use std::sync::Arc;

  fn main() {
      let host = "www.rust-lang.org".try_into().unwrap();

      let roots = rustls::RootCertStore::empty();
      let config = rustls::ClientConfig::builder()
          .with_root_certificates(roots)
          .with_no_client_auth();

      // Enter capability mode
      // see https://man.freebsd.org/cgi/man.cgi?capsicum
      unsafe {
          libc::cap_enter();
      }

      // Fail, because we can't open /dev/urandom in capability mode,
      // but this must works with getrandom.
      rustls::ClientConnection::new(Arc::new(config), host).unwrap();
  }