GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Replace OpenSSL with rustls by thomas-zahner · Pull Request #1928 · lycheeverse/lychee

Conversation

@thomas-zahner

@thomas-zahner thomas-zahner commented Nov 19, 2025 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Closes #1721

Closes #1970

Closes #1920

Hopefully closes #2024

Background

Using Rustls instead of openSSL should simplify many things. Depending on platform specific external openSSL libraries seems to be more brittle than using Rustls for all targets. Very recently I've updated lychee to use reqwest 0.13.1 which coincidentally also uses Rustls by default now. This shows how Rustls should now be fully production ready and well tested. So now seems like a good moment to make the full switch.

As it is a breaking change anyhow I'd like to seize the opportunity to fully remove openSSL. If it works out well it should make maintenance easier. If it turns out that some people really need openSSL (which I think is unlikely) or run into issues we could still add a new feature flag before the next release.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@thomas-zahner thomas-zahner mentioned this pull request Nov 19, 2025
Clarify Network error reporting #1920
Closed
@thomas-zahner
thomas-zahner force-pushed the rustls branch 2 times, most recently from cb636f5 to d645040 Compare November 19, 2025 20:19
@thomas-zahner

thomas-zahner commented Nov 20, 2025

Copy link
Copy Markdown
Member Author

@mre If we see that this PR works in CI and on different machines for users, do you agree that it makes sense to fully get rid of the OpenSSL approach? Or do you think we should keep it and only change the default?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner
thomas-zahner force-pushed the rustls branch from d645040 to fe1e69a Compare November 20, 2025 09:25
@thomas-zahner thomas-zahner mentioned this pull request Nov 24, 2025
chore: add pypi release #1931
Merged
@mre

mre commented Nov 24, 2025

Copy link
Copy Markdown
Member

TBH, for now I would keep it and change the default. At least for one version. Then we can tell people to switch back to OpenSSL if there are any problems. We could mention that in the release-notes. On the other side, I'm flexible here. That's just what I would do, but we can also go all-in on rustls. 😆 Worst case, we release a patch version with the OpenSSL option available again. So whatever you believe is the best tradeoff between simplicity and user experience.
thomas-zahner reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner

thomas-zahner commented Nov 26, 2025

Copy link
Copy Markdown
Member Author

This unfortunately is blocked by reacherhq/check-if-email-exists#1625. The problem is that the latest version of check-if-email-exists on crates.io uses openSSL without an option to use ruslts.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@kemingy

kemingy commented Nov 27, 2025

Copy link
Copy Markdown
Contributor

I just found that the check-if-email-exists is dual licensed under AGPL-3 or Reacher Commercial license.

But it's enabled by default for lychee CLI:

lychee/lychee-bin/Cargo.toml

Line 96 in caf63cc

default = ["native-tls", "email-check"]

As far as I know, it's not compatible with the Apache2 + MIT license.

Maybe we need to open another issue to discuss this. What do you think? @mre
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner

thomas-zahner commented Nov 27, 2025

Copy link
Copy Markdown
Member Author

@kemingy Thanks for pointing it out. This is known since 2022 see #594. Unfortunately, we never really prioritised the issue. But you are right that this is quite problematic and now as it even blocks the transition to rustls I will try to resolve it as soon as possible.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner thomas-zahner mentioned this pull request Dec 26, 2025
Make TLS errors more descriptive #1970
Closed
@thomas-zahner thomas-zahner mentioned this pull request Feb 3, 2026
GITHUB_TOKEN environment variable causes panics with "Could not automatically determine the process-level CryptoProvider from Rustls crate features" #2024
Closed
@thomas-zahner
thomas-zahner force-pushed the rustls branch from b4cd5e8 to 6ea87c6 Compare February 3, 2026 17:37
thomas-zahner added 3 commits February 4, 2026 10:53
@thomas-zahner
Fully switch to rustls
2ef1c7b
@thomas-zahner
Reenable email-check feature
869a115
@thomas-zahner
Update examples to not use OpenSSL
4cfc402
@thomas-zahner
thomas-zahner force-pushed the rustls branch 2 times, most recently from 06ac330 to 4455678 Compare February 4, 2026 10:29
@thomas-zahner
thomas-zahner marked this pull request as ready for review February 4, 2026 10:29
@thomas-zahner
thomas-zahner requested review from katrinafyi and mre February 4, 2026 10:29
katrinafyi
katrinafyi approved these changes Feb 4, 2026
View reviewed changes

