wreq 1.2.11 → 1.2.13

data/src/client.rs

@@ -11,7 +11,7 @@ use magnus::{Module, Object, RModule, Ruby, TryConvert, Value, function, method,
 use wreq::Proxy;
 
 use crate::{
-    arch::{SUPPORTS_INTERFACE, SUPPORTS_TCP_USER_TIMEOUT},
+    arch::{ProcessLocal, SUPPORTS_INTERFACE, SUPPORTS_TCP_USER_TIMEOUT},
     client::{req::execute_request, resp::Response},
     cookie::Jar,
     emulate::Emulation,
@@ -50,7 +50,7 @@ struct Builder {
     cookie_store: Option<bool>,
     /// Whether to use cookie store provider.
     #[serde(default)]
-    cookie_provider: NativeOption<Jar>,
+    cookie_provider: NativeOption<Obj<Jar>>,
 
     // ========= Timeout options =========
     /// The timeout to use for the client. (in seconds)
@@ -94,6 +94,8 @@ struct Builder {
     // ========= TLS options =========
     /// Whether to verify TLS certificates.
     verify: Option<bool>,
+    /// Whether to retain peer certificate data on responses.
+    tls_info: Option<bool>,
 
     // ========= Network options =========
     /// Whether to disable the proxy for the client.
@@ -118,9 +120,8 @@ struct Builder {
     zstd: Option<bool>,
 }
 
-#[derive(Clone)]
 #[magnus::wrap(class = "Wreq::Client", free_immediately, size)]
-pub struct Client(wreq::Client);
+pub struct Client(ProcessLocal<wreq::Client>);
 
 // ===== impl Builder =====
 
@@ -168,12 +169,7 @@ impl Builder {
         extract_native_option!(options, builder, user_agent);
         extract_native_option!(options, builder, headers);
         extract_native_option!(options, builder, orig_headers);
-        extract_native_option!(
-            options,
-            builder,
-            cookie_provider,
-            Obj<Jar> => |value| (*value).clone()
-        );
+        extract_native_option!(options, builder, cookie_provider);
         builder
             .proxy
             .set(Extractor::<Proxy>::try_convert(options.as_value())?.into_inner());
@@ -190,14 +186,16 @@ impl Client {
     /// # Errors
     ///
     /// Returns Ruby configuration errors from [`Builder::from_options`] or the
-    /// native fallible client builder. Extra positional arguments return
-    /// `ArgumentError`.
+    /// native fallible client builder. An inherited cookie provider returns
+    /// `Wreq::ForkError`, and extra positional arguments return `ArgumentError`.
     pub fn new(ruby: &Ruby, args: &[Value]) -> Result<Self, magnus::Error> {
         Options::from_args(ruby, args, "client")?
             .map(Builder::from_options)
             .transpose()
             .map(Option::unwrap_or_default)
             .and_then(|params| Self::build(ruby, params))
+            .map(ProcessLocal::new)
+            .map(Self)
     }
 
     /// Build the default client through the same fallible path as `new`.
@@ -206,7 +204,7 @@ impl Client {
     ///
     /// Returns `Wreq::BuilderError`, `Wreq::TlsError`, or another mapped native
     /// initialization error without unwinding through Ruby.
-    pub(crate) fn default_client(ruby: &Ruby) -> Result<Self, magnus::Error> {
+    pub(crate) fn default_client(ruby: &Ruby) -> Result<wreq::Client, magnus::Error> {
         Self::build(ruby, Builder::default())
     }
 
@@ -214,8 +212,15 @@ impl Client {
     ///
     /// # Errors
     ///
-    /// Maps native build failures only after the GVL has been reacquired.
-    fn build(ruby: &Ruby, mut params: Builder) -> Result<Self, magnus::Error> {
+    /// Returns `Wreq::ForkError` if the cookie provider belongs to a parent
+    /// process. Native build failures are mapped only after the GVL has been
+    /// reacquired.
+    fn build(ruby: &Ruby, mut params: Builder) -> Result<wreq::Client, magnus::Error> {
+        let mut cookie_provider = params
+            .cookie_provider
+            .take()
+            .map(|jar| jar.clone_store(ruby))
+            .transpose()?;
         let result = gvl::nogvl(|| {
             let mut builder = wreq::Client::builder();
 
