Bump ring library version to 0.17.14

Following items included:
* ring library bumping up from 0.17.6 to 0.17.14
* dropping patch for NFC: Address Clippy unused import warning introduced
with confidential-containers/td-shim#760
* dropping SSE and SSE2 checks

Signed-off-by: Zbigniew Lukwinski <zbigniew.lukwinski@intel.com>

Author: zlukwins

Cargo.lock

@@ -1,54 +1,52 @@
+From 022337ecdb430a2e536db8dbd3199b9d3e3cf58e Mon Sep 17 00:00:00 2001
+From: Zbigniew Lukwinski <zbigniew.lukwinski@intel.com>
+Date: Thu, 13 Mar 2025 15:18:16 +0100
+Subject: [PATCH] Support x86_64_unknown target
+
+Signed-off-by: Zbigniew Lukwinski <zbigniew.lukwinski@intel.com>
+---
+ Cargo.toml |  2 +-
+ build.rs   | 18 +++++++++++++++++-
+ 2 files changed, 18 insertions(+), 2 deletions(-)
+
 diff --git a/Cargo.toml b/Cargo.toml
-index 2c8ba6964..209c3d4a1 100644
+index 8f8da17da..a45ec829d 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -171,7 +171,7 @@ all-features = true
- name = "ring"
+@@ -159,7 +159,7 @@ name = "ring"
 
  [dependencies]
+ cfg-if = { version = "1.0.0", default-features = false }
 -getrandom = { version = "0.2.10" }
 +getrandom = { version = "0.2.10", features = ["rdrand"] }
  untrusted = { version = "0.9" }
 
- [target.'cfg(any(target_arch = "x86",target_arch = "x86_64", all(any(target_arch = "aarch64", target_arch = "arm"), any(target_os = "android", target_os = "fuchsia", target_os = "linux", target_os = "windows"))))'.dependencies]
+ [target.'cfg(all(any(all(target_arch = "aarch64", target_endian = "little"), all(target_arch = "arm", target_endian = "little")), any(target_os = "android", target_os = "linux")))'.dependencies]
 diff --git a/build.rs b/build.rs
-index f7b94108b..3bdc8cd29 100644
+index 9843ad8aa..494d8cfc7 100644
 --- a/build.rs
 +++ b/build.rs
-@@ -121,7 +121,9 @@ fn cpp_flags(compiler: &cc::Tool) -> &'static [&'static str] {
-             "-Wenum-compare",
-             "-Wfloat-equal",
-             "-Wformat=2",
--            "-Winline",
-+            // Clear the `-Winline` because warnings will be treated as errors
-+            // when `ring` is used as git submodules.
-+            // "-Winline",
-             "-Winvalid-pch",
-             "-Wmissing-field-initializers",
-             "-Wmissing-include-dirs",
-@@ -260,6 +262,8 @@ const LINUX_ABI: &[&str] = &[
+@@ -254,6 +254,8 @@ const LINUX_ABI: &[&str] = &[
      "linux",
      "redox",
      "solaris",
 +    // For `x86_64-unknown-none` target
 +    "none",
  ];
 
- /// Operating systems that have the same ABI as macOS on every architecture
-@@ -604,16 +608,29 @@ fn configure_cc(c: &mut cc::Build, target: &Target, include_dir: &Path) {
-     // poly1305_vec.c requires <emmintrin.h> which requires <stdlib.h>.
-     if (target.arch == "wasm32")
-         || (target.os == "linux" && target.is_musl && target.arch != "x86_64")
+ const WIN32N: &str = "win32n";
+@@ -594,14 +596,28 @@ fn configure_cc(c: &mut cc::Build, target: &Target, c_root_dir: &Path, include_d
+     // Allow cross-compiling without a target sysroot for these targets.
+     if (target.arch == WASM32)
+         || (target.os == "linux" && target.env == "musl" && target.arch != X86_64)
 +        || (target.os == "none")
      {
-         if let Ok(compiler) = c.try_get_compiler() {
-             // TODO: Expand this to non-clang compilers in 0.17.0 if practical.
-             if compiler.is_like_clang() {
-                 let _ = c.flag("-nostdlibinc");
-+                // Required on windows for cross compilation to `x86_64-unknown-none`
-+                let _ = c.flag("-ffreestanding");
-                 let _ = c.define("RING_CORE_NOSTDLIBINC", "1");
-             }
+         // TODO: Expand this to non-clang compilers in 0.17.0 if practical.
+         if compiler.is_like_clang() {
+             let _ = c.flag("-nostdlibinc");
++            // Required on windows for cross compilation to `x86_64-unknown-none`
++            let _ = c.flag("-ffreestanding");
+             let _ = c.define("RING_CORE_NOSTDLIBINC", "1");
          }
      }
 
