Upgrade reqwest to 0.13 (#18550)
The following user-facing changes are included here: - `aws-lc` is used instead of `ring` for a cryptography backend - Expands our certificate signature algorithm support to include ECDSA_P256_SHA512, ECDSA_P384_SHA512, ECDSA_P521_SHA256, ECDSA_P521_SHA384, and ECDSA_P521_SHA512 - `--native-tls` is deprecated in favor of a new `--system-certs` flag, avoiding confusion with the TLS implementation used (we use `rustls` not `native-tls`, see prior confusion at https://github.com/astral-sh/uv/issues/11595) - NASM is a new build requirement on Windows, it is required by `aws-lc` on x86-64 and i386 - `rustls-platform-verifier` is used instead of `rustls-native-certs` for system certificate verification - On macOS, certificate validation is now delegated to `Security.framework` (`SecTrust`). Performance when using `--system-certs` is improved by avoiding exporting and parsing all the certificates from the keychain at startup. - On Windows, certificate validation is now delegated to `CertGetCertificateChain` and `CertVerifyCertificateChainPolicy` - On Linux, certificate validation should be approximately unchanged - Some previously failing chains may succeed, and some previously accepted chains may fail; generally, this should result in behavior closer matching browsers and other native applications - macOS and Windows may now perform live OCSP fetches for early revocation, which could add latency to some requests - Empty `SSL_CERT_FILE` values are ignored (for consistency with `SSL_CERT_DIR`) The following internal changes are included here: - Certificate loading has been refactored to use a newtype with helper methods - The certificate tests have been rewritten - We use `webpki-root-certs` instead of `webpki-roots`, see https://github.com/astral-sh/uv/pull/17543#discussion_r2820187691 - We request `identity` encoding for range requests, see https://github.com/astral-sh/async_http_range_reader/pull/3#discussion_r2700194798 - Various dependencies (including forks) updates to versions which use reqwest 0.13+ This is a replacement of #17543 with an updated description. See that pull request for prior discussion. I've made the following changes from the initial approach there: - Previously, the `native-tls` TLS implementation was added which included an OpenSSL build. We don't currently use the `native-tls` implementation, but the `--native-tls` flag there was erroneously updated to enable it. - Previously, there was a `--tls-backend` flag to toggle between `native-tls` and `rustls`. Since we currently always use `rustls`, this is deferred to future work (if we need it at all). - Previously, there were unintentional breaking changes to `SSL_CERT_FILE` and `SSL_CERT_DIR` handling, including merging with the base certificates instead of replacing them, dropping support for OpenSSL hash-named certificate files, skipping deduplication of certificates. Here, we retain use of `rustls-native-certs` for loading certificates from the system as it handles these edge cases. Closes https://github.com/astral-sh/uv/issues/17427 --------- Co-authored-by: salmonsd <22984014+salmonsd@users.noreply.github.com>
This commit is contained in:
Zanie Blue
@@ -307,7 +307,9 @@ jobs:
|
||||
echo "CC_aarch64_linux_android=${TOOLCHAIN}/bin/aarch64-linux-android24-clang" >> "$GITHUB_ENV"
|
||||
echo "CXX_aarch64_linux_android=${TOOLCHAIN}/bin/aarch64-linux-android24-clang++" >> "$GITHUB_ENV"
|
||||
echo "AR_aarch64_linux_android=${TOOLCHAIN}/bin/llvm-ar" >> "$GITHUB_ENV"
|
||||
echo "RANLIB_aarch64_linux_android=${TOOLCHAIN}/bin/llvm-ranlib" >> "$GITHUB_ENV"
|
||||
echo "CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER=${TOOLCHAIN}/bin/aarch64-linux-android24-clang" >> "$GITHUB_ENV"
|
||||
echo "CARGO_TARGET_AARCH64_LINUX_ANDROID_RANLIB=${TOOLCHAIN}/bin/llvm-ranlib" >> "$GITHUB_ENV"
|
||||
|
||||
# NDK 23+ removed libgcc, provide a stub that redirects to libunwind
|
||||
LIBDIR=$(echo "${TOOLCHAIN}"/lib/clang/*/lib/linux/aarch64)
|
||||
|
||||
@@ -256,7 +256,14 @@ jobs:
|
||||
- name: "Install cargo extensions"
|
||||
shell: bash
|
||||
run: scripts/install-cargo-extensions.sh
|
||||
|
||||
- name: "Install NASM"
