launchbadge
feat: Allow users to specify a prebuilt 'rustls' configuration for TLS
Does your PR solve an issue?
Closes #4049.
Is this a breaking change?
No.
There is a breaking change for sqlx-core, but that's considered semver-exempt.
Open Design questions
What should the interaction be between sslmode and a prebuilt rustls configuration?
In the current PR, if TLS is available, we behave as if the user specified PgSslMode::VerifyFull.
rustls::client::ClientConfig doesn't expose the underlying server cert verifier, therefore it's not possible to wrap around it to disable hostname verification or cert verification.
At the same time, I think it'd be surprising for a user that specified its own rustls configuration to get the kind of permissive behaviour that PgSslMode::Prefer implies.
Conversion into a URL is inevitably lossy
We can't convert a prebuilt rustls client configuration into the three URL parameters that libpq supports.
At the moment, the PR ends up building a URL that doesn't have ssl* parameters. Would it be preferable to fail the conversion entirely?
Follow-up work
If we agree on the approach, I can add prebuilt rustls support to MySQL; either in this PR or in a separate one.
