{"record":{"id":"02f0786183fa55fd","repo":"googleworkspace/cli","slug":"5-02f078","errorCode":"5","errorMessage":"Failed to build HTTP client: {e}","messagePattern":"Failed to build HTTP client: (.+?)","errorType":"exception","errorClass":"GwsError","httpStatus":null,"severity":"critical","filePath":"crates/google-workspace/src/client.rs","lineNumber":46,"sourceCode":"    let mut headers = HeaderMap::new();\n    let name = env!(\"CARGO_PKG_NAME\");\n    let version = env!(\"CARGO_PKG_VERSION\");\n\n    // Format: gl-rust/name-version (the gl-rust/ prefix is fixed)\n    let client_header = format!(\"gl-rust/{}-{}\", name, version);\n    if let Ok(header_value) = HeaderValue::from_str(&client_header) {\n        headers.insert(\"x-goog-api-client\", header_value);\n    }\n\n    reqwest::Client::builder()\n        .default_headers(headers)\n        .connect_timeout(std::time::Duration::from_secs(CONNECT_TIMEOUT_SECS))\n        .build()\n        .map_err(|e| format!(\"Failed to build HTTP client: {e}\"))\n}\n\npub fn build_client() -> Result<reqwest::Client, crate::error::GwsError> {\n    build_client_inner().map_err(|message| crate::error::GwsError::Other(anyhow::anyhow!(message)))\n}\n\n/// Returns a shared reqwest client clone backed by a single global connection pool.\n///\n/// `reqwest::Client` is cheap to clone, so callers can take ownership of the\n/// returned value while still sharing pooled connections underneath.\npub fn shared_client() -> Result<reqwest::Client, crate::error::GwsError> {\n    static CLIENT: OnceLock<Result<reqwest::Client, String>> = OnceLock::new();\n\n    match CLIENT.get_or_init(build_client_inner) {\n        Ok(client) => Ok(client.clone()),\n        Err(message) => Err(crate::error::GwsError::Other(anyhow::anyhow!(\n            message.clone()\n        ))),\n    }\n}\n\n/// Send an HTTP request with automatic retry on 429 (rate limit) responses","sourceCodeStart":28,"sourceCodeEnd":64,"githubUrl":"https://github.com/googleworkspace/cli/blob/a3768d0e82ad83cca2da97724e46bea4ff0e6dbd/crates/google-workspace/src/client.rs#L28-L64","documentation":"`build_client_inner()` failed: `reqwest::Client::builder()...build()` returned an error before any request was made. With this builder configuration (default headers + a 10s-class connect timeout) the realistic failure modes are TLS-backend initialization (native-tls/OpenSSL load failure or rustls provider init problem) and system DNS-resolver initialization failure. Everything in gws that talks HTTP goes through this client, so the first network-touching command of a session fails here.","triggerScenarios":"Running the gws binary on a host whose OpenSSL shared libraries are missing or the wrong major version (native-tls builds); a musl/alpine image lacking ca-certificates; a system where getaddrinfo/resolver init fails (no /etc/resolv.conf in a minimal container); an OS/cert-store incompatibility after a distro upgrade.","commonSituations":"Copying the binary between distros with different OpenSSL (libssl3 vs 1.1); scratch/distroless containers missing CA bundles and resolver config; Nix/GNU Guix dynamic-linking mismatches; stripped-down VMs.","solutions":["Run `ldd $(which gws)` and install the matching OpenSSL runtime (e.g. `apt install libssl3`) if a symbol is unresolved.","In minimal containers, add ca-certificates and ensure /etc/resolv.conf exists.","Prefer the statically-linked release artifacts (or rustls-TLS builds) for portable deployment.","Verify with a trivial call (`gws auth status`) after fixing — the error surfaces on first client construction."],"exampleFix":"# before — binary copied onto a host with old OpenSSL\n./gws drive files list\n# -> Failed to build HTTP client: failed to init TLS backend\n\n# after — install matching runtime libs / CA bundle, or ship the static binary\napt-get install -y libssl3 ca-certificates\n./gws drive files list","handlingStrategy":"try-catch","validationCode":"// Fail fast at startup instead of mid-command\nfn http_stack_ok() -> bool {\n    google_workspace::client::build_client().is_ok()\n}","typeGuard":null,"tryCatchPattern":"let client = match google_workspace::client::build_client() {\n    Ok(c) => c,\n    Err(GwsError::Other(e)) if e.to_string().contains(\"Failed to build HTTP client\") => {\n        eprintln!(\"TLS/resolver init failed — check OpenSSL libs, ca-certificates, and /etc/resolv.conf\");\n        std::process::exit(3);\n    }\n    Err(e) => return Err(e),\n};","preventionTips":["Deploy the official statically-linked gws releases for cross-distro portability.","In Docker, base images on ones shipping ca-certificates (alpine: `apk add ca-certificates`).","Smoke-test `gws auth status` in new environments before scheduling real workloads."],"tags":["reqwest","tls","openssl","client-init","runtime-environment"],"backgroundTag":"http-client-init-failed","analyzedSha":"a3768d0e82ad83cca2da97724e46bea4ff0e6dbd","analyzedAt":"2026-08-16T19:51:46.516Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}