Skip to content

Conversation

@dertin
Copy link

@dertin dertin commented Jan 10, 2026

Does your PR solve an issue?

fixes #4082

Is this a breaking change?

Potentially. Public APIs are unchanged and defaults remain the same, but --all-features no longer works for sqlx-mysql because mutually exclusive RSA backend features were added. Build/CI scripts that relied on --all-features must select a backend explicitly.

Summary

Add aws-lc-rs RSA auth backend for MySQL/MariaDB with a FIPS option, plus a rustls FIPS TLS feature.
Refactor MySQL RSA auth backends to prefer aws-lc-rs when selected, and expose new facade features.
Update docs, changelog, and CI/test tooling to cover the new feature matrix and FIPS prerequisites.

Testing

- cargo check -p sqlx-mysql --no-default-features --features rsa-aws-lc-rs
- cargo check -p sqlx-mysql --no-default-features --features rsa-aws-lc-rs-fips
- cargo test -p sqlx-mysql --no-default-features --features rsa-aws-lc-rs --lib
- cargo test -p sqlx-mysql --no-default-features --features rsa-aws-lc-rs --doc --features sqlx/mysql-auth-rsa-aws-lc-rs
- cargo check -p sqlx --no-default-features --features mysql-auth-rsa-aws-lc-rs,runtime-tokio,tls-native-tls
- cargo check -p sqlx --no-default-features --features mysql-auth-rsa-aws-lc-rs-fips,runtime-tokio,tls-rustls-aws-lc-rs-fips
- cargo test -p sqlx-core --no-default-features --features _tls-rustls-aws-lc-rs
- cargo test -p sqlx-core --no-default-features --features _tls-rustls-aws-lc-rs-fips
- cargo test -p sqlx-core --no-default-features --features _tls-rustls-ring-webpki
- python tests/x.py --fips

@dertin dertin marked this pull request as draft January 10, 2026 09:17
@dertin dertin marked this pull request as ready for review January 10, 2026 09:32
@dertin dertin changed the title feat(mysql): add aws-lc-rs FIPS RSA auth and rustls features feat(mysql): add aws-lc-rs backend for RSA auth and FIPS TLS support Jan 10, 2026
@dertin
Copy link
Author

dertin commented Jan 10, 2026

Hi @abonander

This PR adds two MySQL RSA auth backend features:

  • mysql-auth-rsa-aws-lc-rs (non‑FIPS, replaces rsa for caching_sha2_password/sha256_password when TLS is off)
  • mysql-auth-rsa-aws-lc-rs-fips (FIPS module, requires Go/CMake on supported targets)

On the TLS side, this PR adds tls-rustls-aws-lc-rs-fips to expose the FIPS rustls provider.
The FIPS and non‑FIPS (tls-rustls-aws-lc-rs) variants are mutually exclusive.

If you'd prefer a different feature layout or naming, I'm happy to adjust.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support aws-lc-rs instead of rsa

1 participant