Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

Support linking against a system-installed AWS-LC:
- Set AWS_LC_SYS_SYSTEM_DIR or let pkg-config / OPENSSL_* environment variables auto-detect an existing AWS-LC installation instead of building from source by @justsmth in #1129
- Support system-installed AWS-LC FIPS library for aws-lc-fips-sys by @justsmth in #1143
- Auto-detect system AWS-LC from OPENSSL_* and pkg-config by @justsmth in #1156
- Gate system AWS-LC on a declared minimum version by @justsmth in #1152
Implement Send/Sync for RSA hazmat encryption key types by @justsmth in #1128
Add Salt::none constructor for HKDF by @justsmth in #1135
Add wasm32-unknown-emscripten build and test support by @justsmth in #1059
Report specific key rejection reasons for invalid RSA key sizes by @justsmth in #1153

Upstream AWS-LC (v5.1.0)

aws-lc-sys now aligns with AWS-LC v5.1.0 (previously v1.73.0). Notable upstream changes include:

ML-DSA native assembly backends for x86_64 and aarch64, imported from mldsa-native by @jakemas in aws/aws-lc#3195 and aws/aws-lc#3219
Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs)

Build Improvements

Fix memcmp_check build failure when CFLAGS contains LTO flags by @justsmth in #1134
Fix missing poly_Rq_mul symbol in Linux x86_64 build by @Lebei2046 in #1130
Apply -ffile-prefix-map to jitterentropy builder by @justsmth in #1139
Select compiler flag dialect by driver mode, not target ABI by @justsmth in #1147

Issues Being Closed

RSA hazmat encryption key types missing Send/Sync -- #1125
RSA key rejection reports generic Unspecified for invalid key sizes -- #1082
Build failure when CFLAGS contains LTO flags (Windows/clang) -- #1132
cargo-xwin (clang-cl) jitterentropy build failure on x86_64-pc-windows-msvc -- #1146
Support system-provided AWS-LC library -- #936
cpu_arm_linux.c assumes sys/auxv.h and getauxval (uclibc targets) -- #1108
jitterentropy embeds absolute paths to files -- #1137

Other Merged PRs

Add ML-DSA aarch64 native assembly to CC builder scripts by @jakemas in #1113
Clarify HKDF info concatenation and encoding responsibility by @justsmth in #1145
CI: support zig cross compile for arm32 by @justsmth in #1124
fix(clippy): fix truncate warnings by @justsmth in #1126
ci: replace dtolnay/rust-toolchain with direct rustup invocations by @justsmth in #1133
Reduce AEAD and RSA test iterations under DISABLE_SLOW_TESTS by @justsmth in #1119
ci(compilers): retry-tolerant curl, latest Go, drop unused PowerShell by @justsmth in #1138
ci(cross): generate MSRV-aware lockfile for alpine-linux by @justsmth in #1150
Harden GitHub Actions workflows against script injection by @justsmth in #1161
Bump actions/upload-artifact from 4 to 7 by @dependabot[bot] in #1141
Bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #1142
Bump codecov/codecov-action from 6 to 7 by @dependabot[bot] in #1144
Bump actions/checkout from 6 to 7 by @dependabot[bot] in #1155
Prepare aws-lc-fips-sys v0.13.15 by @justsmth in #1158
Prepare aws-lc-sys v0.42.0 by @justsmth in #1162
Prepare aws-lc-rs v1.17.1 by @justsmth in #1164

