adjust FIPS feature handling w.r.t aws-lc-sys #2291
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2291 +/- ##
=======================================
Coverage 94.89% 94.89%
=======================================
Files 103 103
Lines 24532 24532
=======================================
Hits 23280 23280
Misses 1252 1252 ☔ View full report in Codecov by Sentry. |
c4fc455 to
f921b09
Compare
|
I'll rebase this soon now that #2342 has landed. Edit: all set. |
Previously rustls unconditionally used the aws-lc-sys and prebuilt-nasm features of the aws-lc-rs dep, meaning we always brought along aws-lc-sys (note the prebuilt-nasm feature customizes that dep). However, when a user is looking for a FIPS crypto provider we want to avoid bringing in aws-lc-sys and instead use aws-lc-rs/fips to get aws-lc-fips-sys. This commit makes the aws-lc-rs feature of webpki activate the "usual" config: aws-lc-rs/aws-lc-sys w/ aws-lc-rs/prebuilt-nasm to have aws-lc-sys with prebuilt assmebly to avoid the nasm dep. The pre-existing fips feature of rustls activates aws-lc-rs/fips and the new downstream webpki/aws-lc-rs-fips feature is activated to have that crate do similar. The net result should be no `aws-lc-sys` dep, just `aws-lc-fips-sys`.
f921b09 to
59db772
Compare
djc
approved these changes
Feb 27, 2025
Benchmark resultsInstruction countsSignificant differencesThere are no significant instruction count differences Other differencesClick to expand
Wall-timeSignificant differencesThere are no significant wall-time differences Other differencesClick to expand
Additional informationCheckout details:
|
ctz
approved these changes
Feb 27, 2025
auto-merge was automatically disabled
February 27, 2025 19:30
Pull Request is not mergeable
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously
rustlsunconditionally used theaws-lc-sysandprebuilt-nasmfeatures of theaws-lc-rsdep, meaning we always brought alongaws-lc-sys(note theprebuilt-nasmfeature customizes that dep). See rustls/webpki#307However, when a user is looking for a FIPS crypto provider we want to avoid bringing in
aws-lc-sysand instead useaws-lc-rs/fipsto getaws-lc-fips-sys.This commit makes the
aws-lc-rsfeature of webpki activate the "usual" config:aws-lc-rs/aws-lc-sysw/aws-lc-rs/prebuilt-nasmto haveaws-lc-syswith prebuilt assmebly to avoid thenasmdep.The pre-existing
fipsfeature ofrustlsnow activatesaws-lc-rs/fips. The new downstreamwebpki/fipsfeature is activated to have that crate do similar. The net result should be noaws-lc-sysdep, justaws-lc-fips-sys.