Crash: rust-webpki-roots causes crash on Android

[0xWildhare]

Problem

When using the rustls, by default rustls-platform-verifier is used, this causes a crash if rustls_platform_verifier::android::init_hosted() has not been called before. Version 0.12 worked fine via the feature flag rustls-tls-webpki-roots-no-provider which skipped any native TLS certificate initialization and used webpki certs.

Proposed Solution

Add a new feature flag like rustls-webpki-roots (or rustls-tls-webpki-roots) that uses webpki-roots for certificate verification instead of rustls-platform-verifier, similar to 0.12's behavior.

Use Case

Android apps using Rust for networking that want to upgrade to reqwest 0.13 without adding JNI initialization code.

Workaround

Stay on reqwest 0.12 or implement Android-specific JNI initialization.

[ospfranco]

Link to the rustls-platform-verifier Android setup

https://github.com/rustls/rustls-platform-verifier#android

It's quite complex and lenghty.

[seanmonstar]

I'd like to prevent the 0.12.x scenario of a bunch of different roots features. I do get that rustls-platform-verifier to work on Android is significantly more work than reqwest used to be.

I suppose we could add a rustls-no-provider-no-roots feature that also disables any verifier besides whatever exact certs you add manually.

I'm not sure how else to make it better in reqwest. Maybe there's something that can be done in rustls-platform-verifier, unsure.

cc @djc @ctz

[ospfranco]

@seanmonstar I think that's an ok solution, as long as it is properly documented. There is currently no mention of rustls-platform-verifier, I had to spelunk and ask claude a to write the integration with gradle to actually make it work.

Another doubt I have is if it's ok to add rustls-platform-verifier as a separate dependency which I had to do in order to install the kotlin component. I say this because it introduces a manual step of keeping the versions in sync, the one I added manually and the one that reqwest 0.13 depends upon.

[ctz]

Maybe there's something that can be done in rustls-platform-verifier, unsure.

It is tricky.

One goal is that rustls-platform-verifier uses the most-native possible way of verifying certificates on a given target platform. For Android that involves calling a Java API (there is no NDK API for this), and doing that requires one-time setup to communicate the JNIEnv* so that JNI can be used. I think if this was going to become easier, it would have happened a long time ago when Google introduced the NDK; I wouldn't hold out much hope that this gets much easier.

It is unfortunate that there is no standard build target describing "android, but no java" which would give rustls-platform-verifier a way of doing something useful and non-surprising.