[dependabot]

Bumps aws-lc-rs from 1.18.2 to 1.19.0.

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.19.0

What's Changed

• Add AES OFB, CFB8, and CFB1 modes by @​lokeswarivejju in aws/aws-lc-rs#1259
  • Adds OperatingMode::OFB, OperatingMode::CFB8, and OperatingMode::CFB1 for AES-128, AES-192, and AES-256 through both the one-shot and streaming cipher APIs.
• Add an on-demand AWS-LC self-test API by @​Elvrarin in aws/aws-lc-rs#1262
  • Adds aws_lc_rs::try_fips_self_test(), allowing applications to re-run all AWS-LC cryptographic algorithm self-tests without calling the sys crate through unsafe FFI. This does not re-run the module integrity test.
• Add Keccak-256 digest support behind "unstable" feature flag by @​fabrice102 in aws/aws-lc-rs#1266
  • Adds aws_lc_rs::unstable::digest::KECCAK256 and KECCAK256_OUTPUT_LEN behind the unstable feature for use with the existing digest::digest and digest::Context APIs.
• Add configurable RSA-PSS salt lengths by @​PaulDance in aws/aws-lc-rs#1267
  • Adds RsaPssSaltLength::{Digest, Max, Custom} and with_pss_salt_length builders on RsaSignatureEncoding and RsaParameters, covering signing and verification for both message and precomputed-digest APIs.
• Implement Clone for signing key pairs by @​JakeHuneau in aws/aws-lc-rs#1277
  • rsa::KeyPair, EcdsaKeyPair, Ed25519KeyPair, and PqdsaKeyPair can now be cloned directly rather than wrapped in an Arc.
  • Clones share the immutable, reference-counted EVP_PKEY; key material is not duplicated, and a clone remains usable after the original is dropped.

Upstream AWS-LC

• aws-lc-sys v0.47.0 aligns with AWS-LC v5.12.0 (previously v5.11.0).
• aws-lc-fips-sys v0.14.4 updates its bundled AWS-LC FIPS 4.2.0 snapshot with recent FIPS 4.x backports.

Build Improvements

• Lower the minimum system-installed AWS-LC version to 4.2.0 by @​justsmth in aws/aws-lc-rs#1268
  • The default aws-lc-sys system-library path now accepts AWS-LC 4.2.0 or newer, previously 5.7.0, allowing use of a FIPS 4.x system library.
  • Enabling the unstable feature requires AWS-LC 5.7.0 or newer because unstable APIs currently include Keccak-256. Bundled-source builds are unaffected.
• Share cc compiler detection across builds by @​johncarmack1984 in aws/aws-lc-rs#1273
  • Reuses compiler detection results across the main library build and compiler feature probes, reducing repeated compiler invocations during cold builds.

Issues Being Closed

• Implement Clone for rsa::KeyPair -- aws/aws-lc-rs#1260
• Expose AWS-LC FIPS on-demand self-test -- aws/aws-lc-rs#1261
• Add a way to specify the RSA-PSS salt length -- aws/aws-lc-rs#1263

Other Merged PRs

• build(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1264
• build(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @​dependabot[bot] in aws/aws-lc-rs#1265
• fix: satisfy Clippy deprecated-since lint and lint legacy-des in CI by @​justsmth in aws/aws-lc-rs#1269
• ci: keep upstream Cargo.lock in rustls integration by @​justsmth in aws/aws-lc-rs#1270
• ci: use dynamic musl CRT for ARM FIPS tests by @​justsmth in aws/aws-lc-rs#1271
• Prepare aws-lc-fips-sys v0.14.4 by @​justsmth in aws/aws-lc-rs#1275
• Prepare aws-lc-sys v0.47.0 by @​justsmth in aws/aws-lc-rs#1274
• Prepare aws-lc-rs v1.19.0 by @​justsmth in aws/aws-lc-rs#1278

New Contributors

• @​lokeswarivejju made their first contribution in aws/aws-lc-rs#1259
• @​johncarmack1984 made their first contribution in aws/aws-lc-rs#1273
• @​JakeHuneau made their first contribution in aws/aws-lc-rs#1277

... (truncated)

Commits

• 5d496f8 Prepare aws-lc-rs v1.19.0 (#1278)
• d099134 Feat: Add the ability to specify an RSA-PSS salt length (#1267)
• b639322 feat(signature): implement Clone for signing key pairs (#1277)
• 7548d5c Prepare aws-lc-sys v0.47.0 (#1274)
• a5862bd Prepare aws-lc-fips-sys v0.14.4 (#1275)
• 9bba3fb perf(builder): share cc's compiler detection across builds (#1273)
• 6a66144 Add Keccak-256 digest algorithm (unstable) (#1266)
• cf4f62b feat(fips): add on-demand AWS-LC self-test API (#1262)
• 825d0e3 feat: support AES OFB, CFB8 and CFB1 modes (#1259)
• c225ce4 Lower minimum system AWS-LC to 4.2.0 and add an unstable floor (#1268)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

1 warning

⚠️ 6 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

✅ 67 untouched benchmarks
⏩ 115 skipped benchmarks¹

---

_{Comparing dependabot/cargo/aws-lc-rs-1.19.0 (7e0347f) with main (4cd42fe)}

Footnotes

1. 115 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