Repository navigation
build(deps): Drop vendored webpki root bundles - #829
Merged
Merged
Conversation
Use the system trust store for sqlx (tls-rustls-ring-native-roots) and enable reqwest's default-tls directly instead of sentry's native-tls feature, which pulls ureq and webpki-root-certs into Cargo.lock even though they are never built. Co-Authored-By: Markus Unterwaditzer <markus@sentry.io>
lvthanh03
approved these changes
Oct 22, 2026
untitaker
marked this pull request as ready for review
October 22, 2026 15:04
untitaker
added a commit
to getsentry/streams
that referenced
this pull request
Oct 22, 2026
…ntry_streams (#401) Follow-up to [INC-2600](https://firetower.getsentry.net/INC-2600): trims what `sentry_streams` carries, and so what consumers of the wheel inherit, when CA bundles need updating. Refs STREAM-1941 Companion to getsentry/taskbroker#829, which makes the same sentry/reqwest change in taskbroker. Rollout order: deploy taskbroker#829 first, then this one. The published 0.0.69 manylinux wheel does not compile in a root bundle. There are no `webpki-roots`/`webpki-root-certs` crates and no CA certs in `rust_streams.so`. TLS goes through native-tls/OpenSSL and `rustls-native-certs`, so it uses the system store. The bundle only exists as a lockfile ghost, but Dependabot still bumps it (e.g. "bump webpki-root-certs from 1.0.7 to 1.0.10"). **Rust** - sentry: use the `reqwest` feature instead of `transport`. `transport` turns on sentry's `native-tls` feature, which includes `ureq?/native-tls`. Cargo then records an unused `ureq` and its `webpki-root-certs` in `Cargo.lock`, even though neither is ever built. Every other default sentry feature is kept. - reqwest: move from 0.12 (defaults) to 0.13 with only `native-tls`, `http2` and `charset`. This matches the reqwest 0.13 that sentry already uses, so there is one reqwest instead of two, and sentry's transport still sends over native-tls. The GCS writer only uses `Client`, headers, `StatusCode` and `text()`, which are unchanged in 0.13. - Removed from all three lockfiles (the main crate, the `rust_transforms` example and `rust_test_functions`): `ureq`, `ureq-proto`, `utf8-zero`, `der`, `pem-rfc7468`, `base64ct`, `webpki-root-certs`, `reqwest` 0.12, `system-configuration(-sys)` and `windows-registry`. The main lockfile also drops the `windows-*` 0.53 target crates. **Python** - Drop `requests` (runtime), plus `responses` and `types-requests` (dev). Nothing in the repo imports them. `certifi` stays in the tree because `datadog` and `sentry-sdk` depend on it, so wheel consumers still get it. Making that bundle a no-op is an image-level fix (`SSL_CERT_FILE`/`REQUESTS_CA_BUNDLE`), not something this package can do. - `uv lock` also synced the lockfile's own `sentry-streams` version from 0.0.68 to 0.0.69, matching `pyproject.toml`. Draft until CI confirms the wheel build. <!-- junior-request-attribution:start --> via **markus**. <!-- junior-request-attribution:end --> <!-- junior-session-footer:start --> <!-- junior-conversation-id:slack%3AD0B0XMY6PHC%3A1792675717.745119 --> -- [View Junior Session](https://junior-prod.sentry.dev/conversations/slack%3AD0B0XMY6PHC%3A1792675717.745119) [[Sentry]](https://sentry.sentry.io/explore/conversations/slack%3AD0B0XMY6PHC%3A1792675717.745119/?project=4510944073809921) <!-- junior-session-footer:end --> --------- Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com> Co-authored-by: Markus Unterwaditzer <markus@sentry.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes the vendored Mozilla root bundles (
webpki-roots,webpki-root-certs) fromCargo.lock, so CA distrust events stop showing up as dependency bumps here. Certificate verification uses the system trust store from the image'sca-certificatesinstead.Follow-up to INC-2600, where rolling out trust bundle updates across repos was painful.
Refs STREAM-1941
tls-rustls-ring-webpki→tls-rustls-ring-native-roots. sqlx only verifies against roots withsslmode=verify-ca/verify-full. Those modes already takesslrootcert, and today the webpki roots just get added on top of it.reqwestfeature instead oftransport, and enable reqwest'sdefault-tlsdirectly.transportturns on sentry'snative-tlsfeature, which includesureq?/native-tls. Cargo then writes an unusedureqand itswebpki-root-certsinto the lockfile, even though neither is ever built. The SDK still sends over native-tls (OpenSSL with the system store), same as before.Net lockfile change: removes
ureq,ureq-proto,utf8-zero,der,pem-rfc7468,webpki-root-certsand bothwebpki-rootsversions, and addsrustls-native-certs.Draft until CI confirms the full build.
via markus.
--
View Junior Session [Sentry]