fix: pgsrv should initialize its own crypto provider

crates/pgsrv/Cargo.toml

@@ -27,6 +27,7 @@ parser = { path = "../parser" }
 pgrepr = { path = "../pgrepr" }
 proxyutil = { path = "../proxyutil" }
 sqlexec = { path = "../sqlexec" }
+once_cell = "1.19.0"
 rustls-pemfile = "2.1.2"
 tokio-postgres = "0.7.11"
 tokio-rustls = "0.26.0"

crates/pgsrv/src/errors.rs

@@ -47,7 +47,7 @@ pub enum PgSrvError {
     CloudResponse(String),
 
     #[error("internal error: {0}")]
-    InternalError(String),
+    Internal(String),
 
     /// We've received an unexpected message identifier from the frontend.
     /// Includes the char representation to allow for easy cross referencing
@@ -71,7 +71,7 @@ pub enum PgSrvError {
     SqlExec(#[from] sqlexec::errors::ExecError),
 
     #[error(transparent)]
-    Datafusion(#[from] datafusion::error::DataFusionError),
+    DataFusion(#[from] datafusion::error::DataFusionError),
 
     #[error(transparent)]
     Arrow(#[from] datafusion::arrow::error::ArrowError),

crates/pgsrv/src/messages.rs

@@ -263,7 +263,7 @@ impl<'a> FieldDescriptionBuilder<'a> {
     }
 
     pub fn build(self) -> Result<FieldDescription> {
-        let pg_type = self.pg_type.ok_or(PgSrvError::InternalError(
+        let pg_type = self.pg_type.ok_or(PgSrvError::Internal(
             "type cannot be `None` in field description".to_string(),
         ))?;
 

crates/pgsrv/src/ssl.rs

@@ -3,6 +3,7 @@ use std::pin::Pin;
 use std::sync::Arc;
 use std::task::{Context, Poll};
 
+use once_cell::sync::OnceCell;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer};
 use rustls::{server, sign, ServerConfig};
 use tokio::fs;
@@ -33,15 +34,32 @@ impl SslConfig {
         for key in rustls_pemfile::pkcs8_private_keys(&mut key_bs.as_slice()) {
             keys.push(key?.secret_pkcs8_der().to_vec());
         }
+
+
         let key = match keys.len() {
             0 => return Err(PgSrvError::ReadCertsAndKeys("No keys found")),
             1 => PrivateKeyDer::try_from(keys.pop().unwrap())
-                .map_err(|e| PgSrvError::InternalError(e.to_owned()))?,
+                .map_err(|e| PgSrvError::Internal(e.to_owned()))?,
             _ => return Err(PgSrvError::ReadCertsAndKeys("Expected exactly one key")),
         };
 
         let resolver = CertResolver::new(chain, &key)?;
 
+        static CRYPTO_PROVIDER: OnceCell<()> = OnceCell::new();
+        CRYPTO_PROVIDER.get_or_try_init(|| {
+            if rustls::crypto::CryptoProvider::get_default().is_none() {
+                rustls::crypto::CryptoProvider::install_default(
+                    rustls::crypto::aws_lc_rs::default_provider(),
+                )
+                .map(|r| r.to_owned())
+                .map_err(|_| {
+                    PgSrvError::Internal("unable to register CryptoProvider".to_string())
+                })?;
+            }
+
+            Ok::<(), PgSrvError>(())
+        })?;
+
         let config = ServerConfig::builder()
             .with_no_client_auth()
             .with_cert_resolver(Arc::new(resolver));
@@ -151,7 +169,6 @@ where
 mod tests {
     use std::io::Write;
 
-    use rustls::crypto::{aws_lc_rs, CryptoProvider};
     use tempfile::NamedTempFile;
 
     use super::*;
@@ -192,8 +209,6 @@ MC4CAQAwBQYDK2VwBCIEIDGe13glRciPej49XvEZqqq4oZ5yUuL9HD2Pw1rSue2j
 
     #[tokio::test]
     async fn create_with_valid_cert() {
-        CryptoProvider::install_default(aws_lc_rs::default_provider()).unwrap();
-
         let cert = create_file(TEST_CERT);
         let key = create_file(TEST_KEY);