add aws-lc-rs-fips feature, adjust sys dep #308
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #308 +/- ##
=======================================
Coverage 97.23% 97.23%
=======================================
Files 20 20
Lines 4225 4225
=======================================
Hits 4108 4108
Misses 117 117 ☔ View full report in Codecov by Sentry. |
cpu
changed the title
SGTM. Updated the name throughout.
Make sense. I broke that out as a separate commit up-front since it's a much more invasive diff. I also cherry-picked Ctz's version bump from #302 to make the semver check in CI happy.
There will be a few CI jobs left stuck in 'expected' based on the |
It appears that GitHub has a newer way to set these up called rule sets, maybe that has gotten better at these kinds of things? (Agreed that the disjointness of workflow job names and their protection status is pretty annoying.) |
We made a mistake using underscores in the original Rustls and Webpki features. We patched over this in Rustls with an alias. Since we're making semver incompat changes, let's fix it here properly.
Previously we unconditionally used the `aws-lc-sys` and `prebuilt-nasm` features of the `aws-lc-rs` dep, meaning we always brought along `aws-lc-sys` (note the `prebuilt-nasm` feature customizes that dep). However, when a user is looking for a FIPS crypto provider we want to avoid bringing in `aws-lc-sys` and instead use `aws-lc-rs/fips` to get `aws-lc-fips-sys`. This commit makes the `aws-lc-rs` feature of `webpki` activate the "usual" config: `aws-lc-rs/aws-lc-sys` w/ `aws-lc-rs/prebuilt-nasm` to have `aws-lc-sys` with prebuilt assmebly to avoid the nasm dep. A new `aws-lc-rs-fips` feature is added for `webpki` that activates the FIPS specific config: `aws-lc-rs/fips`. The `aws-lc-sys` and `prebuilt-nasm` features are **not** activated.
Good catch, fixed up. |
Fixed up. |
Previously we unconditionally used the
aws-lc-sysandprebuilt-nasmfeatures of theaws-lc-rsdep, meaning we always brought alongaws-lc-sys(note theprebuilt-nasmfeature customizes that dep).However, when a user is looking for a FIPS crypto provider we want to avoid bringing in
aws-lc-sysand instead useaws-lc-rs/fipsto getaws-lc-fips-sys.This commit makes the
aws-lc-rsfeature ofwebpkiactivate the "usual" config:aws-lc-rs/aws-lc-sysw/aws-lc-rs/prebuilt-nasmto haveaws-lc-syswith prebuilt assmebly to avoid the nasm dep.A new
aws-lc-rs-fipsfeature is added forwebpkithat activates the FIPS specific config:aws-lc-rs/fips. Theaws-lc-sysandprebuilt-nasmfeatures are not activated.Updates #307