From cd552df22f43029faf4d7e9d187682fc2cb6e5d0 Mon Sep 17 00:00:00 2001 From: Bryan te Beek Date: Tue, 21 Jul 2026 21:48:40 +0200 Subject: [PATCH] fix(cli): install rustls CryptoProvider so wss:// draft publish can't panic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `buzz agents draft-create`/`draft-update` publish an ephemeral event over WebSocket (kind:20001 is WS-only on the relay). Against a wss:// relay, tokio-tungstenite's `connect_async` builds a rustls `ClientConfig` whose builder auto-selects a crypto provider from the enabled crate features. Released CLI builds compile in both aws-lc-rs (via reqwest) and ring (transitively), so that auto-selection is ambiguous and rustls panics on the first wss:// connection: Could not automatically determine the process-level CryptoProvider from Rustls crate features. Every other Buzz binary already installs a provider explicitly at startup (relay, admin, acp, dev-mcp, the desktop WS client); buzz-cli was the only one relying on fragile auto-detection. Pin aws-lc-rs — already pulled by reqwest — as the process default at the top of `main()`, matching the desktop WS client. Reproduced locally by compiling both providers into buzz-cli: the panic occurs without the install and disappears with it (draft publish returns `accepted: true`). fmt + clippy clean; 250 buzz-cli unit tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) Signed-off-by: Bryan te Beek --- Cargo.lock | 1 + crates/buzz-cli/Cargo.toml | 2 ++ crates/buzz-cli/src/main.rs | 2 ++ 3 files changed, 5 insertions(+) diff --git a/Cargo.lock b/Cargo.lock index 0b9e8577ec..eae38064cb 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -899,6 +899,7 @@ dependencies = [ "nostr", "rand 0.10.1", "reqwest 0.13.4", + "rustls", "serde", "serde_json", "sha2 0.11.0", diff --git a/crates/buzz-cli/Cargo.toml b/crates/buzz-cli/Cargo.toml index a12260b526..5df54e0a44 100644 --- a/crates/buzz-cli/Cargo.toml +++ b/crates/buzz-cli/Cargo.toml @@ -76,6 +76,8 @@ dirs = "6" # WebSocket client — ephemeral event publish (kind:20001 is WS-only on the relay) buzz-ws-client = { path = "../buzz-ws-client" } +rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs", "std"] } + # Random number generation — full jitter for exponential backoff in with_retry rand = { workspace = true } diff --git a/crates/buzz-cli/src/main.rs b/crates/buzz-cli/src/main.rs index ff337776b3..c59e1ef395 100644 --- a/crates/buzz-cli/src/main.rs +++ b/crates/buzz-cli/src/main.rs @@ -1,4 +1,6 @@ #[tokio::main] async fn main() { + let _ = rustls::crypto::aws_lc_rs::default_provider().install_default(); + std::process::exit(buzz_cli::run_from_args(std::env::args()).await); }