@@ -259,12 +264,7 @@ impl Client {
 
             // Cookie options.
             apply_option!(set_if_some, builder, params.cookie_store, cookie_store);
-            apply_option!(
-                set_if_some_inner,
-                builder,
-                params.cookie_provider,
-                cookie_provider
-            );
+            apply_option!(set_if_some, builder, cookie_provider, cookie_provider);
 
             // TCP options.
             apply_option!(
@@ -349,6 +349,7 @@ impl Client {
 
             // TLS options.
             apply_option!(set_if_some, builder, params.verify, tls_cert_verification);
+            apply_option!(set_if_some, builder, params.tls_info, tls_info);
 
             // Network options.
             apply_option!(set_if_some, builder, params.proxy, proxy);
@@ -374,12 +375,22 @@ impl Client {
             apply_option!(set_if_some, builder, params.deflate, deflate);
             apply_option!(set_if_some, builder, params.zstd, zstd);
 
-            builder.build().map(Client)
+            builder.build()
         });
 
         // Ruby exceptions must be created after the GVL has been reacquired.
         result.map_err(|err| wreq_error(ruby, err))
     }
+
+    /// Clone the native client handle in the process that created it.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Wreq::ForkError` when the client was inherited from a parent
+    /// process.
+    fn native_client(&self, ruby: &Ruby) -> Result<wreq::Client, magnus::Error> {
+        self.0.get(ruby).cloned()
+    }
 }
 
 impl Client {
@@ -391,9 +402,9 @@ impl Client {
         ruby: &Ruby,
         args: &[Value],
     ) -> Result<Response, magnus::Error> {
-        let ((method, url), request) = extract_request!(args, (Obj<Method>, String));
+        let ((method, url), request) = extract_request!(ruby, args, (Obj<Method>, String));
         let client = Self::default_client(ruby)?;
-        execute_request(ruby, client.0, *method, url, request)
+        execute_request(ruby, client, *method, url, request)
     }
 
     /// Send a request with `method` through a newly built default client.
@@ -405,72 +416,120 @@ impl Client {
         method: Method,
         args: &[Value],
     ) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
+        let ((url,), request) = extract_request!(ruby, args, (String,));
         let client = Self::default_client(ruby)?;
-        execute_request(ruby, client.0, method, url, request)
+        execute_request(ruby, client, method, url, request)
     }
 
     /// Send a HTTP request.
     #[inline]
     pub fn request(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((method, url), request) = extract_request!(args, (Obj<Method>, String));
-        execute_request(ruby, rb_self.0.clone(), *method, url, request)
+        let ((method, url), request) = extract_request!(ruby, args, (Obj<Method>, String));
+        execute_request(ruby, rb_self.native_client(ruby)?, *method, url, request)
     }
 
     /// Send a GET request.
     #[inline]
     pub fn get(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::GET, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::GET,
+            url,
+            request,
+        )
     }
 
     /// Send a POST request.
     #[inline]
     pub fn post(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::POST, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::POST,
+            url,
+            request,
+        )
     }
 
     /// Send a PUT request.
     #[inline]
     pub fn put(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::PUT, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::PUT,
+            url,
+            request,
+        )
     }
 
     /// Send a DELETE request.
     #[inline]
     pub fn delete(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::DELETE, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::DELETE,
+            url,
+            request,
+        )
     }
 
     /// Send a HEAD request.
     #[inline]
     pub fn head(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::HEAD, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::HEAD,
+            url,
+            request,
+        )
     }
 
     /// Send an OPTIONS request.
     #[inline]
     pub fn options(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::OPTIONS, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::OPTIONS,
+            url,
+            request,
+        )
     }
 