@katrinafyi katrinafyi left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes sense and diff looks reasonable. would it be worthwhile to mention somewhere, maybe near the readme feature flags, that we use rustls and to report any issues or shortcomings?

also, idk much about TLS, but does this make it harder to use system-installed root certificates? this could affect people using lychee for intranet websites. but maybe the current vendored-openssl already makes that difficult - I'm not sure.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread lychee-lib/Cargo.toml Resolved

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner thomas-zahner mentioned this pull request Feb 4, 2026
--insecure flag does not work for URL args #1673
Closed
@thomas-zahner

thomas-zahner commented Feb 4, 2026

Copy link
Copy Markdown
Member Author

would it be worthwhile to mention somewhere, maybe near the readme feature flags, that we use rustls and to report any issues or shortcomings?

Sure, that makes sense.

also, idk much about TLS, but does this make it harder to use system-installed root certificates?

I'm also no expert on that. But it seems like self-signed certificates are currently broken, so this PR shouldn't worsen the situation. I've asked on the issue if this branch resolves the problems, which is not entirely unlikely.
katrinafyi reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
mre
mre reviewed Feb 4, 2026
View reviewed changes
Comment thread examples/builder/builder.rs
.client()?;

let response = client.check("https://example.com").await?;
let response = client.check("https://rust-lang.org").await?;

@mre mre Feb 4, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was this change intentional? It seems to be unrelated to rustls and as far as I remember, the goal was to show how includes overrides excludes. By changing the URL this is no longer clear.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@thomas-zahner thomas-zahner Feb 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh thanks for pointing out. Yes it was intentional but I forgot to update the includes and excludes. Fixed now.
I've replaced example.com with rust-lang.org because it might be confusing to people. (at least it confused me) Running cargo run --example builder makes the example panic. The URL is still excluded because we explicitly exclude example.com from checking.

We need to include the feature flag to make the example not panic: cargo run --example builder -F check_example_domains. With f4d1a38 the example will now pass independently of the provided feature flags.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
mre
mre approved these changes Feb 4, 2026
View reviewed changes

@mre mre left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feels good. 😃

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@thomas-zahner
thomas-zahner force-pushed the rustls branch from d41bce5 to ba5572e Compare February 5, 2026 09:26
thomas-zahner added 3 commits February 5, 2026 10:35
@thomas-zahner
Improve builder example
f4d1a38
@thomas-zahner
Update workflow depending on old feature
cbad47b
@thomas-zahner
Update CI & docs
d1b2670
thomas-zahner and others added 2 commits February 5, 2026 10:35
@thomas-zahner
Simplify reqwest's feature flags
17f83bf
@thomas-zahner @katrinafyi
Remove outdated comment
617c866 
Co-authored-by: katrinafyi <[email protected]>
@thomas-zahner
thomas-zahner force-pushed the rustls branch from ba5572e to 617c866 Compare February 5, 2026 09:35
@thomas-zahner
Add note to README about dropping OpenSSL
e9d1e97 
As recommended by @katrinafyi in
lycheeverse#1928 (review)
@thomas-zahner

thomas-zahner commented Feb 5, 2026

Copy link
Copy Markdown
Member Author

Feels good. 😃

Thanks, I agree :)
Less dependencies, shorter workflow files, and most probably less runtime issues and more coherent behaviour across different machines.

would it be worthwhile to mention somewhere, maybe near the readme feature flags, that we use rustls and to report any issues or shortcomings?

Done in e9d1e97
katrinafyi reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@thomas-zahner
thomas-zahner merged commit 2d717a1 into lycheeverse:master Feb 5, 2026
7 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@mre mre mentioned this pull request Feb 5, 2026
chore: release v0.23.0 #2003
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mre mre mre approved these changes
@katrinafyi katrinafyi katrinafyi approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

GITHUB_TOKEN environment variable causes panics with "Could not automatically determine the process-level CryptoProvider from Rustls crate features" Make TLS errors more descriptive Clarify Network error reporting Use rustls by default

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@thomas-zahner @mre @kemingy @katrinafyi
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.