The workspace builds libsql without its `tls` feature, so a
`backend.libsql` config panicked at startup with "The `tls` feature is
disabled, you must provide your own http connector", for every remote
URL including plain `http://`.
pnpr now gives libsql its own connector. It is built on the workspace's
rustls 0.23 with the aws-lc-rs provider, and it verifies servers against
the platform trust store through rustls-platform-verifier. Enabling
libsql's `tls` feature instead would add hyper-rustls 0.25 and a second
rustls release. The lockfile gains no new crates.
- The trust store is loaded only for URLs libsql dials over HTTPS, so an
`http://` database works on a host without CA certificates. The
`http://` check is case-insensitive.
- A connector built for HTTPS refuses plain-HTTP URIs, so a `base_url`
in a Hrana response cannot move the auth token out of TLS.
- An `authToken` with a non-loopback `http://` url fails at startup,
the HTTPS-or-loopback rule pnpr-client applies to its credentials. With a
token, the connector also refuses each later plain-HTTP request to a
non-loopback host.
Zoltan Kochan
7a349e398f