BloopAI/vibe-kanban · critical

Failed to install rustls crypto provider

Error message

Failed to install rustls crypto provider

What it means

Same rustls provider-installation panic as errors 164/167, in the server backend binary: install_default() errors when a process-wide rustls CryptoProvider already exists, and the expect turns that into a hard crash before sentry/tracing initialization.

Source

Thrown at crates/server/src/main.rs:37

#[derive(Debug, Error)]
pub enum VibeKanbanError {
    #[error(transparent)]
    Io(#[from] std::io::Error),
    #[error(transparent)]
    Sqlx(#[from] SqlxError),
    #[error(transparent)]
    Deployment(#[from] DeploymentError),
    #[error(transparent)]
    Other(#[from] AnyhowError),
}

#[tokio::main]
async fn main() -> Result<(), VibeKanbanError> {
    // Install rustls crypto provider before any TLS operations
    rustls::crypto::aws_lc_rs::default_provider()
        .install_default()
        .expect("Failed to install rustls crypto provider");

    sentry_utils::init_once(SentrySource::Backend);

    let log_level = std::env::var("RUST_LOG").unwrap_or_else(|_| "info".to_string());
    let filter_string = format!(
        "warn,server={level},services={level},db={level},executors={level},deployment={level},local_deployment={level},utils={level},embedded_ssh={level},desktop_bridge={level},relay_hosts={level},relay_client={level},relay_webrtc={level},codex_core=off",
        level = log_level
    );
    let env_filter = EnvFilter::try_new(filter_string).expect("Failed to create tracing filter");
    tracing_subscriber::registry()
        .with(tracing_subscriber::fmt::layer().with_filter(env_filter))
        .with(sentry_layer())
        .init();

    // Create asset directory if it doesn't exist
    if !asset_dir().exists() {
        std::fs::create_dir_all(asset_dir())?;
    }

View on GitHub (pinned to 4deb7eca8f)

Solutions

  1. Switch to try_install_default() and tolerate AlreadyInstalled
  2. Audit Cargo features so only one rustls crypto backend is enabled workspace-wide
  3. Ensure no other module installs a provider before main runs

Example fix

// before
rustls::crypto::aws_lc_rs::default_provider().install_default().expect("Failed to install rustls crypto provider");
// after
let _ = rustls::crypto::aws_lc_rs::default_provider().try_install_default();
Defensive patterns

Strategy: try-catch

Validate before calling

// use try_install_default and inspect Result instead of pre-checking

Try / catch

match rustls::crypto::aws_lc_rs::default_provider().install_default() {
    Ok(()) => {},
    Err(_) => { /* already installed; proceed */ }
}

Prevention

When it happens

Trigger: `main` in crates/server runs and another rustls crypto provider was already installed (by a dependency with its own TLS setup, a ring-based provider, or duplicated startup logic), so install_default() returns Err and the process panics.

Common situations: Feature-flag combinations pulling both ring and aws-lc-rs backends; embedded/desktop variants of the server initializing TLS before main; a dependency upgrade that installs a default provider.

Related errors

AI-assisted analysis of BloopAI/vibe-kanban@4deb7eca8f (2026-08-29). Data as JSON: /api/errors/e6ab8c8fcfbb75b3. Report an issue: GitHub.