search

aws / aws-lc-rs

aws-lc-rs is a cryptographic library using AWS-LC for its cryptographic operations. The library strives to be API-compatible with the popular Rust library named ring.
Other
272 stars 50 forks source link

Upgrade the version of the `untrusted` crate #330

Closed joshtriplett closed 7 months ago

joshtriplett commented 8 months ago

Description of changes:

This upgrades the version of the untrusted crate to the latest 0.9, to avoid duplicate dependencies when building aws-lc-rs in a project with other dependencies on untrusted.

Call-outs:

A few deprecated functions take untrusted::Input as a parameter directly. This PR should wait for a new major version of aws-lc-rs that drops those deprecated functions. (Alternatively, it'd be possible to have an untrusted07 feature flag that continues depending on untrusted 0.7 for the sole purpose of the API of those deprecated funtions, but that doesn't seem worthwhile here.)

As far as I can tell, no non-deprecated APIs would be affected, which means future upgrades to untrusted would not have this issue.

Testing:

Builds and passes cargo test, with and without the ring-io and ring-sig-verify feature flags set.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

justsmth commented 8 months ago

This PR should wait for a new major version of aws-lc-rs that drops those deprecated functions.

Thanks for the PR! We don't have plans to publish another major versions on our roadmap. When we eventually do publish a new major version, we will likely drop untrusted as a dependency.

Unfortunately, (although it's deprecated) I don't see a way for us to merge this without breaking some existing consumers.

justsmth commented 8 months ago

As a possible workaround, you could disable default features for aws-lc-rs and only add back the aws-lc-sys feature. (The untrusted crate is only needed when the ring-io feature is enabled.)

joshtriplett commented 8 months ago

@justsmth Unfortunately, rustls is one of the crates that depends on it with default features enabled.

joshtriplett commented 8 months ago

I've submitted https://github.com/rustls/rustls/pull/1768 to attempt to fix that.

justsmth commented 7 months ago

Downstream PR merged. Closing this PR.