[elrrrrrrr]

Draft / investigation. All three trims are implemented, tested, and benched. Opening as draft for review of the tradeoffs (notably: git is now a runtime requirement for git deps).

Result

build (macOS arm64, release profile)	size
baseline (next)	10 MB
+ single TLS provider + drop hickory	8.6 MB
+ system git (drop gix + h2)	6.4 MB

−3.6 MB / −36%. The new pm-binary-size GHA job reports Linux + macOS sizes and asserts the trimmed dep set on both.

1. Git deps via system git (biggest win, ~2.2 MB)

Git dependencies were cloned by bundled gix (a full Rust git impl). Switched to shelling out to the user's git — exactly what npm/pnpm/yarn do. gix dragged in a ~20-crate family, plus gix-transport's default-featured reqwest (the sole non-dev puller of h2/HTTP-2), plus bstr→regex-automata. All gone.

• resolver/git.rs reimplemented on std::process::Command("git"): shallow clone --depth 1 --branch <ref> for branch/tag/HEAD; full clone + checkout for a SHA. rev-parse HEAD pins <cache>/<name>/<sha>/; working tree copied (exec bits + symlinks preserved, .git skipped, path-traversal guard kept). Same public API + cache layout — no façade/pm changes.
• Tradeoff: git is now required for git:/github: deps; a missing binary errors with a clear message naming it (npm is the same). Registry installs need no git.
• Verified: e2e git-deps resolves all three spec forms (github:owner/repo, git+https#tag, owner/repo#tag) to the correct pinned commit.

2. One TLS provider — ring (~0.6 MB)

macOS was compiling two rustls crypto providers: aws-lc-rs (forced by ruborist) and ring (pulled by pm's rustls-tls). Dropped the macOS aws-lc-rs override → all native targets use ring.

The aws-lc-rs special-case existed for "~40% faster M-series cold resolves" — that didn't reproduce. Same-machine A/B (ant-design-sized cold resolve, cache cleared, 5 interleaved runs):

registry	ring (median/min)	aws-lc-rs (median/min)	aws-lc vs ring
registry.npmmirror.com	1.47s / 1.32s	1.87s / 1.83s	+27% slower
registry.antgroup-inc.cn	2.59s / 2.26s	2.84s / 2.19s	+10% median / tied min (noisy)

cold resolve is network-bound, so aws-lc's crypto edge is invisible while its per-client load_native_certs + install_default adds fixed overhead. So this is a size win and a small perf win on China registries.

3. Drop unused hickory-dns (~0.5 MB)

Both clients already set .dns_resolver(shared_resolver()) (custom getaddrinfo + 300s cache), so reqwest's hickory-dns feature was compiled but never used — pure dead weight, zero behavior change, helps every platform.

Research — lighter reqwest / tokio?

Not viable. reqwest is heavy but load-bearing for the resolver's async concurrent-fetch model, and reqwest 0.12 requires tokio; both are deeply embedded. Sync HTTP (ureq) would abandon the concurrency and still need rustls. (Note: with gix gone, reqwest is now pulled only by pm/ruborist, so it could in principle be swapped — but the cost/risk still isn't worth it.) The realistic levers were the dependency trims in this PR.

Verification

• Local macOS arm64 release → 6.4 MB; cargo tree -e no-dev confirms gix/gix-transport/h2/aws-lc-sys/hickory-* all absent, ring sole provider.
• A/B cold-resolve bench (above) on both registries.
• e2e git-deps (3 spec forms) resolve via system git; cargo clippy --all-targets -D warnings clean; cargo test -p utoo-pm 272 passed + 13 ruborist git tests.
• pm-binary-size GHA workflow (ubuntu + macos) reports size + asserts the trimmed set.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request optimizes dependencies and unifies the TLS provider across native targets. It removes the hickory-dns and http2 features from reqwest and eliminates the macOS-specific TLS configuration that used aws-lc-rs, aligning macOS with other native targets to use the default ring provider. This allows for the removal of several unused dependencies, including hickory-resolver, moka, and rustls. The reviewer suggested a further optimization in crates/pm/Cargo.toml to replace "rustls-tls" with "rustls-tls-native-roots" to avoid statically embedding the webpki-roots certificate database, which will further reduce the binary size.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

To further optimize the binary size, consider replacing "rustls-tls" with "rustls-tls-native-roots" in crates/pm/Cargo.toml.\n\nUsing "rustls-tls" enables reqwest's default WebPKI roots feature, which statically embeds the webpki-roots certificate database into the binary, adding around 150–250 KB of unnecessary weight. Since utoo-ruborist already uses and requires "rustls-tls-native-roots" on native targets, the final binary will already rely on the system's native certificate store. Unifying this to "rustls-tls-native-roots" here allows Cargo to completely drop the webpki-roots dependency from the dependency graph, saving additional binary size.

Suggested change

	"rustls-tls",
	"rustls-tls-native-roots",

[elrrrrrrr]

Superseded by #3183 (codex), which takes the same approach (system git, ring TLS, drop hickory/http2) but is a superset: it also trims tokio/full → concrete features and reqwest stream (slightly smaller, 6.32 MB vs 6.4 MB), hardens the git fallback (SHA-256 + --), and folds the size-assert into pm-ci.yml. #3183's CI is green; this branch accidentally bumped the next.js submodule pointer. Posted my ring-vs-aws-lc A/B bench data to #3183 as the empirical justification for dropping aws-lc. Closing in favor of #3183.