Hmbown/CodeWhale · critical

build platform HTTP client

Error message

build platform HTTP client

What it means

reqwest_client in release/src/tls.rs builds the platform HTTP client (rustls crypto provider installed, platform verifier) and .expect()s the build to succeed. A reqwest ClientBuilder build only fails on TLS backend initialization problems, so a panic here means the platform TLS setup is broken.

Solutions

1. Ensure the rustls crypto provider feature (aws-lc-rs or ring) is enabled and no conflicting provider features are set.
2. Test reqwest_client_builder().build() directly and log the underlying error instead of panicking.
3. Verify the deployment image has the required TLS/CA support for the platform verifier.

Example fix

// before
let client = release_tls::reqwest_client();
// after
let client = release_tls::reqwest_client_builder()
    .build()
    .map_err(|e| anyhow!("TLS init failed: {e}"))?;

// preflight TLS setup at startup
let _ = release_tls::reqwest_client_builder().build()?;

let client = reqwest_client_builder().build()
    .map_err(|e| anyhow::anyhow!("TLS client init failed: {e}"))?;

When it happens

Trigger: Calling reqwest_client() when reqwest_client_builder().build() returns Err — e.g. rustls provider installation failed, TLS backend features missing, or an invalid platform verifier on an unusual OS build.

Common situations: Missing or conflicting rustls crypto provider features (aws-lc-rs vs ring), stripped-down container images lacking CA/TLS support, unsupported platform for the platform verifier.

Related errors

• failed to build HTTP client
• Failed to build HTTP client
• build platform HTTP client
• building bundle fetch client failed
• failed to initialize the cloud agent client

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/ce5253b222f726da. Report an issue: GitHub.

Appendix: source

Thrown at crates/release/src/tls.rs:17

//! Process-wide TLS bootstrap plus the platform HTTP client constructors that
//! depend on it. Every reqwest client Codewhale builds goes through here so
//! the rustls crypto provider is installed exactly once, before the first
//! client, on every path (TUI, CLI, tests).

/// Install the rustls `ring` crypto provider if no provider is installed yet.
/// Idempotent; a second call is a no-op.
pub fn ensure_rustls_crypto_provider() {
    let _ = rustls::crypto::ring::default_provider().install_default();
}

/// A ready platform HTTP client (provider installed, platform verifier).
pub fn reqwest_client() -> reqwest::Client {
    ensure_rustls_crypto_provider();
    reqwest_client_builder()
        .build()
        .expect("build platform HTTP client")
}

/// The platform HTTP client builder, with the crypto provider installed.
pub fn reqwest_client_builder() -> reqwest::ClientBuilder {
    ensure_rustls_crypto_provider();
    crate::platform_http_client_builder()
}

/// The blocking platform HTTP client builder, with the crypto provider installed.
pub fn reqwest_blocking_client_builder() -> reqwest::blocking::ClientBuilder {
    ensure_rustls_crypto_provider();
    crate::platform_blocking_http_client_builder()
}

View on GitHub (pinned to 73e0f67d83)