ore,server-core,pgwire,balancerd,environmentd: migrate TLS from openssl to rustls#35866

Closed

jasonhernandez wants to merge 42 commits intomainfrom

jason/sec-218-core-tls-rustls-v2

Commits on Apr 2, 2026

lint: add optional openssl usage linter

jasonhernandez
and
claude
committed
doc: add openssl-to-rustls migration plan and linter output

jasonhernandez
and
claude
committed
doc: update migration plan for FIPS 140-3 compliance mode

jasonhernandez
and
claude
committed
deny: ban non-FIPS crypto crates to prevent compliance gaps

jasonhernandez
and
claude
committed
lint: add container FIPS compliance auditor

jasonhernandez
and
claude
committed
doc: add comprehensive FIPS 140-3 compliance report

jasonhernandez
and
claude
committed
lint: fix copyright header and python formatting

jasonhernandez
and
claude
committed
crypto: unblock rustls and add FIPS feature flag via mz-ore

jasonhernandez
and
claude
committed
chore: regenerate Cargo.lock after rebase

jasonhernandez
and
claude
committed
deny: add duplicate skip entries for Cargo.lock version bumps

jasonhernandez
and
claude
committed
ci: install Go in CI builder for aws-lc-fips-sys

jasonhernandez
and
claude
committed
chore: pin uuid to 1.19.0 to match main

jasonhernandez
and
claude
committed
fix: pin os_info, chrono-tz, serde_path_to_error to avoid CI regressions

jasonhernandez
and
claude
committed
crypto: swap openssl TLS features to rustls in 3 crates

jasonhernandez
and
claude
committed
deny: add wrappers and skips for rustls ecosystem deps

jasonhernandez
and
claude
committed
environmentd: explicitly enable hyper-openssl client-legacy feature

jasonhernandez
and
claude
committed
deny: add CDLA-Permissive-2.0 to about.toml for webpki-roots

jasonhernandez
and
claude
committed
crypto: swap reqwest/hyper-tls to rustls in 3 crates

jasonhernandez
and
claude
committed
doc: update aws-util docs to reflect rustls policy change

jasonhernandez
and
claude
committed
environmentd: explicitly enable hyper-openssl client-legacy feature

jasonhernandez
and
claude
committed
fix: enable default-https-client for aws-config and pin os_info

jasonhernandez
and
claude
committed
adapter: WIP compile-time gating of LD and segment behind telemetry feature

jasonhernandez
and
claude
committed
adapter,environmentd,balancerd,ore: compile-time gate telemetry SDKs for FIPS

jasonhernandez
and
claude
committed
doc: document telemetry SDK compile-time exclusion for FIPS

jasonhernandez
and
claude
committed
auth: migrate mz-auth SCRAM-SHA256 crypto from openssl to aws-lc-rs

jasonhernandez
and
claude
committed
Console OIDC generate token (#35609)

leedqin
authored and
jasonhernandez
committed
Add username to postgresql instructions (#35841)

SangJunBak
authored and
jasonhernandez
committed
crypto: migrate sha2/hmac/subtle usage to aws-lc-rs across 11 crates

jasonhernandez
and
claude
committed

Commits on Apr 3, 2026