build(deps): bump the aws-ls group with 3 updates

[dependabot]

Bumps the aws-ls group with 3 updates: aws-lc-fips-sys, aws-lc-rs and aws-lc-sys.

Updates aws-lc-fips-sys from 0.13.15 to 0.13.16

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Updates aws-lc-rs from 1.17.1 to 1.17.3

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in aws/aws-lc-rs#1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in aws/aws-lc-rs#1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in aws/aws-lc-rs#1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in aws/aws-lc-rs#1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- aws/aws-lc-rs#1166
• memcmp probe fails under RPM hardened build flags -- aws/aws-lc-rs#1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- aws/aws-lc-rs#1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in aws/aws-lc-rs#1172
• ci: only run push-triggered workflows on main by @​justsmth in aws/aws-lc-rs#1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in aws/aws-lc-rs#1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in aws/aws-lc-rs#1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in aws/aws-lc-rs#1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in aws/aws-lc-rs#1177

New Contributors

• @​Mark-Simulacrum made their first contribution in aws/aws-lc-rs#1174
• @​prasden made their first contribution in aws/aws-lc-rs#1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE] aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Updates aws-lc-sys from 0.42.0 to 0.43.0

Commits

• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions