Skip to content

[Rust] The reqwest(-trait) library must not enable any default feature #21933

@JMLX42

Description

@JMLX42

Is your feature request related to a problem? Please describe.

Follow up on #21925 (comment)

As of today, the default features for reqwest is set to ["native-tls"]. This is a problem and IMHO a bad practice. The way Cargo resolves (workspace) dependencies will cause the reqwest/native-tls to always be enabled (even if the user sets default-features = false for reqwest. As a consequence, a transitive dependency to openssl-sys is pulled, which can lead to multiple problems:

  1. OpenSSL might not be available on the target (ex: using cross to build for Android).
  2. OpenSSL is an unsafe SSL implementation, and Rust developers would most likely want the possibility to avoid it/not depend on it/not build it. It might be worth noting reqwest might switch to rustls by default (cf Consider switching to rustls as the default seanmonstar/reqwest#2025).

IMHO as a rule of thumb, I think it's best to keep default features to a minimum for libs anyway.

Describe the solution you'd like

[features]
default = []

IDK if it is considered a breaking change: bins/libs that rely on the Rust SDK generated by OpenAPI Generator will not build anymore if and only if they do not already depend on reqwest with default-features = false and not TLS backend feature configured (default-tls, rustls-tls or native-tls). Otherwise, the default-tls feature is enabled and will be used instead of native-tls.

Describe alternatives you've considered

Override Cargo.mustache.

Additional context

Follow up on #21925 (comment)

Requires #21925 to be merged first.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions