chore(deps): bump aws-lc-rs from 1.17.0 to 1.17.3

[dependabot]

Bumps aws-lc-rs from 1.17.0 to 1.17.3.

Release notes

Sourced from aws-lc-rs's releases.

aws-lc-rs v1.17.3

What's Changed

• Add public API to check AWS-LC and FIPS versions by @​prasden in aws/aws-lc-rs#1167
  • awslc_version() returns the linked AWS-LC library version (e.g., "5.1.0"), resolved at runtime. fips_version() returns the AWS-LC FIPS release-branch version as Some(version), or None when unavailable. Note that fips_version() is independent of try_fips_mode().
• Clarify representations of PqdsaKeyPair in serialized forms by @​Mark-Simulacrum in aws/aws-lc-rs#1174
  • Documents how to use PqdsaKeyPair::from_seed in a FIPS setting, and notes that key pairs constructed from the expanded form cannot be re-serialized to PKCS#8 (which contains just the seed).

Build Improvements

• Fix TARGET_* env leakage into host builds by @​justsmth in aws/aws-lc-rs#1171
  • Per the cc-rs convention, TARGET_CC/TARGET_CXX/TARGET_CFLAGS are now only applied when cross-compiling, and HOST_* variables are honored for native builds. Previously, when aws-lc-sys appeared as both a dependency and a build-dependency in a cross build, the cross toolchain's flags leaked into the host-side build.
• Restore cc default flags in memcmp probe; only fail build on confirmed bug by @​justsmth in aws/aws-lc-rs#1173
  • Fixes build failures under RPM hardened build flags (Fedora/RHEL/Rocky rpmbuild defaults): the memcmp probe (GCC bug 95189 check) now retains cc's computed target default flags (e.g., -fPIC) while still excluding user CFLAGS. The check also only runs for GCC versions that may contain the bug, and a probe that fails to build only warns -- the build only fails when the miscompilation is actually demonstrated.

Issues Being Closed

• Public API for FIPS status -- aws/aws-lc-rs#1166
• memcmp probe fails under RPM hardened build flags -- aws/aws-lc-rs#1168
• Cross-compilation failure: TARGET_CFLAGS applied to host builds -- aws/aws-lc-rs#1169

Other Merged PRs

• ci: Stop installing winehq-stable in cross windows-gnu pre-build by @​justsmth in aws/aws-lc-rs#1172
• ci: only run push-triggered workflows on main by @​justsmth in aws/aws-lc-rs#1163
• Prepare aws-lc-sys v0.43.0 by @​justsmth in aws/aws-lc-rs#1176
• Prepare aws-lc-rs v1.17.2 by @​justsmth in aws/aws-lc-rs#1178
• Prepare aws-lc-fips-sys v0.13.16 by @​justsmth in aws/aws-lc-rs#1180
• build(deps): bump actions/setup-go from 6 to 7 by @​dependabot[bot] in aws/aws-lc-rs#1177

New Contributors

• @​Mark-Simulacrum made their first contribution in aws/aws-lc-rs#1174
• @​prasden made their first contribution in aws/aws-lc-rs#1167

Full Changelog: aws/aws-lc-rs@v1.17.1...v1.17.3

[!NOTE] aws-lc-rs v1.17.2 has been yanked. It failed to compile with the fips feature when aws-lc-fips-sys resolved to v0.13.15 (or earlier), since that version lacks functions needed by the new version APIs. v1.17.3 is identical to v1.17.2 aside from requiring aws-lc-fips-sys v0.13.16.

aws-lc-rs v1.17.1

🎉 AWS-LC FIPS v3 Module Has Been Validated

The AWS-LC FIPS v3 module has been awarded FIPS 140-3 validation by NIST's CMVP:

• [Certificate #5314](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314) (static)
• [Certificate #5298](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298) (dynamic)

Seek guidance from a local FIPS compliance expert regarding requirements for your deployment environments. Please consult the Security Policies associated with our certificates if you have questions.

aws-lc-fips-sys (utilized via the fips feature of aws-lc-rs) currently uses the validated FIPS v3 module.

• In the upcoming aws-lc-rs v1.18.0 release, we plan to switch aws-lc-fips-sys to our FIPS v4 branch.

What's Changed

• Support linking against a system-installed AWS-LC:

... (truncated)

Commits

• 9232f4d Prepare aws lc fips sys v0.13.16 (#1180)
• d722b90 Prepare aws-lc-rs v1.17.2 (#1178)
• 33cbbac Add public API to check AWS-LC and FIPS versions (#1167)
• f031b06 Clarify PqdsaKeyPair serialized formats (#1174)
• deeff57 build(deps): bump actions/setup-go from 6 to 7 (#1177)
• aac7333 Prepare aws-lc-sys v0.43.0 (#1176)
• 6e92439 fix: restore cc default flags in memcmp probe; only fail build on confirmed b...
• 997202f ci: only run push-triggered workflows on main (#1163)
• e017679 fix: memcmp probe PIE mismatch and TARGET_* env leakage into host builds (#1171)
• 5336e79 ci: fix cross windows-gnu pre-build wine dpkg conflict (#1172)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #22.