fix: drop ring from TLS path; bump aarch64 wheel base to manylinux_2_28

.github/workflows/build-binaries.yml

@@ -268,16 +268,11 @@ jobs:
         uses: PyO3/maturin-action@v1.50.1
         with:
           target: ${{ matrix.platform.target }}
-          manylinux: auto
+          manylinux: 2_28
           docker-options: ${{ matrix.platform.maturin_docker_options }}
           args: --release --locked --out dist -i python3.10 python3.11 python3.12 python3.13 python3.14
         env:
           CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
-          # Set the CFLAGS for the aarch64 target, defining the ARM architecture
-          # for the ring crate's build script. This is a workaround for the
-          # issue where the ring crate's build script is not able to detect the
-          # ARM architecture.
-          CFLAGS_aarch64_unknown_linux_gnu: "-march=armv8-a -D__ARM_ARCH=8"
       - uses: uraimo/run-on-arch-action@v2
         if: ${{ matrix.platform.arch != 'ppc64' && matrix.platform.arch != 'ppc64le'}}
         name: Test wheel

Cargo.toml

@@ -43,8 +43,9 @@ pyo3 = { version = "0.28", features = ["extension-module"] }
 promptly = "0.3"
 rand = "0.8"
 regex = "1"
-reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots-no-provider", "stream"] }
 reqwest-eventsource = { version = "0.6" }
+rustls = { version = "0.23", default-features = false, features = ["aws-lc-rs", "std", "tls12"] }
 rpassword = "7"
 rsa = "0.9"
 seahash = "4.1"

crates/tower-api/Cargo.toml

@@ -12,4 +12,4 @@ serde_with = { version = "^3.8", default-features = false, features = ["base64",
 serde_json = "^1.0"
 serde_repr = "^0.1"
 url = "^2.5"
-reqwest = { version = "^0.12", default-features = false, features = ["json", "multipart", "rustls-tls"] }
+reqwest = { version = "^0.12", default-features = false, features = ["json", "multipart", "rustls-tls-webpki-roots-no-provider"] }

crates/tower-cmd/Cargo.toml

@@ -21,6 +21,7 @@ reqwest = { workspace = true }
 reqwest-eventsource = { workspace = true }
 rpassword = { workspace = true }
 rsa = { workspace = true }
+rustls = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 snafu = { workspace = true }

crates/tower-cmd/src/lib.rs

@@ -30,6 +30,8 @@ pub struct App {
 
 impl App {
     pub fn new() -> Self {
+        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+
         let cmd = root_cmd();
 
         // When TOWER_API_KEY is set, skip session entirely — the API key is self-contained

crates/tower-uv/Cargo.toml

@@ -15,6 +15,7 @@ futures-lite = { workspace = true }
 hex = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
+rustls = { workspace = true }
 seahash = { workspace = true }
 tokio = { workspace = true }
 tokio-tar = { workspace = true }

crates/tower-uv/src/install.rs

@@ -211,6 +211,8 @@ async fn download_uv_archive(path: &PathBuf, archive: String) -> Result<PathBuf,
     // Create the directory if it doesn't exist
     std::fs::create_dir_all(&path).map_err(Error::IoError)?;
 
+    let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+
     // Download the file
     let response = reqwest::get(url)
         .await

scripts/rust-client-templates/Cargo.mustache

@@ -44,7 +44,7 @@ reqwest-middleware = { version = "^0.4", features = ["json", "blocking", "multip
 {{/supportMiddleware}}
 {{/supportAsync}}
 {{#supportAsync}}
-reqwest = { version = "^0.12", default-features = false, features = ["json", "multipart", "rustls-tls"] }
+reqwest = { version = "^0.12", default-features = false, features = ["json", "multipart", "rustls-tls-webpki-roots-no-provider"] }
 {{#supportMiddleware}}
 reqwest-middleware = { version = "^0.4", features = ["json", "multipart"] }
 {{/supportMiddleware}}