[codex] feat(signal-safe-http-client): add no_std HTTP client

Cargo.toml

@@ -53,6 +53,7 @@ members = [
   "libdd-tinybytes",
   "libdd-dogstatsd-client",
   "libdd-http-client",
+  "libdd-signal-safe-http-client",
   "libdd-agent-client",
   "libdd-log",
   "libdd-log-ffi",

libdd-signal-safe-http-client/Cargo.toml

@@ -0,0 +1,39 @@
+# Copyright 2026-Present Datadog, Inc. https://www.datadoghq.com/
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "libdd-signal-safe-http-client"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+authors.workspace = true
+description = "no_std HTTP client primitives for preallocated transports"
+homepage = "https://github.com/DataDog/libdatadog/tree/main/libdd-signal-safe-http-client"
+repository = "https://github.com/DataDog/libdatadog/tree/main/libdd-signal-safe-http-client"
+
+[lib]
+bench = false
+
+[lints]
+workspace = true
+
+[features]
+default = []
+alloc = ["reqwless/alloc"]
+std = ["alloc", "embedded-io/std", "embedded-io-async/std", "mbedtls?/std"]
+mbedtls = ["dep:mbedtls", "mbedtls/no_std_deps", "mbedtls/ssl", "mbedtls/x509"]
+esp-mbedtls = []
+
+[dependencies]
+embedded-io = { version = "0.6", default-features = false }
+embedded-io-async = { version = "0.6", default-features = false }
+embedded-nal-async = { version = "0.8.0", default-features = false }
+mbedtls = { version = "0.13.5", default-features = false, optional = true }
+reqwless = { version = "0.13.0", default-features = false }
+
+[target.'cfg(target_os = "linux")'.dev-dependencies]
+low_dns = { version = "0.3.0", default-features = false }
+origin = { version = "0.26.2", default-features = false, features = ["origin-start"] }
+rustix = { version = "1.1.3", default-features = false, features = ["event", "fs", "net", "stdio"] }
+sha2 = { version = "0.10", default-features = false }

libdd-signal-safe-http-client/examples/README.md

@@ -0,0 +1,47 @@
+<!-- Copyright 2026-Present Datadog, Inc. https://www.datadoghq.com/ -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+# Examples
+
+Build the Linux `origin` + `rustix` HTTP-only example for a linux-none target
+without enabling this crate's `alloc`, `std`, TLS, or mbedtls features. The
+example streams a fixed Alpine ISO over HTTP into SHA-256 and checks it against a
+hardcoded digest. Name resolution checks `/etc/hosts` first, then uses a
+`low_dns` A-record resolver configured from `/etc/resolv.conf`, including
+`search`/`domain`, `options ndots:n`, CNAME chasing, and TCP fallback for
+truncated UDP responses.
+
+```bash
+RUSTFLAGS="-C target-feature=+crt-static -C relocation-model=static" \
+  cargo +nightly-2026-02-08 build \
+  -p libdd-signal-safe-http-client \
+  --example http_only_no_std \
+  --no-default-features \
+  --target x86_64-unknown-linux-none \
+  -Zbuild-std=core,compiler_builtins \
+  -Zbuild-std-features=compiler-builtins-mem
+```
+
+The static relocation model avoids requiring Origin's experimental PIE
+relocation path for a fully static executable.
+
+```bash
+docker run --rm --platform linux/amd64 \
+  -v "$PWD:/work" \
+  -w /work \
+  debian:bookworm-slim \
+  /work/target/x86_64-unknown-linux-none/debug/examples/http_only_no_std
+```
+
+Build and run a scratch image:
+
+```bash
+printf 'FROM scratch\nCOPY http_only_no_std /http_only_no_std\nENTRYPOINT ["/http_only_no_std"]\n' \
+  | docker build --platform linux/amd64 \
+      -t libdd-signal-safe-http-client:http-only-no-std-scratch \
+      -f - \
+      target/x86_64-unknown-linux-none/debug/examples
+
+docker run --rm --platform linux/amd64 \
+  libdd-signal-safe-http-client:http-only-no-std-scratch
+```

libdd-signal-safe-http-client/examples/http_only_no_std.rs

@@ -0,0 +1,30 @@
+// Copyright 2026-Present Datadog, Inc. https://www.datadoghq.com/
+// SPDX-License-Identifier: Apache-2.0
+
+#![cfg_attr(target_os = "linux", no_std)]
+#![cfg_attr(target_os = "linux", no_main)]
+
+#[cfg(not(target_os = "linux"))]
+fn main() {}
+
+#[cfg(target_os = "linux")]
+#[path = "http_only_no_std/support.rs"]
+mod support;
+
+#[cfg(target_os = "linux")]
+#[unsafe(no_mangle)]
+/// Origin calls this after taking over Linux process startup.
+///
+/// # Safety
+///
+/// `argc`, `argv`, and `envp` must be the initial process arguments provided by
+/// the Linux program loader.
+unsafe extern "C" fn origin_main(_argc: usize, _argv: *mut *mut u8, _envp: *mut *mut u8) -> i32 {
+    origin::program::immediate_exit(support::run())
+}
+
+#[cfg(target_os = "linux")]
+#[panic_handler]
+fn panic(_info: &core::panic::PanicInfo<'_>) -> ! {
+    origin::program::trap()
+}