fix: replace per-build keychain enumeration with shared platform verification

Author: ualtinok

Cargo.lock

@@ -100,9 +100,11 @@ base64 = "0.22"
 image = { version = "0.25", default-features = false, features = ["png", "jpeg", "gif", "webp"] }
 memchr = "2"
 rayon = "1"
-# Keep the Mozilla bundle and platform roots active together so private/corporate
-# CAs are trusted without losing the static webpki fallback.
-reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls", "rustls-tls-native-roots"] }
+# Use rustls-platform-verifier for per-connection OS trust checks instead of
+# enumerating native roots while every reqwest client is built.
+reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+rustls = { version = "0.23", default-features = false, features = ["ring"] }
+rustls-platform-verifier = "0.6"
 tree-sitter-scss = { package = "cortexkit-tree-sitter-scss", version = "1.0.1" }
 # Local embedding backend (all-MiniLM-L6-v2) driven directly through ort, so we
 # control intra-op thread count (fastembed hardcoded all-cores). hf-hub fetches
@@ -135,4 +137,3 @@ landlock = "=0.4.5"
 tempfile = "3"
 filetime = "0.2"
 rcgen = "0.13"
-rustls = { version = "0.23", default-features = false, features = ["ring"] }

crates/aft/Cargo.toml

@@ -92,6 +92,7 @@ pub mod parser;
 pub mod patch;
 pub mod path_identity;
 pub mod pattern_compile;
+mod platform_tls;
 pub mod protocol;
 pub mod pty_render;
 pub mod query_shape;

crates/aft/src/lib.rs

@@ -0,0 +1,24 @@
+use std::sync::OnceLock;
+
+use rustls::ClientConfig;
+use rustls_platform_verifier::ConfigVerifierExt;
+
+static PLATFORM_VERIFIER_CONFIG: OnceLock<Result<ClientConfig, String>> = OnceLock::new();
+
+/// Return the process-wide platform-verifier TLS configuration.
+///
+/// The configuration is initialized only when the first HTTPS-capable client is
+/// built. Cloning it for reqwest is cheap because the verifier and its shared
+/// state are reference counted; importantly, native trust decisions remain
+/// connection-time work instead of per-client root-store enumeration.
+pub(crate) fn client_config() -> Result<ClientConfig, String> {
+    PLATFORM_VERIFIER_CONFIG
+        .get_or_init(|| {
+            // Reqwest enables rustls' ring provider, but does not install a
+            // process default provider for callers that supply their own config.
+            let _ = rustls::crypto::ring::default_provider().install_default();
+            ClientConfig::with_platform_verifier()
+                .map_err(|error| format!("failed to create platform TLS verifier: {error}"))
+        })
+        .clone()
+}