|
||||
# NASM is required for x86/x86-64 Windows targets by aws-lc-sys.
|
||||
# On aarch64-pc-windows-msvc, it uses clang-cl instead.
|
||||
# See: https://aws.github.io/aws-lc-rs/requirements/windows.html#build-requirements
|
||||
if: contains(matrix.platform.target, 'x86') || contains(matrix.platform.target, 'i686')
|
||||
run: |
|
||||
winget install NASM.NASM --accept-source-agreements --accept-package-agreements
|
||||
echo "C:\Program Files\NASM" | Out-File -FilePath $env:GITHUB_PATH -Append
|
||||
# uv
|
||||
- name: "Build wheels"
|
||||
uses: PyO3/maturin-action@04ac600d27cdf7a9a280dadf7147097c42b757ad # v1.50.1
|
||||
@@ -266,6 +273,8 @@ jobs:
|
||||
args: --release --locked --out dist --features self-update,windows-gui-bin --compatibility pypi
|
||||
env:
|
||||
CARGO: ${{ github.workspace }}/scripts/cargo.cmd
|
||||
# Disable prebuilt NASM objects so we always compile assembly from source.
|
||||
AWS_LC_SYS_PREBUILT_NASM: "0"
|
||||
- name: "Test wheel"
|
||||
shell: bash
|
||||
run: |
|
||||
@@ -351,25 +360,25 @@ jobs:
|
||||
manylinux: 2_17
|
||||
docker-options: -e CARGO
|
||||
args: --release --locked --out dist --features self-update --compatibility pypi
|
||||
# See: https://github.com/sfackler/rust-openssl/issues/2036#issuecomment-1724324145
|
||||
before-script-linux: |
|
||||
# Install the 32-bit cross target on 64-bit (noop if we're already on 64-bit)
|
||||
rustup target add ${{ matrix.target }}
|
||||
# If we're running on rhel centos, install needed packages.
|
||||
if command -v yum &> /dev/null; then
|
||||
yum update -y && yum install -y perl-core openssl openssl-devel pkgconfig libatomic
|
||||
yum update -y && yum install -y pkgconfig libatomic
|
||||
|
||||
# If we're running on i686 we need to symlink libatomic
|
||||
# in order to build openssl with -latomic flag.
|
||||
if [[ ! -d "/usr/lib64" ]]; then
|
||||
# Install cross build requirements
|
||||
if [[ "${{ matrix.target }}" == "i686-unknown-linux-gnu" ]]; then
|
||||
yum install -y glibc-devel.i686 libstdc++-devel.i686 libatomic.i686
|
||||
fi
|
||||
|
||||
# Symlink libatomic so the linker can find it with -latomic.
|
||||
if [[ -f "/usr/lib/libatomic.so.1" && ! -f "/usr/lib/libatomic.so" ]]; then
|
||||
ln -s /usr/lib/libatomic.so.1 /usr/lib/libatomic.so
|
||||
else
|
||||
# Support cross-compiling from 64-bit to 32-bit
|
||||
yum install -y glibc-devel.i686 libstdc++-devel.i686
|
||||
fi
|
||||
else
|
||||
# If we're running on debian-based system.
|
||||
apt update -y && apt-get install -y libssl-dev openssl pkg-config
|
||||
apt update -y && apt-get install -y pkg-config
|
||||
fi
|
||||
# Install cargo extensions as a static musl binary so it runs in any container.
|
||||
scripts/install-cargo-extensions.sh
|
||||
@@ -595,8 +604,12 @@ jobs:
|
||||
rust-toolchain: ${{ matrix.platform.toolchain || null }}
|
||||
before-script-linux: |
|
||||
scripts/install-cargo-extensions.sh
|
||||
# Install the s390x cross target on x86_64
|
||||
rustup target add ${{ matrix.platform.target }}
|
||||
apt-get update && apt-get install -y gcc-s390x-linux-gnu binutils-s390x-linux-gnu
|
||||
env:
|
||||
CARGO: ${{ github.workspace }}/scripts/cargo.sh
|
||||
|
||||
- uses: uraimo/run-on-arch-action@d94c13912ea685de38fccc1109385b83fd79427d # v3.0.1
|
||||
name: "Test wheel"
|
||||
with:
|
||||
|
||||
Reference in New Issue
Block a user