From 933ad4f2ff9bc04acb2ddbcbc526f47f6b8b9972 Mon Sep 17 00:00:00 2001 From: Lucas Pimentel Date: Thu, 24 Sep 2026 19:02:03 -0400 Subject: [PATCH 1/2] chore(deps): pin aws-lc-rs <1.18 to retain AWS-LC-FIPS 3.x backend The rustls <0.23.45 cap did not reliably constrain the transitive crypto backend: rustls 0.23.37 still permits aws-lc-rs 1.18, which switches to AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Pin the backend directly (>=1, <1.18), activated by the fips feature, mirroring DataDog/saluki#2348 and DataDog/serverless-components#173. Resolves to rustls 0.23.43, aws-lc-rs 1.17.4, aws-lc-fips-sys 0.13.17. The RUSTSEC-2026-0285 waiver is kept: the fix ships in rustls 0.23.45, which stays out of range. --- bottlecap/Cargo.lock | 19 +++++++++++-------- bottlecap/Cargo.toml | 11 +++++++---- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/bottlecap/Cargo.lock b/bottlecap/Cargo.lock index 892b0366f..61b5cf23d 100644 --- a/bottlecap/Cargo.lock +++ b/bottlecap/Cargo.lock @@ -282,23 +282,24 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8" [[package]] name = "aws-lc-fips-sys" -version = "0.13.13" +version = "0.13.17" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8bce4948d2520386c6d92a6ea2d472300257702242e5a1d01d6add52bd2e7c1" +checksum = "00ccb9bd2963c4dbcded8052b5666f329a7ccc75d04dea723eece6077ad5e6dc" dependencies = [ "bindgen", "cc", "cmake", "dunce", "fs_extra", + "pkg-config", "regex", ] [[package]] name = "aws-lc-rs" -version = "1.16.2" +version = "1.17.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a054912289d18629dc78375ba2c3726a3afe3ff71b4edba9dedfca0e3446d1fc" +checksum = "932661a1d72328fe06ca79371bede83206f953544cf376d4a1c70b7cbd7b4cc2" dependencies = [ "aws-lc-fips-sys", "aws-lc-sys", @@ -307,14 +308,15 @@ dependencies = [ [[package]] name = "aws-lc-sys" -version = "0.39.0" +version = "0.45.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "1fa7e52a4c5c547c741610a2c6f123f3881e409b714cd27e6798ef020c514f0a" +checksum = "9bff6c3b54fad79a2e60b8102caf565819711497c1f5f092f49508e2f5c31b27" dependencies = [ "cc", "cmake", "dunce", "fs_extra", + "pkg-config", ] [[package]] @@ -488,6 +490,7 @@ version = "0.1.0" dependencies = [ "anyhow", "async-trait", + "aws-lc-rs", "axum", "base64 0.22.1", "bytes", @@ -3618,9 +3621,9 @@ dependencies = [ [[package]] name = "rustls" -version = "0.23.37" +version = "0.23.43" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "758025cb5fccfd3bc2fd74708fd4682be41d99e5dff73c377c0646c6012c73a4" +checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" dependencies = [ "aws-lc-rs", "log", diff --git a/bottlecap/Cargo.toml b/bottlecap/Cargo.toml index b97e8510b..9e9260b7b 100644 --- a/bottlecap/Cargo.toml +++ b/bottlecap/Cargo.toml @@ -44,10 +44,12 @@ hmac = { version = "0.12", default-features = false } sha2 = { version = "0.10", default-features = false } hex = { version = "0.4", default-features = false, features = ["std"] } base64 = { version = "0.22", default-features = false } -# Resolved version is intentionally held below 0.23.45 (see .cargo/audit.toml): that version -# requires aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. -# Do not bump until a FIPS-certified aws-lc-rs is available, or a future `cargo update` will re-bump it. -rustls = { version = ">=0.23.18, <0.23.45", default-features = false } +rustls = { version = "0.23.18", default-features = false } +# Constrain the transitive FIPS crypto backend: aws-lc-rs 1.18 switches to +# AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Lift this bound only +# after 4.x certification is verified. See .cargo/audit.toml and +# DataDog/serverless-components#173. +aws-lc-rs = { version = ">=1, <1.18", default-features = false, optional = true } # Transitive via rustls. Pinned to >=0.103.13 so cargo audit passes (RUSTSEC-2026-0098, RUSTSEC-2026-0099, RUSTSEC-2026-0104). rustls-webpki = { version = "0.103.13", default-features = false } rustls-pemfile = { version = "2.0", default-features = false, features = ["std"] } @@ -172,6 +174,7 @@ fips = [ "libdd-trace-obfuscation/fips", "libdd-trace-stats/fips", "datadog-fips/fips", + "dep:aws-lc-rs", "libddwaf/fips", "reqwest/rustls-tls-native-roots-no-provider", "rustls/fips", From 6b05187abc261130c6a7fa89c0fc23933c7c12b8 Mon Sep 17 00:00:00 2001 From: Tianning Li Date: Tue, 29 Sep 2026 16:05:31 -0400 Subject: [PATCH 2/2] chore(deps): retain rustls FIPS compatibility cap --- bottlecap/Cargo.toml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bottlecap/Cargo.toml b/bottlecap/Cargo.toml index 9e9260b7b..07b8f8e0b 100644 --- a/bottlecap/Cargo.toml +++ b/bottlecap/Cargo.toml @@ -44,7 +44,8 @@ hmac = { version = "0.12", default-features = false } sha2 = { version = "0.10", default-features = false } hex = { version = "0.4", default-features = false, features = ["std"] } base64 = { version = "0.22", default-features = false } -rustls = { version = "0.23.18", default-features = false } +# Keep rustls below 0.23.45 while AWS-LC-FIPS 4.x is uncertified. +rustls = { version = ">=0.23.18, <0.23.45", default-features = false } # Constrain the transitive FIPS crypto backend: aws-lc-rs 1.18 switches to # AWS-LC-FIPS 4.x, pending FIPS 140-3 certification. Lift this bound only # after 4.x certification is verified. See .cargo/audit.toml and