rust: default to rustls TLS backend, add native-tls opt-in

rust/Cargo.toml

@@ -26,11 +26,27 @@ include = [
 name = "github_copilot_sdk"
 
 [features]
-default = ["bundled-cli"]
+default = ["bundled-cli", "rustls-tls"]
 bundled-cli = ["dep:tar", "dep:flate2", "dep:zip"]
 derive = ["dep:schemars"]
 test-support = []
 
+# TLS backend for the request-handler HTTP/WebSocket transport. Exactly one
+# should be enabled; `rustls-tls` is the default. `rustls-tls` uses rustls with
+# the `ring` provider and the OS trust store, keeping the SDK OpenSSL-free so
+# musl/static targets build without an OpenSSL sysroot. `native-tls` links the
+# platform stack (OpenSSL on Linux, Secure Transport on macOS, SChannel on
+# Windows). Disabling default features drops `rustls-tls` along with
+# `bundled-cli`; re-add a TLS feature to keep the transport working over HTTPS.
+rustls-tls = [
+    "reqwest/rustls-tls-native-roots",
+    "tokio-tungstenite/rustls-tls-native-roots",
+]
+native-tls = [
+    "reqwest/native-tls",
+    "tokio-tungstenite/native-tls",
+]
+
 # Build docs.rs documentation with all features so feature-gated APIs
 # (e.g. `define_tool`, `schema_for`) appear and intra-doc links resolve.
 # Mirror this locally with: `cargo doc --no-deps --all-features`.
@@ -58,8 +74,8 @@ base64 = "0.22"
 bytes = "1"
 http = "1"
 futures-util = "0.3"
-reqwest = { version = "0.12", default-features = false, features = ["stream", "http2", "default-tls"] }
-tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect", "native-tls"] }
+reqwest = { version = "0.12", default-features = false, features = ["stream", "http2"] }
+tokio-tungstenite = { version = "0.24", default-features = false, features = ["connect"] }
 
 [target.'cfg(windows)'.dependencies]
 zip = { version = "2", default-features = false, features = ["deflate"], optional = true }

rust/README.md

@@ -902,17 +902,25 @@ Supported: `darwin-arm64`, `darwin-x64`, `linux-x64`, `linux-arm64`, `win32-x64`
 | Feature        | Default | Description                                                                                                                                               |
 | -------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `bundled-cli`  | ✓       | Build-time CLI embedding. Pulls in `tar`+`flate2` (Linux/macOS) or `zip` (Windows). Disable via `default-features = false` to opt out (e.g. when shipping a smaller binary or when always supplying the CLI via `CliProgram::Path` / `COPILOT_CLI_PATH`). |
+| `rustls-tls`   | ✓       | TLS backend for the `CopilotRequestHandler` HTTP/WebSocket transport, using rustls with the `ring` provider and the OS trust store. OpenSSL-free, so `*-unknown-linux-musl` and other fully-static targets cross-compile without a system OpenSSL sysroot, and glibc binaries gain no `libssl` runtime dependency. |
+| `native-tls`   | —       | Alternative TLS backend for the transport, linking the platform-native stack (OpenSSL on Linux, Secure Transport on macOS, SChannel on Windows). Enable it together with `default-features = false` when you specifically want the system TLS stack rather than rustls. |
 | `derive`       | —       | `schema_for::<T>()` for generating JSON Schema from Rust types (adds `schemars`). Enable when defining [tool parameters](#tool-registration).             |
 
+> **Note:** `default-features = false` drops the default `rustls-tls` backend along with `bundled-cli`. The request-handler transport needs a TLS backend to reach HTTPS upstreams, so re-add either `rustls-tls` or `native-tls` whenever you turn default features off.
+
 ```toml
 # These examples use registry syntax for illustration; until the crate is
 # published, use a path or git dependency instead.
 
-# Default — bundles the Copilot CLI in your binary.
+# Default — bundles the Copilot CLI in your binary and uses the rustls TLS backend.
 github-copilot-sdk = "0.1"
 
 # Opt out of bundling — resolve CLI from COPILOT_CLI_PATH or system PATH instead.
-github-copilot-sdk = { version = "0.1", default-features = false }
+# Re-add a TLS backend since disabling default features also drops rustls-tls.
+github-copilot-sdk = { version = "0.1", default-features = false, features = ["rustls-tls"] }
+
+# Use the platform-native TLS stack (e.g. system OpenSSL) instead of rustls.
+github-copilot-sdk = { version = "0.1", default-features = false, features = ["bundled-cli", "native-tls"] }
 
 # Derive JSON Schema for tool parameters (adds to default bundled-cli).
 github-copilot-sdk = { version = "0.1", features = ["derive"] }