chore(deps): audit ssl deps (#3110)

<!-- Thank you for making a PR! Bug fixes are always welcome, but if
you're adding a new feature or changing an existing one, we'd really
appreciate if you open an issue, post on the forum, or drop in on
Discord -->

## Checks
- [ ] I am happy for maintainers to push small adjustments to this PR,
to speed up the review cycle
- [ ] I have checked that there are no existing pull requests for the
same thing

3 files changed, 17 insertions, 0 deletions

diff --git a/crates/atuin-common/Cargo.toml b/crates/atuin-common/Cargo.toml
index d65bdc68..811b0bdb 100644
--- a/crates/atuin-common/Cargo.toml
+++ b/crates/atuin-common/Cargo.toml
@@ -25,6 +25,7 @@ directories = { workspace = true }
 sysinfo = "0.30.7"
 base64 = { workspace = true }
 getrandom = "0.2"
+rustls = { workspace = true }
 
 [dev-dependencies]
 pretty_assertions = { workspace = true }
diff --git a/crates/atuin-common/src/lib.rs b/crates/atuin-common/src/lib.rs
index 75bfc3e9..91164a82 100644
--- a/crates/atuin-common/src/lib.rs
+++ b/crates/atuin-common/src/lib.rs
@@ -56,4 +56,5 @@ macro_rules! new_uuid {
 pub mod api;
 pub mod record;
 pub mod shell;
+pub mod tls;
 pub mod utils;
diff --git a/crates/atuin-common/src/tls.rs b/crates/atuin-common/src/tls.rs
new file mode 100644
index 00000000..e8c840e0
--- /dev/null
+++ b/crates/atuin-common/src/tls.rs
@@ -0,0 +1,15 @@
+use std::sync::Once;
+
+static INIT: Once = Once::new();
+
+/// Ensure the rustls crypto provider (ring) is installed.
+///
+/// Must be called before creating any reqwest clients. Safe to call
+/// multiple times — only the first call installs the provider.
+pub fn ensure_crypto_provider() {
+    INIT.call_once(|| {
+        rustls::crypto::ring::default_provider()
+            .install_default()
+            .expect("Failed to install rustls crypto provider");
+    });
+}