@@ -58,19 +56,22 @@ index f7b94108b..3bdc8cd29 100644
 +        if let Ok(compiler) = c.try_get_compiler() {
 +            if compiler.is_like_clang() {
 +                let _ = c.define("__ELF__", None);
++                let _ = c.flag("-fPIC");
 +            }
 +        }
 +    }
 +
      if target.force_warnings_into_errors {
          c.warnings_into_errors(true);
      }
-@@ -645,7 +662,7 @@ fn nasm(file: &Path, arch: &str, include_dir: &Path, out_file: &Path) -> Command
-         std::path::MAIN_SEPARATOR,
-     )));
+@@ -619,7 +635,7 @@ fn nasm(file: &Path, arch: &str, include_dir: &Path, out_dir: &Path, c_root_dir:
+     let mut include_dir = include_dir.as_os_str().to_os_string();
+     include_dir.push(OsString::from(String::from(std::path::MAIN_SEPARATOR)));
 
 -    let mut c = Command::new("./target/tools/windows/nasm/nasm");
 +    let mut c = Command::new("nasm");
      let _ = c
          .arg("-o")
          .arg(out_file.to_str().expect("Invalid path"))
+-- 
+2.34.1

external/patches/ring/0001-NFC-Address-Clippy-unused-import-warning.patch

@@ -0,0 +1,54 @@
+From e6dd2c965fb14b3ca3c20005f16d727ee12b589f Mon Sep 17 00:00:00 2001
+From: Zbigniew Lukwinski <zbigniew.lukwinski@intel.com>
+Date: Fri, 14 Mar 2025 11:07:55 +0100
+Subject: [PATCH] Disable checks for SSE and SSE2
+
+Signed-off-by: Zbigniew Lukwinski <zbigniew.lukwinski@intel.com>
+---
+ src/cpu/intel.rs | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/src/cpu/intel.rs b/src/cpu/intel.rs
+index f45052fe7..9c3ac044e 100644
+--- a/src/cpu/intel.rs
++++ b/src/cpu/intel.rs
+@@ -22,8 +22,8 @@ mod abi_assumptions {
+     // https://github.com/briansmith/ring/issues/1793#issuecomment-1793243725,
+     // https://github.com/briansmith/ring/issues/1832,
+     // https://github.com/briansmith/ring/issues/1833.
+-    const _ASSUMES_SSE2: () =
+-        assert!(cfg!(target_feature = "sse") && cfg!(target_feature = "sse2"));
++    // const _ASSUMES_SSE2: () =
++    //     assert!(cfg!(target_feature = "sse") && cfg!(target_feature = "sse2"));
+ 
+     #[cfg(target_arch = "x86_64")]
+     const _ASSUMED_POINTER_SIZE: usize = 8;
+@@ -156,8 +156,8 @@ fn cpuid_to_caps_and_set_c_flags(cpuid: &[u32; 4]) -> u32 {
+     // CMOV, it is likely that some of our timing side channel prevention does
+     // not work. Presumably the people who delete these are verifying that it
+     // all works fine.
+-    const _SSE_REQUIRED: () = assert!(cfg!(target_feature = "sse"));
+-    const _SSE2_REQUIRED: () = assert!(cfg!(target_feature = "sse2"));
++    // const _SSE_REQUIRED: () = assert!(cfg!(target_feature = "sse"));
++    // const _SSE2_REQUIRED: () = assert!(cfg!(target_feature = "sse2"));
+ 
+     #[cfg(all(target_arch = "x86", not(target_feature = "sse2")))]
+     {
+@@ -184,10 +184,10 @@ fn cpuid_to_caps_and_set_c_flags(cpuid: &[u32; 4]) -> u32 {
+     // assertions in an attempt to support pre-SSE2 32-bit x86 systems. If they
+     // do, hopefully they won't delete these redundant assertions, so that
+     // x86_64 isn't affected.
+-    #[cfg(target_arch = "x86_64")]
+-    const _SSE2_REQUIRED_X86_64: () = assert!(cfg!(target_feature = "sse2"));
+-    #[cfg(target_arch = "x86_64")]
+-    const _SSE_REQUIRED_X86_64: () = assert!(cfg!(target_feature = "sse2"));
++    // #[cfg(target_arch = "x86_64")]
++    // const _SSE2_REQUIRED_X86_64: () = assert!(cfg!(target_feature = "sse2"));
++    // #[cfg(target_arch = "x86_64")]
++    // const _SSE_REQUIRED_X86_64: () = assert!(cfg!(target_feature = "sse2"));
+ 
+     // Intel: "12.7.2 Checking for SSSE3 Support"
+     // If/when we support dynamic detection of SSE/SSE2, make this conditional
+-- 
+2.34.1
+

