{"record":{"id":"aad52cfa7fde8fda","repo":"block/buzz","slug":"failed-to-install-rustls-crypto-provider-another","errorCode":null,"errorMessage":"failed to install rustls crypto provider: another provider is already installed","messagePattern":"failed to install rustls crypto provider: another provider is already installed","errorType":"console","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/buzz-relay/src/main.rs","lineNumber":134,"sourceCode":"}\n\nasync fn run_relay_main(boot: BootTracker) -> anyhow::Result<()> {\n    // Install the ring CryptoProvider for rustls. Required before any rustls\n    // TLS connection (rediss:// to ElastiCache, wss://, S3 over TLS): both\n    // aws-lc-rs and ring are compiled in transitively, so rustls can't\n    // auto-select a provider and would panic at first use without this.\n    let (mut boot, ()) = boot\n        .run_required(\n            StartupPhase::CryptoInit,\n            || {\n                rustls::crypto::ring::default_provider()\n                    .install_default()\n                    .map_err(|_provider| ())\n            },\n            |_error| LifecycleReason::ProviderConflict,\n        )\n        .map_err(|()| {\n            anyhow::anyhow!(\n                \"failed to install rustls crypto provider: another provider is already installed\"\n            )\n        })?;\n\n    // JSON-only structured logs — simple, machine-parseable, CAKE-compatible.\n    // If OTEL_EXPORTER_OTLP_ENDPOINT is set, also attach an OpenTelemetry tracing\n    // layer that exports spans via OTLP gRPC alongside the JSON stdout logs.\n    //\n    // Build a single shared Resource (service.name=buzz-relay by default, overridable\n    // via OTEL_SERVICE_NAME) for the trace provider so that Datadog can identify\n    // spans under the correct service identity.\n    let tracing_init = boot.start(StartupPhase::TracingInit);\n    let resource = telemetry::service_resource();\n    let tracer_init = telemetry::try_init_tracer(resource.clone());\n    let otel_enabled = matches!(&tracer_init, telemetry::TracerInit::Enabled(_));\n    let otel_layer = match &tracer_init {\n        telemetry::TracerInit::Enabled(p) => {\n            use opentelemetry::trace::TracerProvider as _;","sourceCodeStart":116,"sourceCodeEnd":152,"githubUrl":"https://github.com/block/buzz/blob/dad5a33865fc81a2e55b3b60746632f615ec1e3a/crates/buzz-relay/src/main.rs#L116-L152","documentation":"Raised in run_relay_main during the CryptoInit startup phase when rustls::crypto::ring::default_provider().install_default() returns AlreadyInstalled. Both aws-lc-rs and ring are compiled in transitively, so the relay must pin ring explicitly; this error fires only if something else (e.g. another component or a prior init) already installed a rustls CryptoProvider in this process. It is a sentinel guard ensuring exactly one provider is configured before any TLS use.","triggerScenarios":"Thrown at crates/buzz-relay/src/main.rs:134 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove the duplicate provider installation (install_default call) in the code path that runs before run_relay_main's CryptoInit phase","If a dependency already installs a provider, guard with rustls::crypto::CryptoProvider::get_default() and skip installation when one is present","Verify only one process-wide provider init exists — the relay's own ring install in run_relay_main is normally the only one"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"dad5a33865fc81a2e55b3b60746632f615ec1e3a","analyzedAt":"2026-09-05T18:13:50.666Z","contentChangedAt":"2026-09-05T18:13:50.666Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}