[kinyoklion]

Summary

• The contract test service now reads tls.skipVerifyPeer and tls.customCAFile and builds a per-client connector for them: for rustls, a verifier that accepts any certificate or a root store holding only the custom CA; for native-tls, danger_accept_invalid_certs or the custom CA with the built-in roots disabled.
• The TLS-enabled builds (hyper-rustls-native-roots, hyper-rustls-webpki-roots, native-tls, openssl crypto) now declare tls:verify-peer and tls:skip-verify-peer, so the {streaming,polling,events}/requests/invalid tls certificate tests and the https-skip-verify-peer variants of the method and headers tests run. The native-tls build also declares tls:custom-ca (the https-verify-peer-custom-ca variants). The rustls builds do not, because rustls rejects the harness certificate: it has no subjectAltName.
• rustls and tokio-native-tls become direct optional dependencies of the contract-tests crate. Both were already in its dependency graph with the same features.

Tested locally against harness v2.42.0 and v3.2.0-alpha.15 with the default, native-tls, webpki-roots, native-roots and openssl crypto builds: no test that passed before fails, and every newly enabled test passes.

_{Opened from termag}

---

Note

Overview
The contract test HTTP service now accepts tls.skipVerifyPeer and tls.customCAFile on client configuration and builds a per-instance HTTPS connector instead of always reusing the default verifying connector.

A new tls module implements that behavior for rustls (custom cert verifier or PEM-only root store) and native-tls (danger_accept_invalid_certs or custom CA with built-in roots disabled). /status capabilities are feature-gated: TLS builds advertise tls:verify-peer and tls:skip-verify-peer; tls:custom-ca is only on native-tls because rustls rejects the harness cert without SAN.

rustls and tokio-native-tls are declared as direct optional dependencies on the contract-tests crate for the relevant feature flags.

^{Reviewed by Cursor Bugbot for commit 1510cca. Bugbot is set up for automated code reviews on this repo. Configure here.}