     /// Send a TRACE request.
     #[inline]
     pub fn trace(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::TRACE, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::TRACE,
+            url,
+            request,
+        )
     }
 
     /// Send a PATCH request.
     #[inline]
     pub fn patch(ruby: &Ruby, rb_self: &Self, args: &[Value]) -> Result<Response, magnus::Error> {
-        let ((url,), request) = extract_request!(args, (String,));
-        execute_request(ruby, rb_self.0.clone(), Method::PATCH, url, request)
+        let ((url,), request) = extract_request!(ruby, args, (String,));
+        execute_request(
+            ruby,
+            rb_self.native_client(ruby)?,
+            Method::PATCH,
+            url,
+            request,
+        )
     }
 }
 

data/src/cookie.rs

@@ -18,6 +18,7 @@ use magnus::{
 use wreq::header::{self, HeaderMap, HeaderValue};
 
 use crate::{
+    arch::ProcessLocal,
     error::{header_value_error, type_error},
     gvl,
     options::{NativeOption, Options},
@@ -78,9 +79,14 @@ struct Builder {
 /// A cookie jar that can be shared with a Ruby `Wreq::Client`.
 ///
 /// Pass a populated jar as the client's `cookie_provider` option.
-#[derive(Clone, Default)]
 #[magnus::wrap(class = "Wreq::Jar", free_immediately, size)]
-pub struct Jar(pub Arc<wreq::cookie::Jar>);
+pub struct Jar(ProcessLocal<Arc<wreq::cookie::Jar>>);
+
+impl Default for Jar {
+    fn default() -> Self {
+        Self(ProcessLocal::new(Arc::new(wreq::cookie::Jar::default())))
+    }
+}
 
 // ===== impl Builder =====
 
@@ -309,13 +315,18 @@ impl TryConvert for Cookies {
 impl Jar {
     /// Create a new [`Jar`] with an empty cookie store.
     pub fn new() -> Self {
-        Self(Arc::new(wreq::cookie::Jar::default()))
+        Self::default()
     }
 
     /// Get all cookies.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Wreq::ForkError` when the jar belongs to a parent process.
     pub fn get_all(ruby: &Ruby, rb_self: &Self) -> Result<Value, Error> {
         let cookies: Vec<Cookie> = rb_self
             .0
+            .get(ruby)?
             .get_all()
             .map(RawCookie::from)
             .map(Cookie)
@@ -331,28 +342,53 @@ impl Jar {
     ///
     /// # Errors
     ///
-    /// Returns `TypeError` when `cookie` is neither a [`Cookie`] nor a String.
+    /// Returns `Wreq::ForkError` when the jar belongs to a parent process, or
+    /// `TypeError` when `cookie` is neither a [`Cookie`] nor a String.
     pub fn add(&self, cookie: Value, url: String) -> Result<(), Error> {
+        let ruby = Ruby::get_with(cookie);
+        let jar = self.0.get(&ruby)?;
+
         if let Ok(cookie) = Obj::<Cookie>::try_convert(cookie) {
-            gvl::nogvl(|| self.0.add(cookie.clone_for_jar(), &url));
+            gvl::nogvl(|| jar.add(cookie.clone_for_jar(), &url));
             return Ok(());
         }
 
-        let ruby = Ruby::get_with(cookie);
         let cookie = String::try_convert(cookie)
             .map_err(|_| type_error(&ruby, "cookie must be a Wreq::Cookie or String"))?;
-        gvl::nogvl(|| self.0.add(cookie.as_ref(), &url));
+        gvl::nogvl(|| jar.add(cookie.as_ref(), &url));
         Ok(())
     }
 
     /// Remove a cookie from this jar by name and URL.
-    pub fn remove(&self, name: String, url: String) {
-        gvl::nogvl(|| self.0.remove(name, &url))
+    ///
+    /// # Errors
+    ///
+    /// Returns `Wreq::ForkError` when the jar belongs to a parent process.
+    pub fn remove(ruby: &Ruby, rb_self: &Self, name: String, url: String) -> Result<(), Error> {
+        let jar = rb_self.0.get(ruby)?;
+        gvl::nogvl(|| jar.remove(name, &url));
+        Ok(())
     }
 