external/patches/ring/0001-Support-x86_64-unknown-none-target.patch

@@ -11,7 +11,7 @@ afl = { version = "=0.15.12", optional = true }
 spdmlib = { path = "../../spdmlib", default-features = false, features=["spdm-ring"] }
 simple_logger = "4.2.0"
 log = "0.4.13"
-ring = { version = "0.17.6" }
+ring = { version = "0.17.14" }
 flexi_logger = "0.27.2"
 spdmlib-test = { path = "../../test/spdmlib-test" }
 futures = { version = "0.3", default-features = false }

external/patches/ring/0002-Disable-checks-for-SSE-and-SSE2.patch

@@ -18,17 +18,17 @@ process_args() {
 patch-ring() {
     # apply the patch set for ring
     pushd external/ring
-    git reset --hard 464d367252354418a2c17feb806876d4d89a8508
+    git reset --hard 2723abbca9e83347d82b056d5b239c6604f786df
     git clean -xdf
     case "$TARGET_OPTION" in
         "x86_64-unknown-none")
             git apply ../patches/ring/0001-Support-x86_64-unknown-none-target.patch
+            git apply ../patches/ring/0002-Disable-checks-for-SSE-and-SSE2.patch
         ;;
         *)
             echo "Unsupported target for ring, builds may not work!"
         ;;
     esac
-    git apply ../patches/ring/0001-NFC-Address-Clippy-unused-import-warning.patch
     popd
 }
 

external/ring

@@ -17,7 +17,7 @@ log = "0.4.13"
 bytes = { version="1", default-features=false }
 conquer-once = { version = "0.3.2", default-features = false }
 lazy_static = { version = "1.0", features = ["spin_no_std"], optional = true }
-ring = { version = "0.17.6", default-features = false, features = ["alloc", "less-safe-getrandom-custom-or-rdrand"], optional = true }
+ring = { version = "0.17.14", default-features = false, features = ["alloc", "less-safe-getrandom-custom-or-rdrand"], optional = true }
 webpki = { version = "0.22.4", default-features = false, features = ["alloc"], optional = true}
 untrusted = { version = "0.9.0", optional = true }
 zeroize = { version = "1.5.0", features = ["zeroize_derive"]}

fuzz-target/fuzzlib/Cargo.toml

@@ -8,7 +8,7 @@ edition = "2018"
 
 [dependencies]
 log = "0.4.13"
-ring = { version = "0.17.6" }
+ring = { version = "0.17.14" }
 webpki = { version = "0.22.4", default-features = false, features = ["alloc"]}
 untrusted = { version = "0.9.0" }
 codec = { path = "../../codec" }

sh_script/pre-build.sh

@@ -9,7 +9,7 @@ edition = "2021"
 spdmlib = { path = "../../spdmlib", default-features = false, features=["spdm-ring"] }
 codec = { path = "../../codec", features = ["alloc"] }
 log = "0.4.13"
-ring = { version = "0.17.6" }
+ring = { version = "0.17.14" }
 bytes = { version="1", default-features=false }
 futures = { version = "0.3", default-features = false }
 async-trait = "0.1.71"