Pin aws-lc-rs <1.18 to retain AWS-LC-FIPS 3.x, redux - #173
Open
lucaspimentel wants to merge 1 commit into
Open
lucaspimentel wants to merge 1 commit into
lucaspimentel wants to merge 1 commit into
Conversation
Add an explicit optional aws-lc-rs dependency to datadog-fips and activate it from the fips feature. Capping rustls does not reliably constrain the crypto backend, so a future `cargo update` can re-bump aws-lc-rs to 1.18, which pulls in AWS-LC-FIPS 4.x pending FIPS 140-3 certification. Restore rustls to its ordinary semver requirement and regenerate the lockfile to the latest compatible versions (rustls 0.23.43, rustls-webpki 0.103.13, aws-lc-rs 1.17.4, aws-lc-fips-sys 0.13.17), making the manifest and lockfile consistent again under --locked.
lucaspimentel
marked this pull request as ready for review
September 24, 2026 16:43
lucaspimentel
requested review from
DarcyRaynerDD and
Lewis-E
and removed request for
a team
September 24, 2026 16:43
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Retain the Rustls upper bound or enforce an equivalent guardrail to prevent AWS-LC-FIPS 4.x from entering the FIPS dependency graph.
Review effort: Lite
Findings: None
What changed in this PR
Pins aws-lc-rs below 1.18 to retain AWS-LC-FIPS 3.x compatibility and regenerates the lockfile.
Changes:
- Adds the optional backend dependency to the
fipsfeature. - Resolves compatible Rustls and AWS-LC versions.
- Preserves the existing advisory waiver.
| File | Description |
|---|---|
crates/datadog-fips/Cargo.toml |
Adds the FIPS backend constraint and activation. Retain the rustls <0.23.45 cap or an equivalent CI/lockfile guardrail. |
Cargo.lock |
Resolves compatible AWS-LC, Rustls, and webpki versions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
lucaspimentel
changed the title
Member
Author
|
@DataDog review |
![datadog-official[bot]](https://avatars.githubusercontent.com/in/1358509?s=60&v=4){kind=small}
lucaspimentel
changed the title
aws-lc-rs <1.18 to retain AWS-LC-FIPS 3.x, redux
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Adds an explicit optional
aws-lc-rs = { version = ">=1, <1.18" }dependency todatadog-fipsand activates it from thefipsfeature, replacing the previous rustls upper bound (rustls <0.23.45), and regenerates the lockfile to the latest compatible versions.This follows the backend-pinning approach from DataDog/saluki#2348: capping rustls does not reliably constrain the transitive crypto backend (rustls 0.23.37 still accepts aws-lc-rs 1.18.x), so the backend itself is pinned as a direct dependency even though the crate does not call aws-lc-rs APIs directly.
Resolved versions:
Motivation
Restores consistency between the manifest and lockfile after #172: the manifest capped
rustlsbelow 0.23.45 but the lockfile (updated in #171) pinnedrustls0.23.45 /aws-lc-rs1.18.1, socargo metadata --lockedfailed.aws-lc-rs1.18 switches to AWS-LC-FIPS 4.x, which is pending FIPS 140-3 certification, so the resolved backend must stay on the AWS-LC-FIPS 3.x line (aws-lc-fips-sys0.13.x).Note: this change does not fix RUSTSEC-2026-0285 or establish FIPS certification; the existing advisory waiver in
.cargo/audit.tomlis intentionally preserved.Additional Notes
crates/datadog-fips/src/reqwest_adapter.rsbehavior is unchanged.aws-lc-rs <1.18bound (and remove the advisory waiver) once AWS-LC-FIPS 4.x certification is verified.Describe how to test/QA your changes
cargo metadata --locked --format-version 1andcargo metadata --locked --all-features --format-version 1succeed without modifying the lockfile (previously failed).cargo tree --locked -p datadog-fips --no-default-features --features fips -e features -i aws-lc-rsshows thefipsfeature activating aws-lc-rs 1.17.4 and itsfipsfeature, resolving toaws-lc-fips-sys 0.13.17.cargo check --workspace --locked,cargo fmt --all -- --check, andcargo clippy --workspace --all-features --locked -- -D warningspass.cargo auditpasses with the existing RUSTSEC-2026-0285 waiver.cargo nextest run --workspace --locked --no-fail-fast: 407 passed, 1 failed. The single failure (datadog-trace-agent::integration_test::test_mini_agent_tcp_handles_requests) is pre-existing and reproduces onmainat 8156757; it is unrelated (plain TCP/infoendpoint test, no TLS involvement).