Use aws-lc-rs instead of ring for TLS

.github/workflows/ci.yml

@@ -82,6 +82,8 @@ jobs:
     name: "cargo clippy | windows"
     steps:
       - uses: actions/checkout@v4
+      - name: "Install nasm"
+        uses: ilammy/setup-nasm@v1
       - name: "Install Rust toolchain"
         run: rustup target add x86_64-pc-windows-msvc
       - name: Load xwin cache
@@ -216,6 +218,9 @@ jobs:
         run: |
           Copy-Item -Path "${{ github.workspace }}" -Destination "${{ env.DEV_DRIVE }}/uv" -Recurse
 
+      - name: "Install nasm"
+        uses: ilammy/setup-nasm@v1
+
       - name: "Install Rust toolchain"
         working-directory: ${{ env.DEV_DRIVE }}/uv
         env:
@@ -412,7 +417,7 @@ jobs:
     steps:
       - name: Create Dev Drive using ReFS
         run: |
-          $Volume = New-VHD -Path C:/uv_dev_drive.vhdx -SizeBytes 10GB |
+          $Volume = New-VHD -Path C:/uv_dev_drive.vhdx -SizeBytes 12GB |
                     Mount-VHD -Passthru |
                     Initialize-Disk -Passthru |
                     New-Partition -AssignDriveLetter -UseMaximumSize |
@@ -429,6 +434,9 @@ jobs:
 
       - uses: rui314/setup-mold@v1
 
+      - name: "Install nasm"
+        uses: ilammy/setup-nasm@v1
+
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: ${{ env.DEV_DRIVE }}/uv

CONTRIBUTING.md

@@ -28,6 +28,12 @@ See the [Python](#python) section for instructions on installing the Python vers
 
 You can install CMake from the [installers](https://cmake.org/download/) or with `pipx install cmake`.
 
+Only on Windows, you also need to install the [Netwide Assembler (NASM)](https://nasm.us/) and add its installation directory to your PATH:
+
+```
+set PATH="C:\Program Files\NASM;%PATH%"
+```
+
 ## Testing
 
 For running tests, we recommend [nextest](https://nexte.st/).

Cargo.toml

@@ -112,12 +112,13 @@ quote = { version = "1.0.36" }
 rayon = { version = "1.8.0" }
 reflink-copy = { version = "0.1.15" }
 regex = { version = "1.10.2" }
-reqwest = { version = "0.12.3", default-features = false, features = ["json", "gzip", "brotli", "stream", "rustls-tls", "rustls-tls-native-roots"] }
+reqwest = { version = "0.12.5", default-features = false, features = ["json", "gzip", "brotli", "stream", "rustls-tls", "rustls-tls-native-roots"] }
 reqwest-middleware = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "21ceec9a5fd2e8d6f71c3ea2999078fecbd13cbe" }
 reqwest-retry = { git = "https://github.com/astral-sh/reqwest-middleware", rev = "21ceec9a5fd2e8d6f71c3ea2999078fecbd13cbe" }
 rkyv = { version = "0.7.43", features = ["strict", "validation"] }
 rmp-serde = { version = "1.1.2" }
 rust-netrc = { version = "0.1.1" }
+rustls = { version = "0.23.10", features = ["aws_lc_rs"] }
 rustc-hash = { version = "2.0.0" }
 same-file = { version = "1.0.6" }
 schemars = { version = "0.8.16", features = ["url"] }

crates/uv-client/Cargo.toml

@@ -36,6 +36,7 @@ itertools = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }
+rustls = { workspace = true }
 rkyv = { workspace = true }
 rmp-serde = { workspace = true }
 serde = { workspace = true }

crates/uv-client/src/base_client.rs

@@ -11,6 +11,7 @@ use reqwest_retry::policies::ExponentialBackoff;
 use reqwest_retry::{
     DefaultRetryableStrategy, RetryTransientMiddleware, Retryable, RetryableStrategy,
 };
+use rustls::crypto::{aws_lc_rs, CryptoProvider};
 use tracing::debug;
 
 use pep508_rs::MarkerEnvironment;
@@ -136,6 +137,13 @@ impl<'a> BaseClientBuilder<'a> {
 
         // Initialize the base client.
         let client = self.client.clone().unwrap_or_else(|| {
+            if CryptoProvider::get_default().is_none() {
+                // Use aws_lc_rs as the default TLS provider to support more SSL cert algorithms
+                aws_lc_rs::default_provider()
+                    .install_default()
+                    .expect("failed to install aws_lc_rs as default TLS provider");
+            };
+
             // Check for the presence of an `SSL_CERT_FILE`.
             let ssl_cert_file_exists = env::var_os("SSL_CERT_FILE").is_some_and(|path| {
                 let path_exists = Path::new(&path).exists();