From 05df0b283b4941b630b613a06891596ed96a45bc Mon Sep 17 00:00:00 2001 From: zimbatm Date: Tue, 20 Oct 2026 22:04:18 +0000 Subject: [PATCH] taplo: use native-tls to trust the system CA store taplo built with the default rustls-tls feature. reqwest then embeds the webpki-roots trust store, which still contains emSign ECC Root CA - G3. A cacert update did not change the roots that taplo trusts. Build with native-tls instead. reqwest then uses OpenSSL on Linux and Security.framework on Darwin, which read the system CA store. See #576544. Assisted-by: Claude Code (claude-opus-5) --- pkgs/by-name/ta/taplo/package.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ta/taplo/package.nix b/pkgs/by-name/ta/taplo/package.nix index 105b0140ea67..946e9fae6ce0 100644 --- a/pkgs/by-name/ta/taplo/package.nix +++ b/pkgs/by-name/ta/taplo/package.nix @@ -46,7 +46,14 @@ rustPlatform.buildRustPackage (finalAttrs: { buildInputs = [ openssl ]; - buildFeatures = lib.optional withLsp "lsp"; + buildNoDefaultFeatures = true; + buildFeatures = [ + "completions" + "lint" + "native-tls" + "toml-test" + ] + ++ lib.optional withLsp "lsp"; postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' installShellCompletion --cmd taplo \