New Contributors

@Lebei2046 made their first contribution in #1130

Full Changelog: https://github.com/aws/aws-lc-rs/compare/v1.17.0...v1.17.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [aws-lc-rs](https://github.com/aws/aws-lc-rs) | dependencies | patch | `1.17.0` → `1.17.1` | --- ### Release Notes <details> <summary>aws/aws-lc-rs (aws-lc-rs)</summary> ### [`v1.17.1`](https://github.com/aws/aws-lc-rs/releases/tag/v1.17.1): aws-lc-rs v1.17.1 [Compare Source](https://github.com/aws/aws-lc-rs/compare/v1.17.0...v1.17.1) 🎉 AWS-LC FIPS v3 Module Has Been Validated The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP: - [Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static) - [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic) Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions. `aws-lc-fips-sys` (utilized via the `fips` feature of `aws-lc-rs`) currently uses the validated FIPS v3 module. - In the upcoming **aws-lc-rs v1.18.0** release, we plan to switch `aws-lc-fips-sys` to our FIPS v4 branch. #### What's Changed - Support linking against a system-installed AWS-LC: - Set `AWS_LC_SYS_SYSTEM_DIR` or let pkg-config / `OPENSSL_*` environment variables auto-detect an existing AWS-LC installation instead of building from source by [@justsmth](https://github.com/justsmth) in [#1129](https://github.com/aws/aws-lc-rs/pull/1129) - Support system-installed AWS-LC FIPS library for `aws-lc-fips-sys` by [@justsmth](https://github.com/justsmth) in [#1143](https://github.com/aws/aws-lc-rs/pull/1143) - Auto-detect system AWS-LC from `OPENSSL_*` and pkg-config by [@justsmth](https://github.com/justsmth) in [#1156](https://github.com/aws/aws-lc-rs/pull/1156) - Gate system AWS-LC on a declared minimum version by [@justsmth](https://github.com/justsmth) in [#1152](https://github.com/aws/aws-lc-rs/pull/1152) - Implement `Send`/`Sync` for RSA hazmat encryption key types by [@justsmth](https://github.com/justsmth) in [#1128](https://github.com/aws/aws-lc-rs/pull/1128) - Add `Salt::none` constructor for HKDF by [@justsmth](https://github.com/justsmth) in [#1135](https://github.com/aws/aws-lc-rs/pull/1135) - Add `wasm32-unknown-emscripten` build and test support by [@justsmth](https://github.com/justsmth) in [#1059](https://github.com/aws/aws-lc-rs/pull/1059) - Report specific key rejection reasons for invalid RSA key sizes by [@justsmth](https://github.com/justsmth) in [#1153](https://github.com/aws/aws-lc-rs/pull/1153) ##### Upstream AWS-LC (v5.1.0) `aws-lc-sys` now aligns with [AWS-LC v5.1.0](https://github.com/aws/aws-lc/releases/tag/v5.1.0) (previously v1.73.0). Notable upstream changes include: - ML-DSA native assembly backends for x86\_64 and aarch64, imported from [mldsa-native](https://github.com/pq-code-package/mldsa-native) by [@jakemas](https://github.com/jakemas) in [aws/aws-lc#3195](https://github.com/aws/aws-lc/pull/3195) and [aws/aws-lc#3219](https://github.com/aws/aws-lc/pull/3219) - Security hardening: stack secret zeroing, tightened PKCS7/OCSP/ASN.1 error handling (Various PRs) ##### Build Improvements - Fix `memcmp_check` build failure when CFLAGS contains LTO flags by [@justsmth](https://github.com/justsmth) in [#1134](https://github.com/aws/aws-lc-rs/pull/1134) - Fix missing `poly_Rq_mul` symbol in Linux x86\_64 build by [@Lebei2046](https://github.com/Lebei2046) in [#1130](https://github.com/aws/aws-lc-rs/pull/1130) - Apply `-ffile-prefix-map` to jitterentropy builder by [@justsmth](https://github.com/justsmth) in [#1139](https://github.com/aws/aws-lc-rs/pull/1139) - Select compiler flag dialect by driver mode, not target ABI by [@justsmth](https://github.com/justsmth) in [#1147](https://github.com/aws/aws-lc-rs/pull/1147) ##### Issues Being Closed - RSA hazmat encryption key types missing `Send`/`Sync` -- [#1125](https://github.com/aws/aws-lc-rs/issues/1125) - RSA key rejection reports generic `Unspecified` for invalid key sizes -- [#1082](https://github.com/aws/aws-lc-rs/issues/1082) - Build failure when CFLAGS contains LTO flags (Windows/clang) -- [#1132](https://github.com/aws/aws-lc-rs/issues/1132) - cargo-xwin (clang-cl) jitterentropy build failure on `x86_64-pc-windows-msvc` -- [#1146](https://github.com/aws/aws-lc-rs/issues/1146) - Support system-provided AWS-LC library -- [#936](https://github.com/aws/aws-lc-rs/issues/936) - `cpu_arm_linux.c` assumes `sys/auxv.h` and `getauxval` (uclibc targets) -- [#1108](https://github.com/aws/aws-lc-rs/issues/1108) - jitterentropy embeds absolute paths to files -- [#1137](https://github.com/aws/aws-lc-rs/issues/1137) #### Other Merged PRs - Add ML-DSA aarch64 native assembly to CC builder scripts by [@jakemas](https://github.com/jakemas) in [#1113](https://github.com/aws/aws-lc-rs/pull/1113) - Clarify HKDF info concatenation and encoding responsibility by [@justsmth](https://github.com/justsmth) in [#1145](https://github.com/aws/aws-lc-rs/pull/1145) - CI: support zig cross compile for arm32 by [@justsmth](https://github.com/justsmth) in [#1124](https://github.com/aws/aws-lc-rs/pull/1124) - fix(clippy): fix truncate warnings by [@justsmth](https://github.com/justsmth) in [#1126](https://github.com/aws/aws-lc-rs/pull/1126) - ci: replace dtolnay/rust-toolchain with direct rustup invocations by [@justsmth](https://github.com/justsmth) in [#1133](https://github.com/aws/aws-lc-rs/pull/1133) - Reduce AEAD and RSA test iterations under DISABLE\_SLOW\_TESTS by [@justsmth](https://github.com/justsmth) in [#1119](https://github.com/aws/aws-lc-rs/pull/1119) - ci(compilers): retry-tolerant curl, latest Go, drop unused PowerShell by [@justsmth](https://github.com/justsmth) in [#1138](https://github.com/aws/aws-lc-rs/pull/1138) - ci(cross): generate MSRV-aware lockfile for alpine-linux by [@justsmth](https://github.com/justsmth) in [#1150](https://github.com/aws/aws-lc-rs/pull/1150) - Harden GitHub Actions workflows against script injection by [@justsmth](https://github.com/justsmth) in [#1161](https://github.com/aws/aws-lc-rs/pull/1161) - Bump actions/upload-artifact from 4 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#1141](https://github.com/aws/aws-lc-rs/pull/1141) - Bump actions/download-artifact from 4 to 8 by [@dependabot](https://github.com/dependabot)\[bot] in [#1142](https://github.com/aws/aws-lc-rs/pull/1142) - Bump codecov/codecov-action from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#1144](https://github.com/aws/aws-lc-rs/pull/1144) - Bump actions/checkout from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#1155](https://github.com/aws/aws-lc-rs/pull/1155) - Prepare aws-lc-fips-sys v0.13.15 by [@justsmth](https://github.com/justsmth) in [#1158](https://github.com/aws/aws-lc-rs/pull/1158) - Prepare aws-lc-sys v0.42.0 by [@justsmth](https://github.com/justsmth) in [#1162](https://github.com/aws/aws-lc-rs/pull/1162) - Prepare aws-lc-rs v1.17.1 by [@justsmth](https://github.com/justsmth) in [#1164](https://github.com/aws/aws-lc-rs/pull/1164) #### New Contributors - [@Lebei2046](https://github.com/Lebei2046) made their first contribution in [#1130](https://github.com/aws/aws-lc-rs/pull/1130) **Full Changelog**: <https://github.com/aws/aws-lc-rs/compare/v1.17.0...v1.17.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

renovate added the

Dependencies

Dependencies/Renovate

labels

2026-07-01 05:02:58 +00:00

renovate added 1 commit

2026-07-01 05:02:58 +00:00

chore(deps): update rust crate aws-lc-rs to v1.17.1

Auto Labeler / Apply labels based on changed files (pull_request_target) Successful in 5s

Details

Checks / Prek / Check changed files (pull_request) Successful in 4s

Details