined_pem.as_bytes()).map_err(|e| {
-                anyhow::anyhow!("Failed to create identity from cert and key: {}", e)
-            })?;
+            let identity = Identity::from_pkcs8_pem(cert_pem.as_bytes(), key_pem.as_bytes())
+                .map_err(|e| {
+                    anyhow::anyhow!("Failed to create identity from cert and key: {}", e)
+                })?;
 
             Ok(Some(identity))
         } else {
-- 
2.53.0