Can't use a validated FIPS library (aws-lc-rs) version

[leo-costa]

From the aws-lc-rs crate, only version 1.11.1 has been FIPS validated while the latest version are on still on module review process under AWS-LC 3.0 Cryptographic Module

So the following Cargo.toml work but uses a non validated FIPS library

[package]
name = "rust-fips-140"
version = "0.1.0"
edition = "2024"

# Works because ureq requires rustls ^0.23.22 and
# aws-lc-rs > 0.11.1 is NOT yet fips validated
[dependencies]
aws-lc-rs = { version = "=1.12.1", features = ["fips"] }
rustls = { version = "=0.23.22", features = ["fips"] }
ureq = "3.1.2"

While the following doesn't with the following error:

[package]
name = "rust-fips-140"
version = "0.1.0"
edition = "2024"

# aws-lc-rs 1.11.1 is the only FIPS validated version and rustls
# just to ^0.12 after version 0.23.19
[dependencies]
aws-lc-rs = { version = "=1.11.1", features = ["fips"] }
rustls = { version = "=0.23.19", features = ["fips"] }
ureq = "3.1.2"

    Updating crates.io index
error: failed to select a version for `rustls`.
    ... required by package `ureq v3.1.2`
    ... which satisfies dependency `ureq = "^3.1.2"` of package `rust-fips-140 v0.1.0 (/home/user/dev/experiments/rust-fips-140)`
versions that meet the requirements `^0.23.22` are: 0.23.22, 0.23.31, 0.23.29, 0.23.28, 0.23.27, 0.23.26, 0.23.25, 0.23.24, 0.23.23

all possible versions conflict with previously selected packages.

  previously selected package `rustls v0.23.19`
    ... which satisfies dependency `rustls = "=0.23.19"` of package `rust-fips-140 v0.1.0 (/home/user/dev/experiments/rust-fips-140)`

failed to select a version for `rustls` which could resolve this conflict

Is there anything on the rustls crate that warrants the bump to > 0.23.19 or could we make rustls = { version = "0.23.19" .. }
Thanks !

[algesten]

Hi there!

In a quick test, I don't find a problem with what you suggest, but it makes me a bit uneasy. In a patch versions of rustls between 0.23.19 and the current, we for instance have the switch from webpki-roots pre-version (0.26) to a proper release (1.0.0).

Personally I think that jump could be a big deal for downstream consumers (and I would have liked rustls do that in a bump to 0.24). I decided that ureq would bump minor for this reason.

Downgrading to 0.23.19 would sort of "undo" the reason for going 3.1.0 (it's not entirely true because it's ultimately the lock-file that determines).

While FIPS compatibility could be important, this is the first time anyone asks about it.

[leo-costa]

The reason to ask for some FIPS support is simple, you can't do any work for the US Government without FIPS. I was able to get the reqwest crate to build with the same FIPS support and it uses webpki-roots 1.0 too. I'll later post my Cargo.toml that allowed me to do this.

[algesten]

For now, I will not try to fix this. However I leave this bug open so that others can express an interest in the problem.