fix: linux goosed crashing libssl error

[zanesq]

Summary

fixes #6034

Root Cause

The bug was introduced in PR #5251 "goose remote access" which added the tokio-tungstenite dependency with the native-tls feature to crates/goose-server/Cargo.toml:

tokio-tungstenite = { version = "0.28.0", features = ["native-tls"] }

On Linux, native-tls uses OpenSSL via the system's libssl. The build environment (likely Ubuntu 20.04 or similar) links against OpenSSL 1.1 (libssl.so.1.1), but modern Linux distributions ship with OpenSSL 3.x (libssl.so.3):

• Ubuntu 22.04+ → OpenSSL 3.x
• Ubuntu 25.10 → OpenSSL 3.x
• Fedora → OpenSSL 3.x
• Arch Linux → OpenSSL 3.x

This causes a runtime error: libssl.so.1.1: cannot open shared object file.

Fix

Change tokio-tungstenite from native-tls to rustls-tls-native-roots:

-tokio-tungstenite = { version = "0.28.0", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.28.0", features = ["rustls-tls-native-roots"] }

Why this works:

• rustls is a pure Rust TLS implementation - no system OpenSSL dependency
• rustls-tls-native-roots uses the system's certificate store for trust anchors
• This is consistent with reqwest in the same file which already uses rustls-tls

Files Changed

• crates/goose-server/Cargo.toml - one line change

The fix removes native-tls, tokio-native-tls, openssl, openssl-probe, and openssl-sys from the dependency tree, replacing them with rustls and tokio-rustls.

[zanesq]

@michaelneale can you follow up and check if the goose remote access feature still works after this change?

[zanesq]

looking into failing tunnel test

[sheikhlimon]

yeah it was pulling in rustls with aws-lc-rs default provider

[zanesq]

Fix for tests failing:

Using rustls-tls-native-roots instead of native-tls uses rustls (a pure Rust TLS implementation) which doesn't depend on system OpenSSL. However, rustls 0.23.x requires an explicit crypto provider to be installed at runtime so I added the ring feature and the install_default() call.

[DOsinga]

Using rustls-tls-native-roots instead of native-tls uses rustls (a pure Rust TLS implementation) which doesn't depend on system OpenSSL. However, rustls 0.23.x requires an explicit crypto provider to be installed at runtime so I added the ring feature and the install_default() call.

can you say more about this?

[zanesq]

Using rustls-tls-native-roots instead of native-tls switches to rustls, a pure Rust TLS implementation that doesn't depend on system OpenSSL. The native-roots part means it still uses the system's trusted certificate store for validating server certificates.

However, rustls 0.23.x no longer bundles a default cryptographic backend—it requires an explicit crypto provider to be installed at runtime. The library supports two options: ring (mature, widely used) or aws-lc-rs (AWS's libcrypto). Since both were already in our dependency tree via other crates, I chose ring and added the install_default() call to register it as the process-wide crypto provider before any TLS connections are made.