after test from other command I see other attohttpc usage.

So I added the load certs on all attohttpc call.

If someone known how ensure the rustls-native-certs is call only once, and configure attohttpc to always use theses certs, I take

OK, all attohttpc use rustls-native-certs now.
But I don't know how to make a global lazy Cert Vec, to load once rustls-native-certs, and reuse certs at each call.

Hi @Purexo, thanks for taking this on! I believe there are some potential issues, not with your changes, but with how attohttpc imports root certs. I opened sbstp/attohttpc#133 (and will likely look to create a PR into attohttpc this week) to address those. The core issue, as noted in the reqwest package, is that some native cert stores have very old certificates with invalid formats. Turning this on for those systems would mean that every attempt to make a network call would fail.

Instead, I'm proposing to take the same approach and skip over any native certs that don't parse correctly, which should make this more robust to those issues. Once that lands, the changes on the Volta side would be limited to enabling the feature flag within attohttpc, which would be a much smaller diff.

If that doesn't wind up working, however, this will be a great starting point to get those situations working!

I understand your concerns, but rustls-native-certs check the validity of certs before return them so it should be OK.

About the rest of my PR, what do you think about wrap the attohttpc usage in a subcrate to have the same version of attohttpc in all the projec without need to redeclare attohttpc in differents cargo files ?

About the rest of my PR, what do you think about wrap the attohttpc usage in a subcrate to have the same version of attohttpc in all the projec without need to redeclare attohttpc in differents cargo files ?

A good thought, but I think the right solution for that is actually #1367, which will manage that automatically without needing the extra indirection.

Issue is fixed by #1375.
And because workspace is a better approach than wrap a dependencies to use the same version everywhere this PR has no reason to exist, so I close it.

Just one question, #1375 is merged since one month now, I can use personally volta on work because I build it for testing and it's perfect. But I wait a new release to share this software with my colleague. Do you have a date @charlespierce or @chriskrycho in mind for a new release ?