[JacobStephens2]

Summary

No flag can drop aws-lc or the image stack. Both are forced by axoupdater's required axoasset/remote, so this PR only records why, in Cargo.toml, and the follow-up is on #174 (comment).

thirdshift ── axoupdater 0.10.2 [github_releases → axoasset/remote]   (needed: uses axoasset::reqwest ungated)
                └── axoasset 2.0.1 [remote = reqwest + image]         (no feature leaves either out)
                      ├── image → moxcms → pxfm
                      └── reqwest [default-tls = rustls = __rustls-aws-lc-rs]
                            └── aws-lc-rs → aws-lc-sys

Features unify, so switching our own reqwest to rustls-no-provider plus rustls's ring still builds aws-lc (checked with cargo tree -i aws-lc-sys), and would build ring on top of it. So our reqwest is left as it was.

 [dependencies]
 anyhow = "1.0.104"
+# axoupdater needs axoasset's `remote` feature, which always pulls in `image`
+# ... No flag turns either off, and features unify ...
+# needs an axoasset change or another updater (#174).
 axoupdater = { ... }

The first acceptance criterion is not met: cargo tree -i aws-lc-sys still finds it. Every way to meet it is out of scope under #174: forking axoasset with [patch], going back to axoupdater 0.9 / axoasset 1.x, or replacing axoupdater. The #174 comment lays out these options. The maintainer should decide whether that's enough to close #203.

Evidence

Cold cargo test --no-run (empty target dir), and then a warm full cargo test, against the #174 baseline. There's no dependency change, so the difference comes from machine load, not from this PR. Other Runs were active, and load was about 3× the baseline's, so these times are not idle-machine numbers.

Measurement	Baseline (#174)	This PR
Cold cargo test --no-run wall	127s	275s
Cold cargo test --no-run user + sys	336s	278s + 47s = 325s
Load during cold build (1-min mean / max)	3.54 / 4.53	10.81 / 12.66
Warm full cargo test wall	268s	664s
Warm full cargo test user + sys	701s	479s + 218s = 697s

• Full suite: all binaries test result: ok, 0 failed.
• cargo tree -i aws-lc-sys: still present, via our reqwest rustls feature and via axoasset default-tls. With our side switched to rustls-no-provider, it's still present via axoasset.
• HTTPS and TLS behaviour: unchanged, since the resolved dependency graph and Cargo.lock are untouched.

Merge Danger

Door: two-way

A comment only.

Blast Radius: none

Cargo.lock and the built binary are unchanged.

Unaddressed findings

Standards

• None. Both wording points ("Neither … it", and "reqwest has no ring feature") were fixed in 8df4211.

Spec

• "cargo tree -i aws-lc-sys (and aws-lc-rs) finds nothing": not met. The only fixes are forking, downgrading or replacing axoupdater, and Make the test suite faster #174 puts all of those out of scope. Explained on Make the test suite faster #174.
• "a manual thirdshift update check against the real release endpoint still works": skipped. The dependency graph and Cargo.lock are unchanged, so the updater is byte-for-byte the same. A dev build has no install receipt and refuses before any network call. Running the installed copy would replace the maintainer's binary.

Closes #203

🤖 Generated with Claude Code