aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @prasden in #1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @Mark-Simulacrum in #1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @justsmth in #1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @justsmth in #1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- #1166
• memcmp probe fails under RPM hardened build flags -- #1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- #1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @justsmth in #1172
• ci: only run push-triggered workflows on main by @justsmth in #1163
• Prepare aws-lc-sys v0.43.0 by @justsmth in #1176
• Prepare aws-lc-rs v1.17.2 by @justsmth in #1178
• Prepare aws-lc-fips-sys v0.13.16 by @justsmth in #1180
• build(deps): bump actions/setup-go from 6 to 7 by @dependabot[bot] in #1177

New Contributors

• @Mark-Simulacrum made their first contribution in #1174
• @prasden made their first contribution in #1167

Full Changelog: v1.17.1...v1.17.3

Note

aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.