perf: load TLS certs only for https

crates/common/src/provider/runtime_transport.rs

@@ -144,7 +144,9 @@ impl RuntimeTransport {
 
  /// Connects to an HTTP [alloy_transport_http::Http] transport.
  async fn connect_http(&self) -> Result<InnerTransport, RuntimeTransportError> {
- let mut client_builder = reqwest::Client::builder().timeout(self.timeout);
+ let mut client_builder = reqwest::Client::builder()
+ .timeout(self.timeout)
+ .tls_built_in_root_certs(self.url.scheme() == "https");
  let mut headers = reqwest::header::HeaderMap::new();
 
  // If there's a JWT, add it to the headers if we can decode it.

crates/config/src/etherscan.rs

@@ -306,32 +306,29 @@ impl ResolvedEtherscanConfig {
  let (mainnet_api, mainnet_url) = NamedChain::Mainnet.etherscan_urls().expect("exist; qed");
 
  let cache = chain
- .or_else(|| {
- if api_url == mainnet_api {
- // try to match against mainnet, which is usually the most common target
- Some(NamedChain::Mainnet.into())
- } else {
- None
- }
- })
+ // try to match against mainnet, which is usually the most common target
+ .or_else(|| (api_url == mainnet_api).then(Chain::mainnet))
  .and_then(Config::foundry_etherscan_chain_cache_dir);
 
- if let Some(ref cache_path) = cache {
+ if let Some(cache_path) = &cache {
  // we also create the `sources` sub dir here
  if let Err(err) = std::fs::create_dir_all(cache_path.join("sources")) {
  warn!("could not create etherscan cache dir: {:?}", err);
  }
  }
 
+ let api_url = into_url(&api_url)?;
+ let client = reqwest::Client::builder()
+ .user_agent(ETHERSCAN_USER_AGENT)
+ .tls_built_in_root_certs(api_url.scheme() == "https")
+ .build()?;
  foundry_block_explorers::Client::builder()
- .with_client(reqwest::Client::builder().user_agent(ETHERSCAN_USER_AGENT).build()?)
+ .with_client(client)
  .with_api_key(api_key)
- .with_api_url(api_url.as_str())?
- .with_url(
- // the browser url is not used/required by the client so we can simply set the
- // mainnet browser url here
- browser_url.as_deref().unwrap_or(mainnet_url),
- )?
+ .with_api_url(api_url)?
+ // the browser url is not used/required by the client so we can simply set the
+ // mainnet browser url here
+ .with_url(browser_url.as_deref().unwrap_or(mainnet_url))?
  .with_cache(cache, Duration::from_secs(24 * 60 * 60))
  .build()
  }
@@ -419,6 +416,13 @@ impl fmt::Display for EtherscanApiKey {
  }
 }
 
+/// This is a hack to work around `IntoUrl`'s sealed private functions, which can't be called
+/// normally.
+#[inline]
+fn into_url(url: impl reqwest::IntoUrl) -> std::result::Result<reqwest::Url, reqwest::Error> {
+ url.into_url()
+}
+
 #[cfg(test)]
 mod tests {
  use super::*;