rust: default to rustls TLS backend, add native-tls opt-in (#1805)

The Rust crate hard-coded the OpenSSL-backed native-tls stack for its
request-handler HTTP (reqwest `default-tls`) and WebSocket
(tokio-tungstenite `native-tls`) clients, pulling in `openssl-sys`. That
breaks `*-unknown-linux-musl` / fully-static builds (no OpenSSL sysroot)
and adds a dynamic `libssl` runtime dependency on glibc.

Make TLS feature-gated and default to rustls:

- `rustls-tls` (default): reqwest `rustls-tls-native-roots` +
  tokio-tungstenite `rustls-tls-native-roots`, using rustls with the
  `ring` provider and the OS trust store. OpenSSL-free, so musl/static
  targets cross-compile with no system OpenSSL.
- `native-tls` (opt-in): keeps the platform-native stack for consumers
  who want it.

The transport code is TLS-backend-agnostic (`reqwest::Client::builder()`
+ `connect_async`), so no source changes were needed. For `wss://`,
tokio-tungstenite resolves the rustls crypto provider via Cargo feature
unification on the shared `rustls` crate (reqwest pins `ring`).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: colbylwilliams

rust/Cargo.lock

@@ -26,11 +26,29 @@ include = [
 name = "github_copilot_sdk"
 
 [features]
-default = ["bundled-cli"]
+default = ["bundled-cli", "rustls-tls"]
 bundled-cli = ["dep:tar", "dep:flate2", "dep:zip"]
 derive = ["dep:schemars"]
 test-support = []
 
+# TLS backend for the request-handler HTTP/WebSocket transport. Enable at least
+# one; `rustls-tls` is the default. `rustls-tls` uses rustls with the `ring`
+# provider and the OS trust store, keeping the SDK OpenSSL-free so musl/static
+# targets build without an OpenSSL sysroot. `native-tls` links the platform
+# stack (OpenSSL on Linux, Secure Transport on macOS, SChannel on Windows).
+# Cargo features are additive, so enabling both is unnecessary — when both are
+# present (e.g. under `--all-features`) the transport prefers native-tls.
+# Disabling default features drops `rustls-tls` along with `bundled-cli`;
+# re-add a TLS feature to keep the transport working over HTTPS.
+rustls-tls = [
+    "reqwest/rustls-tls-native-roots",
+    "tokio-tungstenite/rustls-tls-native-roots",
+]
+native-tls = [
+    "reqwest/native-tls",
+    "tokio-tungstenite/native-tls",
+]
+
 # Build docs.rs documentation with all features so feature-gated APIs
 # (e.g. `define_tool`, `schema_for`) appear and intra-doc links resolve.
 # Mirror this locally with: `cargo doc --no-deps --all-features`.
@@ -58,8 +76,8 @@ base64 = "0.22"
 bytes = "1"
 http = "1"
 futures-util = "0.3"
-reqwest = { version = "0.12", default-features = false, features = ["stream", "http2", "default-tls"] }
-tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect", "native-tls"] }
+reqwest = { version = "0.12", default-features = false, features = ["stream", "http2"] }
+tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect"] }
 
 [target.'cfg(windows)'.dependencies]
 zip = { version = "2", default-features = false, features = ["deflate"], optional = true }

rust/Cargo.toml

@@ -902,17 +902,25 @@ Supported: `darwin-arm64`, `darwin-x64`, `linux-x64`, `linux-arm64`, `win32-x64`
 | Feature        | Default | Description                                                                                                                                               |
 | -------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `bundled-cli`  | ✓       | Build-time CLI embedding. Pulls in `tar`+`flate2` (Linux/macOS) or `zip` (Windows). Disable via `default-features = false` to opt out (e.g. when shipping a smaller binary or when always supplying the CLI via `CliProgram::Path` / `COPILOT_CLI_PATH`). |
+| `rustls-tls`   | ✓       | TLS backend for the `CopilotRequestHandler` HTTP/WebSocket transport, using rustls with the `ring` provider and the OS trust store. OpenSSL-free, so `*-unknown-linux-musl` and other fully-static targets cross-compile without a system OpenSSL sysroot, and glibc binaries gain no `libssl` runtime dependency. |
+| `native-tls`   | —       | Alternative TLS backend for the transport, linking the platform-native stack (OpenSSL on Linux, Secure Transport on macOS, SChannel on Windows). Enable it together with `default-features = false` when you specifically want the system TLS stack rather than rustls. |
 | `derive`       | —       | `schema_for::<T>()` for generating JSON Schema from Rust types (adds `schemars`). Enable when defining [tool parameters](#tool-registration).             |
 
+> **Note:** `default-features = false` drops the default `rustls-tls` backend along with `bundled-cli`. The request-handler transport needs a TLS backend to reach HTTPS upstreams, so re-add either `rustls-tls` or `native-tls` whenever you turn default features off.
+
 ```toml
 # These examples use registry syntax for illustration; until the crate is
 # published, use a path or git dependency instead.
 
-# Default — bundles the Copilot CLI in your binary.
+# Default — bundles the Copilot CLI in your binary and uses the rustls TLS backend.
 github-copilot-sdk = "0.1"
 
 # Opt out of bundling — resolve CLI from COPILOT_CLI_PATH or system PATH instead.
-github-copilot-sdk = { version = "0.1", default-features = false }
+# Re-add a TLS backend since disabling default features also drops rustls-tls.
+github-copilot-sdk = { version = "0.1", default-features = false, features = ["rustls-tls"] }
+
+# Use the platform-native TLS stack (e.g. system OpenSSL) instead of rustls.
+github-copilot-sdk = { version = "0.1", default-features = false, features = ["bundled-cli", "native-tls"] }
 
 # Derive JSON Schema for tool parameters (adds to default bundled-cli).
 github-copilot-sdk = { version = "0.1", features = ["derive"] }