Set rustls crypto provider explicitly

Cargo.toml

@@ -74,6 +74,7 @@ spin-telemetry = { path = "crates/telemetry", features = [
   "tracing-log-compat",
 ] }
 spin-templates = { path = "crates/templates" }
+spin-tls = { path = "crates/tls" }
 spin-trigger = { path = "crates/trigger" }
 spin-trigger-http = { path = "crates/trigger-http" }
 spin-trigger-redis = { path = "crates/trigger-redis" }

crates/tls/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "spin-tls"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+rustls = { workspace = true }
+
+[lints]
+workspace = true

crates/tls/src/lib.rs

@@ -0,0 +1,15 @@
+use std::sync::Once;
+
+static INSTALL_DEFAULT_CRYPTO_PROVIDER: Once = Once::new();
+
+/// Install Spin's process-wide rustls crypto provider.
+///
+/// This is idempotent for Spin's own duplicate calls from `main` and the trigger,
+/// but fails loudly if something else installed a rustls provider first.
+pub fn install_default_crypto_provider() {
+    INSTALL_DEFAULT_CRYPTO_PROVIDER.call_once(|| {
+        rustls::crypto::ring::default_provider()
+            .install_default()
+            .expect("failed to install rustls ring crypto provider");
+    });
+}

crates/trigger/Cargo.toml

@@ -36,6 +36,7 @@ spin-factor-wasi = { path = "../factor-wasi" }
 spin-factors = { path = "../factors" }
 spin-factors-executor = { path = "../factors-executor" }
 spin-telemetry = { path = "../telemetry" }
+spin-tls = { path = "../tls" }
 spin-world = { path = "../world" }
 tokio = { workspace = true, features = ["fs", "rt"] }
 tracing = { workspace = true }

crates/trigger/src/cli.rs

@@ -185,6 +185,7 @@ pub struct NoCliArgs;
 impl<T: Trigger<B::Factors>, B: RuntimeFactorsBuilder> FactorsTriggerCommand<T, B> {
     /// Create a new TriggerExecutorBuilder from this TriggerExecutorCommand.
     pub async fn run(self) -> Result<()> {
+        spin_tls::install_default_crypto_provider();
         // Handle --help-args-only
         if self.help_args_only {
             Self::command()

src/bin/spin.rs

@@ -2,6 +2,7 @@ use spin_cli::subprocess::ExitStatusError;
 
 #[tokio::main]
 async fn main() {
+    spin_tls::install_default_crypto_provider();
     if let Err(err) = spin_cli::run().await {
         let code = match err.downcast_ref::<ExitStatusError>() {
             // If we encounter an `ExitStatusError` it means a subprocess has already