Repository: servo/servo
File: components/net/connector.rs (Rust)

Code before:
where
    F: Future<Output = ()> + 'static + std::marker::Send,
{
    fn execute(&self, fut: F) {
        spawn_task(fut);
    }
}

#[derive(Debug)]
struct CertificateVerificationOverrideVerifier {
    #[cfg(not(target_os = "android"))]
    main_verifier: Arc<rustls_platform_verifier::Verifier>,
    #[cfg(target_os = "android")]
    main_verifier: Arc<rustls::client::WebPkiServerVerifier>,
    ignore_certificate_errors: bool,
    override_manager: CertificateErrorOverrideManager,
}

impl CertificateVerificationOverrideVerifier {
    #[cfg(not(target_os = "android"))]
    fn new(
        ca_certficates: CACertificates<'static>,
        ignore_certificate_errors: bool,
        override_manager: CertificateErrorOverrideManager,
    ) -> Self {
        let crypto_provider = Arc::new(rustls::crypto::aws_lc_rs::default_provider());
        let main_verifier = Arc::new(
            match ca_certficates {
                CACertificates::Default => rustls_platform_verifier::Verifier::new(crypto_provider),
                CACertificates::Override(root_cert_store) => {
                    rustls_platform_verifier::Verifier::new_with_extra_roots(
                        root_cert_store,
                        crypto_provider,
                    )
                },
            }
            .expect("Could not initialize crypto"),
        );

        Self {
            main_verifier,
            ignore_certificate_errors,
            override_manager,
        }
    }

    #[cfg(target_os = "android")]
    fn new(
        ca_certficates: CACertificates<'static>,
        ignore_certificate_errors: bool,
        override_manager: CertificateErrorOverrideManager,

Review comment (suggestion):
Right now we make embedders choose a crypto provider (https://github.com/servo/servo/blob/b00a76427aed5f2b4c9f9f182965f4f75962a9a8/ports/servoshell/lib.rs#L49-L52). I think we should use https://docs.rs/rustls/latest/rustls/crypto/struct.CryptoProvider.html#method.get_default here instead of forcing one provider.

Code after:
        override_manager,
    );
    rustls::ClientConfig::builder()
        .dangerous()
        .with_custom_certificate_verifier(Arc::new(verifier))
        .with_no_client_auth()
}

#[derive(Clone)]
struct TokioExecutor {}

impl<F> Executor<F> for TokioExecutor
where
    F: Future<Output = ()> + 'static + std::marker::Send,
{
    fn execute(&self, fut: F) {
        spawn_task(fut);
    }
}

#[derive(Debug)]
struct CertificateVerificationOverrideVerifier {
    main_verifier: Arc<dyn ServerCertVerifier>,
    ignore_certificate_errors: bool,
    override_manager: CertificateErrorOverrideManager,
}

impl CertificateVerificationOverrideVerifier {
    fn new(
        ca_certficates: CACertificates<'static>,
        ignore_certificate_errors: bool,
        override_manager: CertificateErrorOverrideManager,
    ) -> Self {
        let crypto_provider = rustls::crypto::CryptoProvider::get_default()
            .unwrap_or(&Arc::new(aws_lc_rs::default_provider()))
            .clone();
        let main_verifier = match ca_certficates {
            #[cfg(not(target_os = "android"))]
            CACertificates::PlatformVerifier => Arc::new(
                rustls_platform_verifier::Verifier::new(crypto_provider)
                    .expect("Could not initialize platform certificate verifier."),
            ),
            CACertificates::WebPKI => {
                let root_store = Arc::new(rustls::RootCertStore::from_iter(
                    webpki_roots::TLS_SERVER_ROOTS.iter().cloned(),
                ));

                rustls::client::WebPkiServerVerifier::builder(root_store)
                    .build()
                    .expect("Could not initialize platform certificate verifier.")
                    as Arc<dyn ServerCertVerifier>