PR #64 moved the Bugzilla client to reqwest 0.13, which changes where TLS
trust anchors come from: the bundled Mozilla webpki-roots set is gone
(confirmed absent from Cargo.lock) and rustls-platform-verifier reads
the OS trust store instead.
That change is deliberate, disclosed, and right for this project — a
distro-packaged tool should use the system CA bundle rather than carry its
own, and it is what makes a Bugzilla instance behind a corporate or
internal CA work without extra configuration.
The gap
The DESIGN.md paragraph added by that PR states only the upside:
deliberate for a Bugzilla instance behind a corporate or internal CA, and
an accepted, operator-visible change from the previous release
It does not state the cost, which is the half an operator hits at runtime:
a deployment with no OS trust store now fails every HTTPS request,
where 0.12 succeeded using the bundled roots. That is the scratch /
distroless container case, and some minimal images that ship no
ca-certificates. The failure is a TLS handshake error at first contact
with Bugzilla, with nothing pointing at the missing CA bundle as the cause.
This matters because the project ships release tarballs, not images —
so how the binary is containerized is the operator's choice, made without
knowing this dependency exists.
Why record it rather than reverse it
DESIGN.md's practice is that a decision is recoverable later, with the
rejected alternative legible. Right now a future reader sees only reasons
to keep the OS trust store and no statement of what it costs, so the
trade-off cannot be re-evaluated — for example if the project ever ships
an image.
Acceptance criteria
PR #64 moved the Bugzilla client to reqwest 0.13, which changes where TLS
trust anchors come from: the bundled Mozilla
webpki-rootsset is gone(confirmed absent from
Cargo.lock) andrustls-platform-verifierreadsthe OS trust store instead.
That change is deliberate, disclosed, and right for this project — a
distro-packaged tool should use the system CA bundle rather than carry its
own, and it is what makes a Bugzilla instance behind a corporate or
internal CA work without extra configuration.
The gap
The DESIGN.md paragraph added by that PR states only the upside:
It does not state the cost, which is the half an operator hits at runtime:
a deployment with no OS trust store now fails every HTTPS request,
where 0.12 succeeded using the bundled roots. That is the
scratch/distrolesscontainer case, and some minimal images that ship noca-certificates. The failure is a TLS handshake error at first contactwith Bugzilla, with nothing pointing at the missing CA bundle as the cause.
This matters because the project ships release tarballs, not images —
so how the binary is containerized is the operator's choice, made without
knowing this dependency exists.
Why record it rather than reverse it
DESIGN.md's practice is that a decision is recoverable later, with the
rejected alternative legible. Right now a future reader sees only reasons
to keep the OS trust store and no statement of what it costs, so the
trade-off cannot be re-evaluated — for example if the project ever ships
an image.
Acceptance criteria
HTTPS, where the previous release worked from bundled roots.
ca-certificates,or mount the host bundle) so the error is diagnosable from the doc.
with the reason, rather than left absent.