     /// Clear all cookies in this jar.
-    pub fn clear(&self) {
-        gvl::nogvl(|| self.0.clear())
+    ///
+    /// # Errors
+    ///
+    /// Returns `Wreq::ForkError` when the jar belongs to a parent process.
+    pub fn clear(ruby: &Ruby, rb_self: &Self) -> Result<(), Error> {
+        let jar = rb_self.0.get(ruby)?;
+        gvl::nogvl(|| jar.clear());
+        Ok(())
+    }
+
+    /// Clone the shared native store in the process that created this jar.
+    ///
+    /// # Errors
+    ///
+    /// Returns `Wreq::ForkError` when the jar was inherited from a parent
+    /// process.
+    pub(crate) fn clone_store(&self, ruby: &Ruby) -> Result<Arc<wreq::cookie::Jar>, Error> {
+        self.0.get(ruby).cloned()
     }
 }
 

data/src/error.rs

@@ -56,6 +56,7 @@ macro_rules! map_wreq_error {
 
 // System-level and runtime errors
 define_exception!(MEMORY, "MemoryError", exception_runtime_error);
+define_exception!(FORK_ERROR, "ForkError", exception_runtime_error);
 
 // Network connection errors
 define_exception!(CONNECTION_ERROR, "ConnectionError", exception_runtime_error);
@@ -98,6 +99,26 @@ pub fn interrupt_error(ruby: &Ruby) -> MagnusError {
     MagnusError::new(ruby.get_inner(&INTERRUPT_ERROR), "request interrupted")
 }
 
+/// Build `Wreq::ForkError` without touching inherited native state.
+#[cfg(unix)]
+pub fn fork_error(ruby: &Ruby, owner_pid: u32, current_pid: u32) -> MagnusError {
+    MagnusError::new(
+        ruby.get_inner(&FORK_ERROR),
+        format!(
+            "wreq-ruby native state was created in process {owner_pid} and cannot be used after fork in process {current_pid}"
+        ),
+    )
+}
+
+/// Map a failed process-fork handler registration to `Wreq::ForkError`.
+#[cfg(unix)]
+pub fn fork_handler_error(ruby: &Ruby, err: &std::io::Error) -> MagnusError {
+    MagnusError::new(
+        ruby.get_inner(&FORK_ERROR),
+        format!("failed to initialize process fork tracking: {err}"),
+    )
+}
+
 /// Map a Tokio runtime initialization failure to `Wreq::BuilderError`.
 pub fn runtime_initialization_error(ruby: &Ruby, err: &std::io::Error) -> MagnusError {
     MagnusError::new(
@@ -239,6 +260,13 @@ pub fn include(ruby: &Ruby, gem_module: &RModule) -> Result<(), MagnusError> {
         "MemoryError",
         exception_runtime_error
     );
+    initialize_exception!(
+        ruby,
+        gem_module,
+        FORK_ERROR,
+        "ForkError",
+        exception_runtime_error
+    );
     initialize_exception!(
         ruby,
         gem_module,

data/src/lib.rs

@@ -15,6 +15,7 @@ mod http;
 mod options;
 mod rt;
 mod serde;
+mod tls;
 
 use magnus::{Error, Module, Ruby, Value};
 
