Reqwest does not have default-features set to false

[pimeys]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

Renovate did a cargo update to our dependencies. We pin all reqwest usage to use rustls instead of native-tls. Spent a few hours this morning trying to understand why our workspace now tries to compile openssl-sys, and found the culprit:

ory-client update from 1.9.0 to 1.17.2: the reqwest dependency lost its default-features = false setting. Now it pulls hyper-tls with native-tls and openssl, and fails in our CI that checks we do not have dynamic linking to any dependencies.

Could we get this setting back to the reqwest dependency? Or does ory's rust-client now depend on native-tls features?

Reproducing the bug

Update ory-client from 1.9.0 to 1.17.2. Compile without openssl installed and observe a build failure.

Relevant log output

error: failed to run custom build command for `openssl-sys v0.9.106`
note: To improve backtraces for build dependencies, set the CARGO_PROFILE_DEV_BUILD_OVERRIDE_DEBUG=true environment variable to enable debug information generation.

Caused by:
  process didn't exit successfully: `/home/runner/work/grafbase/grafbase/target/debug/build/openssl-sys-90bf1def39477aa3/build-script-main` (exit status: 101)
  --- stdout
  cargo:rustc-check-cfg=cfg(osslconf, values("OPENSSL_NO_OCB", "OPENSSL_NO_SM4", "OPENSSL_NO_SEED", "OPENSSL_NO_CHACHA", "OPENSSL_NO_CAST", "OPENSSL_NO_IDEA", "OPENSSL_NO_CAMELLIA", "OPENSSL_NO_RC4", "OPENSSL_NO_BF", "OPENSSL_NO_PSK", "OPENSSL_NO_DEPRECATED_3_0", "OPENSSL_NO_SCRYPT", "OPENSSL_NO_SM3", "OPENSSL_NO_RMD160", "OPENSSL_NO_EC2M", "OPENSSL_NO_OCSP", "OPENSSL_NO_CMS", "OPENSSL_NO_COMP", "OPENSSL_NO_SOCK", "OPENSSL_NO_STDIO", "OPENSSL_NO_EC", "OPENSSL_NO_SSL3_METHOD", "OPENSSL_NO_KRB5", "OPENSSL_NO_TLSEXT", "OPENSSL_NO_SRP", "OPENSSL_NO_RFC3779", "OPENSSL_NO_SHA", "OPENSSL_NO_NEXTPROTONEG", "OPENSSL_NO_ENGINE", "OPENSSL_NO_BUF_FREELISTS", "OPENSSL_NO_RC2"))
  cargo:rustc-check-cfg=cfg(openssl)
  cargo:rustc-check-cfg=cfg(libressl)
  cargo:rustc-check-cfg=cfg(boringssl)
  cargo:rustc-check-cfg=cfg(libressl250)

Relevant configuration

Version

1.17.2

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

None

Additional Context

No response

[aeneasr]

This probably happened because we updated the openapi generator. If it's in the config options here https://openapi-generator.tech/docs/generators/rust/#config-options we can adjust it. If not, then not (because it's the generator) and you probably need to raise an issue in their GH repo.

[pimeys]

Wait, you generate this config?

Uhm, I have no idea how a generator like that should work. The fact is that this crate is broken in every single Rust project that does not want to use native SSL, which is quite a few of them.