Improve MSRV CI

.github/workflows/analysis.yml

@@ -194,27 +194,7 @@ jobs:
         working-directory: ./aws-lc-rs
         run: cargo --locked check
 
-  msrv:
-    name: Minimum Supported Rust Version
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          submodules: 'recursive'
-          lfs: true
 
-      - uses: dtolnay/rust-toolchain@stable
-        id: toolchain
-
-      - name: Set Rust toolchain override
-        run: rustup override set ${{ steps.toolchain.outputs.name }}
-
-      - name: Install cargo-msrv
-        run: cargo install cargo-msrv
-
-      - name: Verify msrv
-        working-directory: ./aws-lc-rs
-        run: cargo msrv verify
 
   copyright:
     runs-on: ubuntu-latest

.github/workflows/integration.yml

@@ -125,3 +125,40 @@ jobs:
       - name: ${{ matrix.crate }}
         working-directory: ./${{ matrix.crate }}
         run: cargo ${{ matrix.args }}
+
+  msrv:
+    name: Minimum Supported Rust Version
+    if: github.repository == 'aws/aws-lc-rs'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, macos-12, macos-13-xlarge, windows-latest ]
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: 'recursive'
+          lfs: true
+
+      - name: Install NASM on Windows
+        if: runner.os == 'Windows'
+        uses: ilammy/setup-nasm@v1
+
+      - name: Setup Go >=v1.18
+        uses: actions/setup-go@v4
+        with:
+          go-version: '>=1.18'
+
+      - name: Install ninja-build tool
+        if: runner.os == 'Windows'
+        uses: seanmiddleditch/gha-setup-ninja@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+        id: toolchain
+
+      - name: Install cargo-msrv
+        run: cargo install cargo-msrv
+
+      - name: Verify msrv
+        working-directory: ./aws-lc-rs
+        run: cargo msrv --log-level debug --log-target stdout verify -- cargo check --features bindgen

aws-lc-fips-sys/Cargo.toml

@@ -64,10 +64,24 @@ dunce = "1.0"
 fs_extra = "1.3"
 
 [target.'cfg(any(all(target_os = "linux", target_arch = "x86_64", target_env="gnu"), all(target_os = "linux", target_arch = "aarch64", target_env="gnu")))'.build-dependencies]
-bindgen = { version = "0.69.1", optional = true }
+bindgen = { version = "0.69.2", optional = true }
 
 [target.'cfg(not(any(all(target_os = "linux", target_arch = "x86_64", target_env="gnu"), all(target_os = "linux", target_arch = "aarch64", target_env="gnu"))))'.build-dependencies]
-bindgen = { version = "0.69.1" }
+bindgen = { version = "0.69.2" }
+
+[dev-dependencies]
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.61.0
+memchr = "=2.6.2"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.63.0
+which = "=4.4.0"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.70.0
+home = "=0.5.5"
+# Pinned dependency to preserve MSRV: 1.60.0  <= rust-version < 1.65.0
+regex = "~1.9.6"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.65.0
+regex-automata = "~0.3.9"
+# Pinned dependency to preserve MSRV: 1.60.0  <= rust-version < 1.65.0
+regex-syntax = "~0.7.5"
 
 [dependencies]
 libc = "0.2"

aws-lc-rs/Cargo.toml

@@ -3,7 +3,7 @@ name = "aws-lc-rs"
 authors = ["AWS-LibCrypto"]
 version = "1.6.1"
 edition = "2021"
-rust-version = "1.60"
+rust-version = "1.60.0"
 keywords = ["crypto", "cryptography", "security"]
 license = "ISC AND (Apache-2.0 OR ISC)"
 description = "aws-lc-rs is a cryptographic library using AWS-LC for its cryptographic operations. This library strives to be API-compatible with the popular Rust library named ring."
@@ -51,7 +51,11 @@ mirai-annotations = "1.12.0"
 paste = "1.0"
 
 [dev-dependencies]
-regex = "1.6.0"
 lazy_static = "1.4.0"
 clap = { version = "4.1.8", features = ["derive"] }
 hex = "0.4.3"
+
+# Pinned dependencies to preserve Rust 1.61 as MSRV
+regex = "~1.9.6"
+regex-automata = "~0.3.9"
+regex-syntax = "~0.7.5"

aws-lc-rs/src/ed25519.rs

@@ -149,7 +149,7 @@ impl KeyPair for Ed25519KeyPair {
     }
 }
 
-pub(crate) unsafe fn generate_key() -> Result<LcPtr<EVP_PKEY>, ()> {
+pub(crate) fn generate_key() -> Result<LcPtr<EVP_PKEY>, ()> {
     let pkey_ctx = LcPtr::new(unsafe { EVP_PKEY_CTX_new_id(EVP_PKEY_ED25519, null_mut()) })?;
 
     if 1 != unsafe { EVP_PKEY_keygen_init(*pkey_ctx) } {
@@ -191,7 +191,7 @@ impl Ed25519KeyPair {
     /// # Errors
     /// `error::Unspecified` if `rng` cannot provide enough bits or if there's an internal error.
     pub fn generate_pkcs8(_rng: &dyn SecureRandom) -> Result<Document, Unspecified> {
-        let evp_pkey = unsafe { generate_key()? };
+        let evp_pkey = generate_key()?;
         evp_pkey.marshall_private_key(Version::V2)
     }
 
@@ -228,7 +228,7 @@ impl Ed25519KeyPair {
     /// # Errors
     /// `error::Unspecified` if `rng` cannot provide enough bits or if there's an internal error.
     pub fn generate_pkcs8v1(_rng: &dyn SecureRandom) -> Result<Document, Unspecified> {
-        let evp_pkey = unsafe { generate_key()? };
+        let evp_pkey = generate_key()?;
         evp_pkey.marshall_private_key(Version::V1)
     }
 

aws-lc-sys/Cargo.toml

@@ -55,11 +55,24 @@ dunce = "1.0"
 fs_extra = "1.3"
 
 [target.'cfg(any(all(target_os = "macos", target_arch = "x86_64"), all(target_os = "linux", target_arch = "x86", target_env="gnu"), all(target_os = "linux", target_arch = "x86_64", target_env="gnu"), all(target_os = "linux", target_arch = "aarch64", target_env="gnu")))'.build-dependencies]
-bindgen = { version = "0.69.1", optional = true }
+bindgen = { version = "0.69.2", optional = true }
 
 [target.'cfg(not(any(all(target_os = "macos", target_arch = "x86_64"), all(target_os = "linux", target_arch = "x86", target_env="gnu"), all(target_os = "linux", target_arch = "x86_64", target_env="gnu"), all(target_os = "linux", target_arch = "aarch64", target_env="gnu"))))'.build-dependencies]
 bindgen = { version = "0.69.2" }
 
+[dev-dependencies]
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.61.0
+memchr = "=2.6.2"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.63.0
+which = "=4.4.0"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.70.0
+home = "=0.5.5"
+# Pinned dependency to preserve MSRV: 1.60.0  <= rust-version < 1.65.0
+regex = "~1.9.6"
+# Pinned dependency to preserve MSRV: ??? <= rust-version < 1.65.0
+regex-automata = "~0.3.9"
+# Pinned dependency to preserve MSRV: 1.60.0  <= rust-version < 1.65.0
+regex-syntax = "~0.7.5"
 
 [dependencies]
 libc = "0.2"