{"record":{"id":"12070ccfe6f35371","repo":"aaif-goose/goose","slug":"custom-tls-configuration-requires-the-rustls-tls","errorCode":null,"errorMessage":"Custom TLS configuration requires the `rustls-tls` or `native-tls` feature","messagePattern":"Custom TLS configuration requires the `rustls-tls` or `native-tls` feature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/goose-providers/src/api_client.rs","lineNumber":379,"sourceCode":"            }\n\n            // Load CA certificates\n            let ca_certs = tls_config.load_ca_certificates()?;\n            for ca_cert in ca_certs {\n                client_builder = client_builder.add_root_certificate(ca_cert);\n            }\n        }\n        Ok(client_builder)\n    }\n\n    /// Reject custom TLS settings when goose is compiled without a TLS backend.\n    #[cfg(not(any(feature = \"rustls-tls\", feature = \"native-tls\")))]\n    fn configure_tls(\n        client_builder: reqwest::ClientBuilder,\n        tls_config: &TlsConfig,\n    ) -> Result<reqwest::ClientBuilder> {\n        if tls_config.is_configured() {\n            return Err(anyhow::anyhow!(\n                \"Custom TLS configuration requires the `rustls-tls` or `native-tls` feature\"\n            ));\n        }\n        Ok(client_builder)\n    }\n\n    pub fn with_headers(mut self, headers: HeaderMap) -> Result<Self> {\n        self.default_headers = headers;\n        self.rebuild_client()?;\n        Ok(self)\n    }\n\n    pub fn with_query(mut self, params: Vec<(String, String)>) -> Self {\n        self.default_query = params;\n        self\n    }\n\n    pub fn with_header(mut self, key: &str, value: &str) -> Result<Self> {","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/aaif-goose/goose/blob/3810898a7447ec3299be72e223d3570a7aabf0ab/crates/goose-providers/src/api_client.rs#L361-L397","documentation":"This build of goose was compiled without either TLS backend feature (rustls-tls or native-tls), so the real configure_tls that loads client identities and CA bundles does not exist; only this #[cfg(not(...))] stub compiles. The stub's one job is to fail loudly when a caller asks for custom TLS (TlsConfig::is_configured() = client_identity or ca_cert_path set) on a TLS-less binary, instead of silently ignoring your certificates.","triggerScenarios":"Building goose-providers with --no-default-features (or a feature set that drops rustls-tls/native-tls) while configuration or code sets a client cert/key pair or a CA cert path, e.g. GOOSE_TLS_* settings or TlsConfig::with_ca_cert(...).","commonSituations":"Downstream crates depend on goose-providers with a trimmed feature list to slim builds; distro packaging compiles with default-features=false; users then enable corporate-proxy CA settings that previously worked in the official binary.","solutions":["Re-enable a TLS backend: add default-features = true, or features = [\"rustls-tls\"] (or \"native-tls\") to the goose-providers dependency / cargo build --features rustls-tls","If TLS customization genuinely isn't needed, remove the client-cert/CA config so is_configured() is false","For downstream crates: check cargo tree -e features on goose-providers to confirm which TLS feature survives feature unification"],"exampleFix":"# before\n# Cargo.toml\ngoose-providers = { version = \"...\", default-features = false }  # no TLS feature\n\n# after\ngoose-providers = { version = \"...\", default-features = false, features = [\"rustls-tls\"] }","handlingStrategy":"validation","validationCode":"fn tls_backends_compiled_in() -> bool {\n    cfg!(any(feature = \"rustls-tls\", feature = \"native-tls\"))\n}\n// before configuring:\nif tls.is_configured() && !tls_backends_compiled_in() {\n    eprintln!(\"TLS customization ignored: build lacks rustls-tls/native-tls\");\n    // either skip TLS config or abort, matching your policy\n}","typeGuard":null,"tryCatchPattern":"// Compile-time guard so misconfigured feature sets fail the build, not first request:\n#[cfg(all(not(any(feature = \"rustls-tls\", feature = \"native-tls\"))))]\nconst _: () = { /* optional: emit a build warning via build.rs instead */ };","preventionTips":["Pin the feature explicitly in Cargo.toml (features = [\"rustls-tls\"]) instead of relying on default-feature inheritance","Run cargo tree -e features -p goose-providers in CI to assert a TLS feature survives unification","If shipping a TLS-optional binary, gate the TLS settings UI/env parsing on the same cfg so users can't reach this error"],"tags":["build","feature-flags","tls","configuration"],"backgroundTag":null,"analyzedSha":"3810898a7447ec3299be72e223d3570a7aabf0ab","analyzedAt":"2026-08-16T10:14:26.282Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}