fix(deps): update rust crate reqwest to 0.13

.github/workflows/agent-ci.yml

@@ -475,3 +475,92 @@ jobs:
           path: staging/
           if-no-files-found: error
           retention-days: 14
+
+  # ──────────────────────────────────────────────────────────────────
+  # OS trust store. reqwest 0.13's `rustls` feature verifies through
+  # rustls-platform-verifier, i.e. the system trust store. This job
+  # installs a private CA there and serves a certificate signed by it:
+  # no bundled Mozilla root can vouch for that chain, so a pass proves
+  # the store is genuinely consulted. It runs the #[ignore]d test the
+  # regular `tests` job skips.
+  # ──────────────────────────────────────────────────────────────────
+  os-trust-store:
+    name: "🔐 OS trust store (${{ matrix.os }})"
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 25
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu
+            runner: ubuntu-latest
+          - os: windows
+            runner: windows-latest
+          - os: macos
+            runner: macos-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: cargo-os-trust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
+
+      - name: Generate a private CA and a 127.0.0.1 certificate
+        shell: bash
+        # Git Bash rewrites the leading slash of -subj into a Windows path
+        env:
+          MSYS_NO_PATHCONV: 1
+          MSYS2_ARG_CONV_EXCL: "*"
+        run: |
+          openssl req -x509 -newkey rsa:2048 -sha256 -days 1 -nodes \
+            -keyout ca.key -out ca.pem -subj "/CN=OpenAEV OS trust test CA" \
+            -addext "basicConstraints=critical,CA:TRUE" \
+            -addext "keyUsage=critical,keyCertSign,cRLSign"
+          printf 'subjectAltName=DNS:localhost,IP:127.0.0.1\nbasicConstraints=critical,CA:FALSE\nextendedKeyUsage=serverAuth\n' > leaf.ext
+          openssl req -newkey rsa:2048 -nodes -keyout leaf.key -out leaf.csr -subj "/CN=localhost"
+          openssl x509 -req -in leaf.csr -CA ca.pem -CAkey ca.key -CAcreateserial \
+            -out leaf.pem -days 1 -sha256 -extfile leaf.ext
+          openssl x509 -in leaf.pem -noout -subject -issuer -ext subjectAltName
+
+      - name: Trust the CA (linux)
+        if: matrix.os == 'ubuntu'
+        run: |
+          sudo cp ca.pem /usr/local/share/ca-certificates/openaev-os-trust-test-ca.crt
+          sudo update-ca-certificates
+
+      - name: Trust the CA (macos)
+        if: matrix.os == 'macos'
+        run: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ca.pem
+
+      - name: Trust the CA (windows)
+        if: matrix.os == 'windows'
+        shell: pwsh
+        run: certutil -addstore -f Root ca.pem
+
+      - name: Serve HTTPS and run the OS trust store test
+        shell: bash
+        env:
+          OAEV_OS_TRUST_URL: https://127.0.0.1:8443
+        run: |
+          openssl s_server -accept 8443 -cert leaf.pem -key leaf.key -www -quiet &
+          server=$!
+          for _ in $(seq 1 30); do
+            if (exec 3<>/dev/tcp/127.0.0.1/8443) 2>/dev/null; then break; fi
+            sleep 1
+          done
+          set +e
+          cargo test --locked test_os_trust_store_is_consulted -- --ignored --nocapture
+          status=$?
+          kill "$server" 2>/dev/null
+          exit $status