Skip to content

aws-lc-rs v1.18.2

Latest
Latest

Choose a tag to compare

View all tags
@justsmth justsmth released this 12 Oct 15:30
· 2 commits to main since this release
v1.18.2
9df4975
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Implement Eq and PartialEq for RSA and EdDSA parameters by @dsykes16 in #1228
    • RsaParameters can now be compared directly against RSA verification constants. Algorithms with different digests, padding schemes, or modulus-size ranges compare unequal. EdDSAParameters also gains equality support.
  • Add wasm32-wasip2 and wasm32-wasip3 support by @ricochet in #1239
    • Adds non-FIPS builds using universal bindings, with CI coverage under Wasmtime and wasi-sdk 34. WASIp3 requires nightly Rust.
    • Direct aws-lc-sys consumers must disable the default all-bindings feature for these targets.
  • Publish the intended RandomizedNonceKey::open_in_place documentation by @Serophots in #1227
    • Makes the existing nonce, ciphertext/tag layout, and buffer-on-error contract visible in rustdoc. No runtime behavior changes.

Upstream AWS-LC

  • aws-lc-sys v0.46.0 aligns with AWS-LC v5.11.0 (previously v5.7.0). See also the release notes for v5.8.0, v5.9.0, and v5.10.0.
    • The Ed25519 C-implementation decoder now rejects non-canonical public keys, matching the assembly-optimized implementations: aws/aws-lc#3457
    • Includes ChaCha20-Poly1305 key-material zeroization and fixes ML-KEM CPU feature detection to avoid illegal-instruction failures on x86-64 CPUs with AVX2 but no BMI2: aws/aws-lc#3552 and aws/aws-lc#3596
  • aws-lc-fips-sys v0.14.3 updates its bundled AWS-LC FIPS 4.2.0 snapshot and regenerates bindings. It remains on the FIPS 4.x release line.

Build Improvements

  • Raise the minimum system AWS-LC version to 5.7.0 by @justsmth in #1243
    • Non-FIPS system-library installations must now provide AWS-LC 5.7.0 or newer, previously 1.68.0. Bundled-source builds and FIPS version requirements are unchanged.
  • Fix static FIPS system-library linking by @justsmth in #1236
    • Fixes unresolved FIPS_mode references with GNU ld.bfd when linking a prebuilt static FIPS library, including binaries that do not call crypto and builds where LTO removes those calls.
    • Uses whole-archive linking to retain libcrypto, including in downstream Rust staticlib outputs. This can increase binary size; dynamic FIPS and non-FIPS linking are unchanged.
  • Fix Cranelift linking by @justsmth in #1234
    • Normalizes binding link names to avoid undefined-symbol failures, including when Cranelift is selected through Cargo profiles rather than RUSTFLAGS. The AWS_LC_SYS_NO_U1_BINDINGS workaround is no longer needed.
  • Fix jitterentropy builds with optimizing CFLAGS and newer cc versions by @justsmth in #1254
    • Keeps filtered flags in effect throughout the jitterentropy builder's lifetime, preventing cached environment reads from allowing flags such as -O2 to override its required -O0.
  • Honor AWS_LC_SYS_CC in the main library build by @justsmth in #1255
    • Applies crate-specific compiler overrides before compiler lookup in both CC and CMake build paths, keeping compiler selection and capability probes consistent when cc caches environment reads.
  • Improve archive reproducibility through symlinked build paths by @justsmth in #1238
    • Prevents the non-Windows CC builder from incorporating symlink-resolved absolute build paths into archive member names, avoiding unnecessary downstream compile-cache misses. Windows short-path handling is unchanged.
  • Upgrade bindgen to 0.73 by @xtqqczze in #1244
  • Document the system-library trust model by @justsmth in #1218
    • Clarifies that supplied paths and pkg-config results are trusted build inputs, and that FIPS validation can execute candidate library code before accepting or rejecting it. Documents runner requirements and how to disable automatic system-library detection.

Issues Being Closed

  • Cranelift builds fail with codegen-backend = "cranelift" -- #1231
  • Upgrade bindgen to v0.73 -- #1245
  • Undefined FIPS_mode when linking a prebuilt FIPS module into a binary that does not use crypto -- #1246
  • Jitterentropy fails with "must not be compiled with optimizations" in aws-lc-rs v1.18.1 / aws-lc-sys v0.45.0 -- #1252

Other Merged PRs

New Contributors

Full Changelog: v1.18.1...v1.18.2

Contributors

ricochet, dependabot, and 5 other contributors
Assets 2
Loading