@@ -85,6 +86,7 @@ pub fn patch(ruby: &Ruby, args: &[Value]) -> Result<Response, magnus::Error> {
 fn init(ruby: &Ruby) -> Result<(), Error> {
     let gem_module = ruby.define_module(RUBY_MODULE_NAME)?;
     gem_module.const_set("VERSION", VERSION)?;
+    error::include(ruby, &gem_module)?;
     gem_module.define_module_function("request", magnus::function!(request, -1))?;
     gem_module.define_module_function("get", magnus::function!(get, -1))?;
     gem_module.define_module_function("post", magnus::function!(post, -1))?;
@@ -97,8 +99,8 @@ fn init(ruby: &Ruby) -> Result<(), Error> {
     http::include(ruby, &gem_module)?;
     header::include(ruby, &gem_module)?;
     cookie::include(ruby, &gem_module)?;
+    tls::include(ruby, &gem_module)?;
     client::include(ruby, &gem_module)?;
     emulate::include(ruby, &gem_module)?;
-    error::include(ruby, &gem_module)?;
     Ok(())
 }

data/src/macros.rs

@@ -148,11 +148,10 @@ macro_rules! define_ruby_enum {
 }
 
 macro_rules! extract_request {
-    ($args:expr, $required:ty) => {{
+    ($ruby:expr, $args:expr, $required:ty) => {{
         let args = magnus::scan_args::scan_args::<$required, (), (), (), magnus::RHash, ()>($args)?;
         let required = args.required;
-        let ruby = magnus::Ruby::get_with(args.keywords);
-        let request = crate::client::req::Request::new(&ruby, args.keywords)?;
+        let request = crate::client::req::Request::new($ruby, args.keywords)?;
         (required, request)
     }};
 }

data/src/rt.rs

@@ -1,57 +1,78 @@
-use std::sync::LazyLock;
+use std::{io, sync::OnceLock};
 
 use magnus::Ruby;
-use tokio::runtime::{Builder, Runtime};
+use tokio::runtime::{Builder, Runtime as TokioRuntime};
 
 use crate::{
     error::{interrupt_error, runtime_initialization_error},
     gvl,
 };
 
+#[cfg(unix)]
+use crate::{
+    arch,
+    error::{fork_error, fork_handler_error},
+};
+
 /// Initialize the global runtime lazily and preserve failures for Ruby.
-static RUNTIME: LazyLock<Result<Runtime, std::io::Error>> = LazyLock::new(|| {
-    let mut builder = Builder::new_multi_thread();
+static RUNTIME: OnceLock<Result<TokioRuntime, io::Error>> = OnceLock::new();
 
-    builder.enable_all().build()
-});
+/// Reject a child process that inherited an initialized native runtime.
+///
+/// # Errors
+///
+/// Returns `Wreq::ForkError` when the global runtime belongs to the parent
+/// process.
+fn ensure_runtime_owner(ruby: &Ruby) -> Result<(), magnus::Error> {
+    #[cfg(unix)]
+    if let Some((owner_pid, current_pid)) = arch::forked_process_ids() {
+        return Err(fork_error(ruby, owner_pid, current_pid));
+    }
+
+    #[cfg(not(unix))]
+    let _ = ruby;
 
