{"record":{"id":"a42d5b041e3a811a","repo":"windmill-labs/windmill","slug":"client-build","errorCode":null,"errorMessage":"client build","messagePattern":"client build","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"backend/windmill-api-client/src/lib.rs","lineNumber":183,"sourceCode":"        } else {\n            Err(Error::UnexpectedResponse(\n                response.status().as_u16(),\n                response.text().await.unwrap_or_default(),\n            ))\n        }\n    }\n}\n\n/// Create a client with bearer token authentication\npub fn create_client(base_url: &str, token: String) -> Client {\n    let mut val = HeaderValue::from_str(&format!(\"Bearer {token}\")).expect(\"header creation\");\n    val.set_sensitive(true);\n    let mut headers = HeaderMap::new();\n    headers.insert(AUTHORIZATION, val);\n    let client = reqwest::ClientBuilder::new()\n        .default_headers(headers)\n        .build()\n        .expect(\"client build\");\n    Client::new_with_client(&format!(\"{}/api\", base_url.trim_end_matches('/')), client)\n}\n\n/// Error type for API client\n#[derive(Debug)]\npub enum Error {\n    /// Request error\n    Request(reqwest::Error),\n    /// Unexpected response status\n    UnexpectedResponse(u16, String),\n}\n\nimpl From<reqwest::Error> for Error {\n    fn from(err: reqwest::Error) -> Self {\n        Error::Request(err)\n    }\n}\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-api-client/src/lib.rs#L165-L201","documentation":"After building the Bearer header, create_client constructs the reqwest HTTP client with reqwest::ClientBuilder::build().expect(\"client build\"). reqwest's build fails when the TLS backend cannot be initialized (no root certificates / broken native-tls or rustls setup) or when the builder options are inconsistent. Because expect is used, any such failure panics rather than returning a Result.","triggerScenarios":"Calling create_client in an environment where reqwest cannot initialize its connector/TLS backend: missing system CA bundle, a rustls/native-tls misconfiguration, or an invalid reqwest feature set for the target platform.","commonSituations":"Deploying to a minimal/stripped container image without /etc/ssl/certs; cross-compiled binaries where native-tls/OpenSSL is unavailable; Alpine/musl builds missing CA certificates; environment variable SSL_CERT_FILE/SSL_CERT_DIR pointing at nonexistent paths.","solutions":["Install CA certificates in the runtime environment (e.g. apk add ca-certificates, apt-get install ca-certificates).","If using rustls, ensure add_included_root_certs or webpki-roots feature is enabled; if native-tls, ensure OpenSSL is present.","Check SSL_CERT_FILE / SSL_CERT_DIR env vars point to real certificate bundles.","If you control the library, propagate the build error (Result<Client, Error>) instead of .expect so the underlying reqwest message is reported."],"exampleFix":"// before (library)\n.build().expect(\"client build\");\n\n// after (library, propagate instead of panic)\n.build().map_err(|e| Error::Reqwest(e))","handlingStrategy":"fallback","validationCode":"// before calling create_client in a container, ensure CA certs exist:\n// std::path::Path::new(\"/etc/ssl/certs/ca-certificates.crt\").exists()","typeGuard":null,"tryCatchPattern":"// panic-based expect: catch at process boundary if you cannot change the library\nlet client = std::panic::catch_unwind(|| create_client(url, token))\n    .unwrap_or_else(|_| fallback_insecure_client(url));","preventionTips":["Install ca-certificates in every runtime image (Alpine/musl builds especially).","Prefer reqwest with rustls + webpki-roots features so root certs are bundled, not read from disk.","Smoke-test client construction at startup so TLS misconfig fails fast with a clear log.","Patch the library to return Result from create_client instead of panicking on build."],"tags":["rust","panic","reqwest","tls","configuration"],"backgroundTag":"tls-init-failed","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}