From 94b10f7b012d9573143a3a7c2da12fd47ff99b7a Mon Sep 17 00:00:00 2001
From: Colin Marsch <cmarsch@squareup.com>
Date: Thu, 23 Jul 2026 10:17:10 -0500
Subject: [PATCH] Select Rustls provider in Buzz CLI

Combined sidecar release builds enable both Rustls backends, so auto-selection panics before a secure WebSocket connection. Install the ring provider explicitly at CLI startup.

Co-authored-by: Colin Marsch <cmarsch@squareup.com>
Signed-off-by: Colin Marsch <cmarsch@squareup.com>
---
 Cargo.lock                  |  1 +
 crates/buzz-cli/Cargo.toml  |  4 ++++
 crates/buzz-cli/src/main.rs | 17 +++++++++++++++++
 3 files changed, 22 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index b5b2605a4b..32152e41ab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -899,6 +899,7 @@ dependencies = [
  "nostr",
  "rand 0.10.1",
  "reqwest 0.13.4",
+ "rustls",
  "serde",
  "serde_json",
  "sha2 0.11.0",
diff --git a/crates/buzz-cli/Cargo.toml b/crates/buzz-cli/Cargo.toml
index a12260b526..296b1fee0d 100644
--- a/crates/buzz-cli/Cargo.toml
+++ b/crates/buzz-cli/Cargo.toml
@@ -76,6 +76,10 @@ dirs = "6"
 # WebSocket client — ephemeral event publish (kind:20001 is WS-only on the relay)
 buzz-ws-client = { path = "../buzz-ws-client" }
 
+# The release build can enable both rustls providers through other sidecars, so
+# the CLI selects ring explicitly before opening any wss:// connection.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+
 # Random number generation — full jitter for exponential backoff in with_retry
 rand = { workspace = true }
 
diff --git a/crates/buzz-cli/src/main.rs b/crates/buzz-cli/src/main.rs
index ff337776b3..bab2867742 100644
--- a/crates/buzz-cli/src/main.rs
+++ b/crates/buzz-cli/src/main.rs
@@ -1,4 +1,21 @@
 #[tokio::main]
 async fn main() {
+    install_rustls_crypto_provider();
     std::process::exit(buzz_cli::run_from_args(std::env::args()).await);
 }
+
+fn install_rustls_crypto_provider() {
+    let _ = rustls::crypto::ring::default_provider().install_default();
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn installs_rustls_crypto_provider_before_websocket_setup() {
+        assert!(rustls::crypto::CryptoProvider::get_default().is_none());
+
+        super::install_rustls_crypto_provider();
+
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+    }
+}