-enum BlockOnError<E> {
-    Interrupted,
-    Future(E),
+    Ok(())
 }
 
-/// Block on a future to completion on the global Tokio runtime.
+/// Block on a future to completion on the current process's global Tokio runtime.
 ///
 /// The future runs without Ruby's GVL, so it must not construct Ruby objects or
-/// Ruby exceptions. Convert Rust errors back into Ruby errors after the GVL has
-/// been reacquired.
+/// Ruby exceptions. Its output is returned unchanged. If that output is a
+/// `Result`, convert its error after this function returns and reacquires the
+/// GVL.
 ///
 /// # Errors
 ///
-/// Returns `Wreq::BuilderError` if the Tokio runtime cannot be initialized,
-/// `Wreq::InterruptError` if Ruby interrupts the request, or the error produced
-/// by `map_err` if the future fails.
-pub fn try_block_on<F, T, E, M>(ruby: &Ruby, future: F, map_err: M) -> Result<T, magnus::Error>
+/// Returns `Wreq::ForkError` if the runtime belongs to a parent process,
+/// `Wreq::BuilderError` if the Tokio runtime cannot be initialized,
+/// or `Wreq::InterruptError` if Ruby interrupts the operation.
+pub(crate) fn block_on<F>(ruby: &Ruby, future: F) -> Result<F::Output, magnus::Error>
 where
-    F: Future<Output = Result<T, E>>,
-    M: FnOnce(&Ruby, E) -> magnus::Error,
+    F: Future,
 {
+    // Install fork tracking at the same point as the lazy runtime. Loading the
+    // extension alone must not claim the runtime for the parent process.
+    #[cfg(unix)]
+    arch::initialize_fork_tracking().map_err(|err| fork_handler_error(ruby, &err))?;
+
+    ensure_runtime_owner(ruby)?;
     let runtime = RUNTIME
+        .get_or_init(|| {
+            let mut builder = Builder::new_multi_thread();
+            builder.enable_all().build()
+        })
         .as_ref()
         .map_err(|err| runtime_initialization_error(ruby, err))?;
     let result = gvl::nogvl_cancellable(|flag| {
         runtime.block_on(async move {
             tokio::select! {
                 biased;
-                _ = flag.cancelled() => Err(BlockOnError::Interrupted),
-                result = future => result.map_err(BlockOnError::Future),
+                _ = flag.cancelled() => None,
+                result = future => Some(result),
             }
         })
     });
 
-    match result {
-        Ok(value) => Ok(value),
-        Err(BlockOnError::Interrupted) => Err(interrupt_error(ruby)),
-        Err(BlockOnError::Future(err)) => Err(map_err(ruby, err)),
-    }
+    result.ok_or_else(|| interrupt_error(ruby))
 }

data/src/tls.rs

@@ -0,0 +1,51 @@
+//! Ruby wrappers for TLS metadata attached to a response.
+//!
+//! Certificates use the DER encoding described by the X.509 profile in
+//! [RFC 5280 section 4.1](https://www.rfc-editor.org/rfc/rfc5280#section-4.1).
+
+use magnus::{Error, Module, RArray, RModule, RString, Ruby, value::ReprValue};
+
+/// Read-only Ruby wrapper around [`wreq::tls::TlsInfo`].
+///
+/// The native value keeps certificate bytes alive independently of the response
+/// body. Its `Bytes` buffers are cheap to clone, while accessors copy the data
+/// into Ruby-owned Strings so callers cannot mutate the stored metadata.
+#[derive(Clone)]
+#[magnus::wrap(class = "Wreq::TlsInfo", free_immediately, size)]
+pub(crate) struct TlsInfo(pub(crate) wreq::tls::TlsInfo);
+
+impl TlsInfo {
+    /// Copy the DER-encoded leaf certificate into a binary Ruby String.
+    fn peer_certificate(ruby: &Ruby, rb_self: &Self) -> Option<RString> {
+        rb_self
+            .0
+            .peer_certificate()
+            .map(|der| ruby.str_from_slice(der))
+    }
+
+    /// Copy the certificate chain into a frozen Array of binary Ruby Strings.
+    ///
+    /// Only the Array is frozen. Its Strings are independent copies and remain
+    /// mutable in Ruby.
+    fn peer_certificate_chain(ruby: &Ruby, rb_self: &Self) -> Option<RArray> {
+        rb_self.0.peer_certificate_chain().map(|chain| {
+            let certificates = ruby.ary_from_iter(chain.map(|cert| ruby.str_from_slice(cert)));
+            certificates.freeze();
+            certificates
+        })
+    }
+}
+
+/// Define the `Wreq::TlsInfo` Ruby class and its readers.
+pub(crate) fn include(ruby: &Ruby, gem_module: &RModule) -> Result<(), Error> {
+    let tls_info_class = gem_module.define_class("TlsInfo", ruby.class_object())?;
+    tls_info_class.define_method(
+        "peer_certificate",
+        magnus::method!(TlsInfo::peer_certificate, 0),
+    )?;
+    tls_info_class.define_method(
+        "peer_certificate_chain",
+        magnus::method!(TlsInfo::peer_certificate_chain, 0),
+    )?;
+    Ok(())
+}