feat: enhance TLS support by merging Mozilla WebPKI roots with OS certificate store

ARCHITECTURE.md

@@ -85,7 +85,7 @@ confluence2md is a single Rust crate that exposes one binary (`confluence2md`) a
 - **Responsibility:** Talk to the Confluence REST API v1 and download regular binary assets referenced by the page HTML. draw.io and PlantUML assets are resolved by their dedicated modules first.
 - **Key types:** `EnvConfig`, `PageResult`, `Attachment`, `AttachmentMaps`, `DownloadBinaryOptions`, `DownloadAttachmentOptions`, `DownloadImagesOptions`.
 - **Key functions:**
-    - `build_http_client` — `reqwest` client with `rustls-tls`.
+    - `build_http_client` — `reqwest` client backed by `rustls`. Trust anchors come from both the bundled Mozilla WebPKI root set (`rustls-tls-webpki-roots`) and the host OS certificate store (`rustls-tls-native-roots`); the two sets are merged so corporate / internal CAs trusted by the host work without configuration, and minimal container images without a system CA bundle still work via the bundled roots.
     - `get_required_env` — reads the personal access token from `CONFLUENCE2MD_PERSONAL_ACCESS_TOKEN`.
     - `resolve_page_id_from_url` — supports `pageId`, `/spaces/.../pages/<id>/`, `/display/<space>/<title>`, and `spaceKey`+`title` URL formats.
     - `fetch_confluence_page` — fetches the page with `body.export_view` and `body.storage` expansions.
@@ -310,7 +310,7 @@ No other external services are called.
 ## 8. Security Considerations
 
 - **Authentication:** Confluence Personal Access Token, read from `CONFLUENCE2MD_PERSONAL_ACCESS_TOKEN`. Never logged.
-- **Transport:** HTTPS via `reqwest` with `rustls-tls` (no OpenSSL dependency).
+- **Transport:** HTTPS via `reqwest` with `rustls` (no OpenSSL dependency). Trust anchors are the union of the bundled Mozilla WebPKI root set and the host OS certificate store, so the binary works on minimal container images (no system CA bundle required) and also honors corporate / internal CAs that the host already trusts. This means corporate TLS-inspection proxies whose root CA is installed in the OS store will be silently traversed, which is the standard tradeoff for tools that respect the OS trust store.
 - **Authorization:** Whatever the token's owner can read in Confluence.
 - **Sandbox:** Output is restricted to the resolved `--output-path` directory. `sanitize_file_name` strips path separators and forbidden characters to prevent path traversal in attachment titles.
 - **No `unsafe`:** The crate compiles without `unsafe` blocks; lints are enforced with `-D warnings`.

Cargo.toml

@@ -20,8 +20,21 @@ once_cell = "1"
 percent-encoding = "2.3"
 quick-xml = "0.37"
 regex = "1.10"
+# TLS trust anchors come from both:
+#   * the Mozilla WebPKI root set bundled at compile time
+#     (via the `rustls-tls-webpki-roots` feature), and
+#   * the host operating system certificate store loaded at runtime
+#     (via the `rustls-tls-native-roots` feature).
+#
+# Enabling both features makes `reqwest` merge the two trust sets by
+# default, so the tool works out-of-the-box on minimal container images
+# that ship without a system CA bundle, while still honoring corporate
+# / internal CAs trusted by the host (e.g. Windows certificate store,
+# macOS Keychain, Linux NSS / `/etc/ssl/certs`). No additional
+# `ClientBuilder` configuration is required.
 reqwest = { version = "0.12", default-features = false, features = [
-    "rustls-tls",
+    "rustls-tls-webpki-roots",
+    "rustls-tls-native-roots",
 ] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

README.md

@@ -176,6 +176,6 @@ confluence2md automatically detects the page from various Confluence URL formats
 | Runtime      | [Rust](https://www.rust-lang.org/) (stable, 2024 edition) with [Tokio](https://tokio.rs/)                   |
 | Language     | Rust                                                                                                        |
 | HTML parsing | [`htmd`](https://crates.io/crates/htmd) + [`markup5ever_rcdom`](https://crates.io/crates/markup5ever_rcdom) |
-| HTTP client  | [`reqwest`](https://crates.io/crates/reqwest) with `rustls-tls`                                             |
+| HTTP client  | [`reqwest`](https://crates.io/crates/reqwest) with `rustls` (bundled Mozilla WebPKI roots + OS certificate store) |
 | CLI parsing  | [`clap`](https://crates.io/crates/clap) (derive macros)                                                     |
 | API          | [Confluence REST API v1](https://developer.atlassian.com/cloud/confluence/rest/v1/intro/#about)             |