Segmentation fault with vendored-openssl feature

[quietvoid]

Problem

When building cargo with the vendored-openssl feature, a fresh setup (empty registry I assume), causes a segfault when updating the crates.io index.
I'm not sure if this happens in an environment without OpenSSL.

This can be reproduced in a Docker environment with this image:

FROM archlinux:base-devel

RUN pacman -Syu --noconfirm
RUN pacman -S --noconfirm git curl openssl rustup

Steps

1. Setup Docker image using "archlinux:base-devel" image
2. Install rustup with pacman -S rustup
3. Install Rust toolchain, rustup update stable
4. Build cargo from the repo:
   4.1. git clone https://github.com/rust-lang/cargo.git
   4.2. cargo build --release --features=vendored-openssl
5. Remove .cargo directory
6. Run previously built cargo binary with build subcommand in any project
   6.1. For example, in the same cargo repo: ./target/release/cargo build
7. It segfaults

Possible Solution(s)

Building without --features=vendored-openssl
The segfault also doesn't seem to happen on 0.65.0 tag, so I might just bisect it.
It broke between 0.65.0 and 0.66.0.

Notes

Related downstream issues:

• https://bugs.archlinux.org/task/77373
• Segmentation fault with vendored-openssl feature lu-zero/cargo-c#309

A backtrace from cargo-c: https://0x0.st/oC1n.txt

Version

cargo 1.69.0 (12a26b333 2023-02-03)

[quietvoid]

Bisected to 36053de on my side.