fix(redis): install explicit rustls crypto provider

Cargo.lock

@@ -916,6 +916,7 @@ dependencies = [
  "redis",
  "reqwest",
  "ring",
+ "rustls",
  "secrecy",
  "serde",
  "serde_json",

Cargo.toml

@@ -11,6 +11,7 @@ jmap-client = { version = "=0.4.2", default-features = false, features = ["async
 redis = { version = "0.27", default-features = false, features = ["aio", "tokio-comp", "streams", "script", "tokio-rustls-comp"] }
 reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
 ring = "0.17.14"
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 secrecy = "0.8"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

src/main.rs

@@ -24,6 +24,9 @@ use std::sync::Arc;
 #[tokio::main]
 async fn main() -> Result<(), error::BotError> {
     tracing_subscriber::fmt().with_env_filter("info").init();
+    // reqwest/JMAP and Redis can activate different rustls crypto backends. Install
+    // ring explicitly before any client is constructed to avoid rustls provider panic.
+    let _ = install_rustls_provider();
     let port = std::env::var("PORT")
         .ok()
         .and_then(|value| value.parse().ok())
@@ -175,3 +178,20 @@ async fn main() -> Result<(), error::BotError> {
     axum::serve(listener, app).await?;
     Ok(())
 }
+
+fn install_rustls_provider() -> bool {
+    rustls::crypto::ring::default_provider()
+        .install_default()
+        .is_ok()
+        || rustls::crypto::CryptoProvider::get_default().is_some()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::install_rustls_provider;
+
+    #[test]
+    fn rustls_provider_is_installable_without_network() {
+        assert!(install_rustls_provider());
+    }
+}