Verify custom-relay /healthz with webpki roots; 0.0.43 - #57
Merged
Merged
Conversation
…fier
The on-demand connection-path snapshot probes each custom relay's /healthz
with reqwest. On the `rustls-no-provider` feature reqwest builds its TLS
verifier from rustls-platform-verifier, which on Android requires a JNI
initialisation the host app never performs and otherwise panics while the
client is being built ("Expect rustls-platform-verifier to be initialized").
That panic unwinds into the JNI `connPath` entry point and aborts the whole
app process as soon as a profile with custom relays opens the sheet.
Hand reqwest a preconfigured rustls ClientConfig instead: ring plus the
embedded Mozilla roots, which is exactly what iroh verifies the relay's own
TLS with (its platform-verifier feature is off), so a relay the tunnel trusts
is one the health check trusts. The platform verifier is no longer built on
any platform, and the process-wide provider install is gone with it.
Also drop the Nexus 7 references from the Android build notes: the app is
arm64-only now.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/healthzprobe built its reqwest client onrustls-platform-verifier, which on Android needs a JNI init the app never performs and panics withExpect rustls-platform-verifier to be initialized— the panic reaches the JNIconnPathentry point and aborts the app process whenever a profile with custom relays opens the "Connection path" sheet (reproduced on the arm64 emulator with the staging bastion profile).webpki-roots), the same trust iroh uses for the relay connection itself. The platform verifier is no longer constructed on any platform.Test plan
cargo clippy --lib -- -D warningsandcargo ndk -t arm64-v8a --platform 29 clippy --lib -- -D warningscargo test --lib transport::paths/healthzverified against the webpki roots)🤖 Generated with Claude Code
https://claude.ai/code/session_01QedowxAkQAV7HoeJu8ZYZC