Skip to content

fix(NATSRS-010-2): CU-86akbhh82 async-nats/Cargo.toml enables both ring and aws-lc-rs unconditionally by default #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
flamingo wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −1
Draft

fix(NATSRS-010-2): CU-86akbhh82 async-nats/Cargo.toml enables both ring and aws-lc-rs unconditionally by default #136

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion async-nats/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jsonschema = "0.17.1"
num = "0.4.1"

[features]
default = ["server_2_10", "server_2_11", "server_2_12", "ring"]

@flamingo flamingo Bot Sep 14, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🦩 🔴 async-nats/Cargo.toml enables both ring and aws-lc-rs unconditionally by default

In async-nats/Cargo.toml, removed ring from the default feature list (line default = ["server_2_10", "server_2_11", "server_2_12", "ring"] changed to default = ["server_2_10", "server_2_11", "server_2_12"]) so that no crypto backend (ring or aws-lc-rs) is unconditionally compiled in via defaults, matching the --at-least-one-of aws-lc-rs,ring cargo-hack policy described in the finding. Risk: this is a behavior-affecting change — consumers relying on default-features = true to get TLS/crypto working via ring will now need to explicitly enable ring or aws-lc-rs themselves, and the crate's own code paths that assume a backend is present (e.g. TLS connector construction) may fail to compile or behave incorrectly with default-features alone; a complete fix would also need to verify all non-dev code compiles with zero backend features enabled (likely gating TLS code behind cfg(any(feature = "ring", feature = "aws-lc-rs")) or similar), which is outside what can be safely done from Cargo.toml alone in this file-scoped change. The dev-dependency async-nats line already disables default features and explicitly lists service, server_2_10, so it is unaffected; the [dev-dependencies] ring = "0.17" line is untouched since it's a separate direct test dependency, not the feature default.

🤖 Prompt for AI agents 
In async-nats/Cargo.toml around line 63, review and complete this code-review fix: async-nats/Cargo.toml enables both ring and aws-lc-rs unconditionally by default.
What the draft fix changed: In `async-nats/Cargo.toml`, removed `ring` from the `default` feature list (line `default = ["server_2_10", "server_2_11", "server_2_12", "ring"]` changed to `default = ["server_2_10", "server_2_11", "server_2_12"]`) so that no crypto backend (`ring` or `aws-lc-rs`) is unconditionally compiled in via defaults, matching the `--at-least-one-of aws-lc-rs,ring` cargo-hack policy described in the finding. Risk: this is a behavior-affecting change — consumers relying on `default-features = true` to get TLS/crypto working via `ring` will now need to explicitly enable `ring` or `aws-lc-rs` themselves, and the crate's own code paths that assume a backend is present (e.g. TLS connector construction) may fail to compile or behave incorrectly with default-features alone; a complete fix would also need to verify all non-dev code compiles with zero backend features enabled (likely gating TLS code behind `cfg(any(feature = "ring", feature = "aws-lc-rs"))` or similar), which is outside what can be safely done from Cargo.toml alone in this file-scoped change. The dev-dependency `async-nats` line already disables default features and explicitly lists `service, server_2_10`, so it is unaffected; the `[dev-dependencies] ring = "0.17"` line is untouched since it's a separate direct test dependency, not the feature default.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer

default = ["server_2_10", "server_2_11", "server_2_12"]
# Enables Service API for the client.
service = []
websockets = ["dep:tokio-websockets"]
Expand Down Expand Up @@ -91,3 +91,4 @@ lto = true
# We can't use `all-features` because the `fips` doesn't compile in restricted docs.rs environment.
features = ["server_2_10", "service", "experimental", "ring", "aws-lc-rs"]
rustdoc-args = ["--cfg", "docsrs"]

Loading