Does that change prevent embedders to use the webpki roots on platforms other than Android?

Currently, as I understand it, you can still override the certificates as an embedder.
The current thing will use the webpki roots on android. With modifications to the android code (https://docs.rs/rustls-platform-verifier/latest/rustls_platform_verifier/#android) it will use the platform certificates in addition to the webpki roots.

Currently, as I understand it, you can still override the certificates as an embedder.

How? I could only find the certificate_path option to configure a custom store, but that's different than choosing to use the webpki root certs. I hope I'm missing something!

Oh I thought that is what you meant. With this PR there is the option to use a custom store via "certificate_path". Otherwise it will use the certificate system from the platform. If it doesn't have any way to get certificates from the platform it will fall back to webpki roots.

Can you explain the reason why an embedder would want the webpki roots specifically instead of relying on the platform which gives better security guarantees?

Can you explain the reason why an embedder would want the webpki roots specifically instead of relying on the platform which gives better security guarantees?

Because the platform does not necessarily give better security guarantees, and you may not want to be tied to the OS policy on that front. Firefox by default ships with its own roots, and can be setup to also lookup OS provided ones (useful for enterprise deployments).

It would be better to have an explicit toggle (eg. a pref) to control that behavior.

Ok I added a way to just use the webpki verifier.
One question remains: Currently, if you override the certificate store, it is given as additional roots in the platform verifier. I think this is ok because if the platform has revocations than we should honor them but if you have some input into it that would be good.

Ok I added a way to just use the webpki verifier.

Thanks!

One question remains: Currently, if you override the certificate store, it is given as additional roots in the platform verifier. I think this is ok because if the platform has revocations than we should honor them but if you have some input into it that would be good.

That looks reasonable to me.

🔨 Triggering try run (#19896088516) for Android, OpenHarmony

Bencher Report

⚠️ WARNING: No Threshold found!

Without a Threshold, no Alerts will ever be generated.

• Latency (nanoseconds (ns))
• Data (Measure (units))
• Memory (Bytes)
• score (Measure (units))

Click here to create a new Threshold
For more information, see the Threshold documentation.
To only post results if a Threshold exists, set the --ci-only-thresholds flag.

⚠️ Try run (#19896088516) failed.

🔨 Triggering try run (#19907392915) for Android, OpenHarmony

✨ Try run (#19907392915) succeeded.