Skip to content

[Rust] The reqwest(-trait) library must not enable any default feature #21933

Description

@JMLX42

Is your feature request related to a problem? Please describe.

Follow up on #21925 (comment)

As of today, the default features for reqwest is set to ["native-tls"]. This is a problem and IMHO a bad practice. The way Cargo resolves (workspace) dependencies will cause the reqwest/native-tls to always be enabled (even if the user sets default-features = false for reqwest. As a consequence, a transitive dependency to openssl-sys is pulled, which can lead to multiple problems:

  1. OpenSSL might not be available on the target (ex: using cross to build for Android).
  2. OpenSSL is an unsafe SSL implementation, and Rust developers would most likely want the possibility to avoid it/not depend on it/not build it. It might be worth noting reqwest might switch to rustls by default (cf Consider switching to rustls as the default seanmonstar/reqwest#2025).

IMHO as a rule of thumb, I think it's best to keep default features to a minimum for libs anyway.

Describe the solution you'd like

[features]
default = []

IDK if it is considered a breaking change: bins/libs that rely on the Rust SDK generated by OpenAPI Generator will not build anymore if and only if they do not already depend on reqwest with default-features = false and not TLS backend feature configured (default-tls, rustls-tls or native-tls). Otherwise, the default-tls feature is enabled and will be used instead of native-tls.

Describe alternatives you've considered

Override Cargo.mustache.

Additional context

Follow up on #21925 (comment)

Requires #21925 to be merged first.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions