From 6759ceac5facb59512bb2dee035189169b2e08f6 Mon Sep 17 00:00:00 2001
From: Denis Cornehl <denis@cornehl.org>
Date: Wed, 21 Oct 2026 09:18:30 +0200
Subject: [PATCH] support rustls instead of native-tls for https calls

---
 .github/workflows/main.yml |  3 ++-
 Cargo.toml                 |  6 ++++--
 README.md                  | 12 ++++++++++++
 3 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 4c41bb6b..2c9b9c8c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -64,7 +64,8 @@ jobs:
         os: [ubuntu-22.04, windows-latest]
         cargo_flags:
           - ""
-          - "--no-default-features"
+          - "--no-default-features --features tls-native"
+          - "--no-default-features --features tls-rustls"
           - "--features tracing"
           - "--all-features"
         docker_runtime:
diff --git a/Cargo.toml b/Cargo.toml
index ef3c659c..f3ce8f36 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,10 +14,12 @@ readme = "README.md"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [features]
-default = ["git-registries"]
+default = ["git-registries", "tls-native"]
 
 git-registries = ["dep:git2"]
 alternate-registries = ["git-registries"]
+tls-native = ["attohttpc/tls-native"]
+tls-rustls = ["attohttpc/tls-rustls"]
 unstable = []
 unstable-toolchain-ci = []
 tracing = ["dep:tracing"]
@@ -31,7 +33,7 @@ tokio-stream = { version = "0.1", features = ["io-util"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 tempfile = "3.0.0"
-attohttpc = "0.31.0"
+attohttpc = { version = "0.31.0", default-features = false, features = ["compress"] }
 flate2 = "1"
 tar = "0.4.0"
 percent-encoding = "2.1.0"
diff --git a/README.md b/README.md
index 5bad9156..235df1f3 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,18 @@ projects like [Crater] and [docs.rs]. It features:
 Rustwide was originally part of the [Crater] project, and it was extracted to
 let the whole community benefit from it.
 
+Rustwide uses native TLS by default. To use Rustls with WebPKI root certificates
+for HTTP requests, disable default features and enable `tls-rustls`:
+
+```toml
+rustwide = { version = "0.27", default-features = false, features = ["tls-rustls"] }
+```
+
+Enable `git-registries` as well if you need Git registry support. Its `git2`
+dependency uses a separate TLS backend and still requires OpenSSL on Linux.
+Features are additive: if `tls-native` is also enabled, it takes precedence over
+`tls-rustls`.
+
 Rustwide is licensed under both the MIT and Apache 2.0 licenses, allowing you
 to choose which one to adhere to.