adapter: run the LaunchDarkly HTTPS transport on aws-lc-rs, not ring

The `launchdarkly-sdk-transport` crate's `build_https` hardcodes its
`hyper-rustls` dependency to the `ring` crypto provider, which is not
FIPS 140-3 validated. The crate exposes no aws-lc-rs feature, so we
cannot select the provider there.

Instead, build a `hyper-rustls` `HttpsConnector` on the aws-lc-rs rustls
provider ourselves and inject it via the transport crate's
`build_with_connector`. To keep the ring-pinned `hyper-rustls` out of the
build entirely, the workspace now selects only the base `hyper` feature on
both `launchdarkly-server-sdk` and `launchdarkly-sdk-transport` (dropping
`hyper-rustls-native-roots`, which was the sole activator of
`hyper-rustls/ring`), and `mz-adapter` depends on `hyper-rustls` and
`rustls` directly. `ring` is no longer reachable through the LaunchDarkly
transport path. It remains only as a direct dependency of `gcp_auth`.

native-tls was already eliminated on the LD-3.1.1 base, so this closes the
remaining crypto-provider gap for the FIPS migration.

The `MetricsTransport` wrapping and the event-processor / streaming
data-source builders are unchanged: only the underlying HTTPS transport's
crypto provider changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: jasonhernandez

Cargo.lock

@@ -389,6 +389,14 @@ hyper = { version = "1.9.0", features = ["http1", "server"] }
 # which can only be done by constructing the HTTP Client
 hyper-0-14 = { package = "hyper", version = "0.14", features = ["client", "tcp"] }
 hyper-openssl = "0.10.2"
+# `aws-lc-rs` selects the FIPS-capable crypto provider (not `ring`), `native-tokio`
+# brings the `rustls-native-certs` roots that `with_provider_and_native_roots`
+# needs, and `http1`/`http2` cover the LaunchDarkly streaming and event
+# connections. We keep `default-features = false` to leave out the `logging`
+# feature, which would pull in the (workspace-banned) `log` crate. Used by
+# `mz-adapter` to build a FIPS-capable HTTPS connector for the LaunchDarkly
+# transport.
+hyper-rustls = { version = "0.27", default-features = false, features = ["aws-lc-rs", "native-tokio", "http1", "http2", "tls12"] }
 hyper-util = "0.1.20"
 tower-service = "0.3.3"
 iceberg = "0.9.0"
@@ -407,8 +415,17 @@ junit-report = "0.8.3"
 k8s-controller = "0.11.0"
 k8s-openapi = { version = "0.27.0", features = ["schemars", "v1_32"] }
 kube = { version = "3.1.0", default-features = false, features = ["client", "derive", "openssl-tls", "runtime", "ws"] }
-launchdarkly-server-sdk = { version = "3.1.1", default-features = false, features = ["hyper-rustls-native-roots", "crypto-aws-lc-rs"] }
-launchdarkly-sdk-transport = "0.1"
+# We select only the base `hyper` feature, not `hyper-rustls-native-roots`. That
+# feature would enable `launchdarkly-sdk-transport`'s `hyper-rustls` dependency,
+# which the transport crate hardcodes to the `ring` crypto provider (not
+# FIPS-validated). We supply our own aws-lc-rs-backed HTTPS connector to the
+# transport instead. See `mz-adapter`'s `config::frontend::ld_config`.
+launchdarkly-server-sdk = { version = "3.1.1", default-features = false, features = ["hyper", "crypto-aws-lc-rs"] }
+# `default-features = false` with only `hyper` keeps the transport crate's
+# ring-pinned `hyper-rustls` dependency out of the build. The `hyper` feature
+# still exposes `HyperTransport::builder()` and `build_with_connector`, which we
+# use to inject an aws-lc-rs connector.
+launchdarkly-sdk-transport = { version = "0.1", default-features = false, features = ["hyper"] }
 lgalloc = "0.6.0"
 libc = "0.2.186"
 lru = "0.16.3"

Cargo.toml

@@ -27,6 +27,7 @@ futures.workspace = true
 governor.workspace = true
 hex.workspace = true
 humantime.workspace = true
+hyper-rustls.workspace = true
 imbl.workspace = true
 http.workspace = true
 ipnet.workspace = true
@@ -83,6 +84,7 @@ prost.workspace = true
 qcell.workspace = true
 rand.workspace = true
 rand_chacha.workspace = true
+rustls.workspace = true
 semver.workspace = true
 serde.workspace = true
 serde_json.workspace = true

src/adapter/Cargo.toml

@@ -385,10 +385,23 @@ impl<T: HttpTransport> HttpTransport for MetricsTransport<T> {
 }
 
 fn ld_config(api_key: &str, metrics: &Metrics, now_fn: &NowFn) -> ld::Config {
+    // Build the HTTPS connector on the aws-lc-rs rustls crypto provider. The
+    // `launchdarkly-sdk-transport` crate's own `build_https` hardcodes rustls to
+    // the `ring` provider, which is not FIPS-validated. We name the aws-lc-rs
+    // provider explicitly and inject the connector via `build_with_connector`.
+    // Native roots match the trust store the SDK used under the transport
+    // crate's `hyper-rustls-native-roots` feature, which we no longer enable.
+    let https = hyper_rustls::HttpsConnectorBuilder::new()
+        .with_provider_and_native_roots(rustls::crypto::aws_lc_rs::default_provider())
+        .expect("failed to load native root certificates")
+        .https_only()
+        .enable_http1()
+        .enable_http2()
+        .build();
     let transport = launchdarkly_sdk_transport::HyperTransport::builder()
         .connect_timeout(Duration::from_secs(10))
         .read_timeout(Duration::from_secs(300))
-        .build_https()
+        .build_with_connector(https)
         .expect("failed to create HTTPS transport");
 
     let cse_transport = MetricsTransport {