Switch from http to rhttp for Windows certificate support

Windows lazily loads root certificates, and Dart's http package (using
BoringSSL) doesn't trigger this mechanism. This caused CERTIFICATE_VERIFY_FAILED
errors on fresh Windows installs when downloading dependencies from GitHub.

rhttp uses Rust with native TLS, properly integrating with Windows' certificate
store.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: StuartCameronCode

app/lib/main.dart

@@ -1,5 +1,6 @@
 import 'package:flutter/material.dart';
 import 'package:provider/provider.dart';
+import 'package:rhttp/rhttp.dart';
 import 'package:window_manager/window_manager.dart';
 
 import 'models/filter_registry.dart';
@@ -12,6 +13,9 @@ import 'views/main_window.dart';
 void main() async {
   WidgetsFlutterBinding.ensureInitialized();
 
+  // Initialize rhttp (required for Rust FFI on Windows)
+  await Rhttp.init();
+
   // Initialize window manager for desktop
   await windowManager.ensureInitialized();
 

app/lib/services/dependency_manager.dart

@@ -6,7 +6,7 @@ import 'package:archive/archive.dart';
 import 'package:crypto/crypto.dart';
 import 'package:flutter/foundation.dart';
 import 'package:flutter/services.dart';
-import 'package:http/http.dart' as http;
+import 'package:rhttp/rhttp.dart';
 import 'package:path/path.dart' as path;
 
 /// Status of the dependency installation.
@@ -391,34 +391,37 @@ class DependencyManager {
     int? expectedSize,
     String? expectedSha256,
   }) async {
-    final client = http.Client();
+    final digestSink = AccumulatorSink<Digest>();
+    final sha256Sink = sha256.startChunkedConversion(digestSink);
+    final totalBytes = expectedSize ?? 0;
+
     try {
-      final request = http.Request('GET', Uri.parse(url));
-      final response = await client.send(request);
+      // Use rhttp streaming download with progress
+      final response = await Rhttp.getStream(
+        url,
+        onReceiveProgress: (bytesReceived, contentLength) {
+          _progressController.add(DownloadProgress(
+            bytesReceived: bytesReceived,
+            totalBytes: contentLength > 0 ? contentLength : totalBytes,
+            status: 'Downloading...',
+          ));
+        },
+      );
 
+      // Check status code
       if (response.statusCode != 200) {
         throw HttpException(
           'Download failed: HTTP ${response.statusCode}',
           uri: Uri.parse(url),
         );
       }
 
-      final totalBytes = response.contentLength ?? expectedSize ?? 0;
-      var bytesReceived = 0;
+      // Stream to file while computing SHA256
       final sink = destination.openWrite();
-      final digestSink = AccumulatorSink<Digest>();
-      final sha256Sink = sha256.startChunkedConversion(digestSink);
 
-      await for (final chunk in response.stream) {
+      await for (final chunk in response.body) {
         sink.add(chunk);
         sha256Sink.add(chunk);
-        bytesReceived += chunk.length;
-
-        _progressController.add(DownloadProgress(
-          bytesReceived: bytesReceived,
-          totalBytes: totalBytes,
-          status: 'Downloading...',
-        ));
       }
 
       await sink.close();
@@ -434,8 +437,8 @@ class DependencyManager {
           );
         }
       }
-    } finally {
-      client.close();
+    } on RhttpException catch (e) {
+      throw HttpException('Download failed: $e', uri: Uri.parse(url));
     }
   }
 

app/pubspec.yaml

@@ -30,8 +30,8 @@ dependencies:
   # Window management
   window_manager: ^0.4.0
 
-  # HTTP client for dependency downloads
-  http: ^1.2.0
+  # HTTP client for dependency downloads (uses native TLS for Windows cert support)
+  rhttp: ^0.9.0
 
   # Archive extraction
   archive: ^3.6.0