Okhttp: RFC: Remove Platform.trustManager

[yschimke]

We only need this for

https://github.com/square/okhttp/blob/7135628c645892faf1a48a8cff464e0ed4ad88cb/okhttp/src/main/java/okhttp3/OkHttpClient.java#L594-L604

And Platform has

https://github.com/square/okhttp/blob/7135628c645892faf1a48a8cff464e0ed4ad88cb/okhttp/src/main/java/okhttp3/internal/platform/Platform.java#L166-L168

So I plan to combine these into a single call.

[yschimke]

Relates to Conscrypt support as otherwise, I need this ghastly method :( or request a nice accessor

https://github.com/yschimke/okhttp/blob/conscrypt/okhttp/src/main/java/okhttp3/internal/platform/ConscryptPlatform.java#L32-L51

I'm assuming with Conscrypt we could use the provider X509ExtendedTrustManager, but I might be missing something.

We can also use the internal class https://github.com/google/conscrypt/blob/29916ef38dc9cb4e4c6e3fdb87d4e921546d3ef4/platform/src/main/java/org/conscrypt/TrustedCertificateIndex.java

[yschimke]

https://github.com/square/okhttp/pull/3611/files

n.b. Not so easy to use X509ExtendedTrustManager as method just fails, doesn't sort or filter.

[liedQM]

The method sslSocketFactory(SSLSocketFactory sslSocketFactory) of OkHttpClient.Builder still has an @deprecated flag. I think that flag was forgotten there.

[swankjesse]

I think we should not support Conscrypt with this deprecated API. I'm even tempted to suggest that if you attempt that combination we just throw. Won't impact any existing apps.

[liedQM]

The problem is that you made a breaking change with 3.9.1 compared to 3.9.0 with making the method trustManager of Plattform protected. Hence it's not possible to set a socket factory using your default trustmanager without calling the deprecated method I mentioned.

[swankjesse]

Gotcha. Everything in internal is undocumented implementation details, and that includes Platform. We don‘t maintain any API compatibility in internal.

[swankjesse]

... which is to say, do whatever you want in Platform!