switch smtp client from webpki-roots to rustls-platform-verifier

We had some feedback that it would be nice to be able to influence
the set of ca-certs allowed by the client, which isn't possible
when using the hard-coded list in webpki-roots.

This commit is a fairly dumb application of the example shown
in the readme for rustls-platform-verifier.

Cargo.lock

@@ -854,6 +854,12 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
 [[package]]
 name = "cexpr"
 version = "0.6.0"
@@ -2781,6 +2787,26 @@ version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
+[[package]]
+name = "jni"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+dependencies = [
+ "cesu8",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
 [[package]]
 name = "jobserver"
 version = "0.1.32"
@@ -3196,7 +3222,6 @@ dependencies = [
  "utoipa",
  "uuid",
  "version-info",
- "webpki-roots 0.26.5",
  "zstd",
 ]
 
@@ -5299,13 +5324,13 @@ dependencies = [
  "openssl",
  "pest",
  "pest_derive",
+ "rustls-platform-verifier",
  "serde",
  "thiserror",
  "tokio",
  "tokio-openssl",
  "tokio-rustls 0.26.0",
  "tracing",
- "webpki-roots 0.26.5",
 ]
 
 [[package]]
@@ -5502,6 +5527,33 @@ version = "1.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0a2ce646f8655401bb81e7927b812614bd5d91dbc968696be50603510fcaf0"
 
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afbb878bdfdf63a336a5e63561b1835e7a8c91524f51621db870169eac84b490"
+dependencies = [
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls 0.23.13",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki 0.102.8",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-roots 0.26.5",
+ "winapi",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.101.7"
@@ -5592,6 +5644,7 @@ dependencies = [
  "core-foundation",
  "core-foundation-sys",
  "libc",
+ "num-bigint 0.4.6",
  "security-framework-sys",
 ]
 

Cargo.toml

@@ -66,7 +66,6 @@ hickory-proto = "0.24"
 utoipa = {version="4", features=["axum_extras", "time", "uuid"]}
 utoipa-rapidoc = { version="4.0", features = ["axum"] }
 uuid = "1.4"
-webpki-roots = "0.26"
 
 [patch.crates-io]
 # Can be removed once dane support is upstreamed

crates/kumod/Cargo.toml

@@ -70,7 +70,6 @@ tracing = "0.1"
 utoipa = {workspace=true}
 uuid = {workspace=true, features=["v4", "fast-rng"]}
 version-info = {path="../version-info"}
-webpki-roots = {workspace=true}
 zstd = "0.13"
 
 [target.'cfg(target_os = "linux")'.dependencies]

crates/rfc5321/Cargo.toml

@@ -7,7 +7,7 @@ edition = "2021"
 
 [features]
 default = ["client"]
-client = ["dep:openssl", "dep:tokio-rustls", "dep:tokio-openssl", "dep:tracing", "dep:tokio", "dep:hickory-proto", "dep:webpki-roots"]
+client = ["dep:openssl", "dep:tokio-rustls", "dep:tokio-openssl", "dep:tracing", "dep:tokio", "dep:hickory-proto", "dep:rustls-platform-verifier"]
 
 [dependencies]
 data-encoding = {workspace=true}
@@ -17,6 +17,7 @@ memchr = "2.5"
 openssl = {workspace=true, optional=true}
 pest = "2.7"
 pest_derive = "2.7"
+rustls-platform-verifier = {version="0.3", optional=true}
 serde = {workspace=true}
 thiserror = {workspace=true}
 tokio = {workspace=true, features=["full"], optional=true}
@@ -24,4 +25,3 @@ tokio-rustls = {workspace=true, optional=true}
 tokio-openssl = {version="0.6.4", optional=true}
 tracing = {version="0.1", optional=true}
 hickory-proto = {workspace=true, optional=true}
-webpki-roots = {workspace=true, optional=true}

crates/rfc5321/src/client.rs

@@ -17,7 +17,7 @@ use tokio::net::{TcpStream, ToSocketAddrs};
 use tokio::time::timeout;
 use tokio_rustls::rustls::crypto::{aws_lc_rs as provider, CryptoProvider};
 use tokio_rustls::rustls::pki_types::ServerName;
-use tokio_rustls::rustls::{ClientConfig, RootCertStore, SupportedCipherSuite};
+use tokio_rustls::rustls::{ClientConfig, SupportedCipherSuite};
 use tokio_rustls::TlsConnector;
 use tracing::Level;
 
@@ -895,16 +895,13 @@ mod danger {
 }
 
 pub fn build_tls_connector(options: &TlsOptions) -> TlsConnector {
-    let mut root_store = RootCertStore::empty();
-    root_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-
     let cipher_suites = if options.rustls_cipher_suites.is_empty() {
         provider::DEFAULT_CIPHER_SUITES
     } else {
         &options.rustls_cipher_suites
     };
 
-    let mut config = ClientConfig::builder_with_provider(
+    let config = ClientConfig::builder_with_provider(
         CryptoProvider {
             cipher_suites: cipher_suites.to_vec(),
             ..provider::default_provider()
@@ -912,15 +909,20 @@ pub fn build_tls_connector(options: &TlsOptions) -> TlsConnector {
         .into(),
     )
     .with_protocol_versions(tokio_rustls::rustls::DEFAULT_VERSIONS)
-    .expect("inconsistent cipher-suite/versions selected")
-    .with_root_certificates(root_store)
-    .with_no_client_auth();
+    .expect("inconsistent cipher-suite/versions selected");
 
-    if options.insecure {
-        config.dangerous().set_certificate_verifier(Arc::new(
-            danger::NoCertificateVerification::new(provider::default_provider()),
-        ));
-    }
+    let config = if options.insecure {
+        config
+            .dangerous()
+            .with_custom_certificate_verifier(Arc::new(danger::NoCertificateVerification::new(
+                provider::default_provider(),
+            )))
+    } else {
+        config
+            .dangerous()
+            .with_custom_certificate_verifier(Arc::new(rustls_platform_verifier::Verifier::new()))
+    };
+    let config = config.with_no_client_auth();
 
     TlsConnector::from(Arc::new(config))
 }