aws-lc-rs dependency in release candidates

[daddycocoaman]

Hi,

I know that 0.9.0 is not officially released but I've been looking at it to mostly to avoid getting unnecessary info! logs in my program (thanks for addressing that).

However, I noticed that 0.9.0 includes the new default rustls features that now include aws-lc-rs, which creates additional build dependencies in cross-platform environments (https://aws.github.io/aws-lc-rs/requirements/windows.html).

├── rustls v0.23.29
│   │   ├── aws-lc-rs v1.13.2
│   │   │   ├── aws-lc-sys v0.30.0
│   │   │   │   [build-dependencies]
│   │   │   │   ├── cc v1.2.29
│   │   │   │   │   ├── jobserver v0.1.33
│   │   │   │   │   │   └── libc v0.2.174
│   │   │   │   │   ├── libc v0.2.174
│   │   │   │   │   └── shlex v1.3.0
│   │   │   │   ├── cmake v0.1.54
│   │   │   │   │   └── cc v1.2.29 (*)
│   │   │   │   ├── dunce v1.0.5
│   │   │   │   └── fs_extra v1.3.0
│   │   │   └── zeroize v1.8.1
│   │   ├── log v0.4.27
│   │   ├── once_cell v1.21.3
│   │   ├── ring v0.17.14
│   │   │   ├── cfg-if v1.0.1
│   │   │   ├── getrandom v0.2.16 (*)
│   │   │   └── untrusted v0.9.0
│   │   │   [build-dependencies]
│   │   │   └── cc v1.2.29 (*)
│   │   ├── rustls-pki-types v1.12.0
│   │   │   └── zeroize v1.8.1
│   │   ├── rustls-webpki v0.103.4
│   │   │   ├── aws-lc-rs v1.13.2 (*)
│   │   │   ├── ring v0.17.14 (*)
│   │   │   ├── rustls-pki-types v1.12.0 (*)
│   │   │   └── untrusted v0.9.0
│   │   ├── subtle v2.6.1
│   │   └── zeroize v1.8.1

From what I can tell, neo4rs is intending to stick with rustls for the native approach, so it might be useful to set default-features = false for rustls and use only the necessary features.

[knutwalker]

Hey, thanks for raising this. The aws-lc-rs dependency was added in #201 as a dev-dependency, but if that causes build issues on windows systems, I agree that it should be avoided. Would you mind opening a PR for the change?
Also pinging @madchicken as the author of #201, do you happen to remember why the dependency was added?

[madchicken]

@knutwalker It was probably due to my tests on fips compliance. It can probably be removed.

[madchicken]

Sorry to be late on this, I just opened a PR to fix the wrongly added dependency aws-lc-rs

[daddycocoaman]

Just to be clear, I don't think the dev dependency is the root cause here. Rustls itself defaults to aws-lc-rs and would need to have default features set to false to avoid bringing it in. (rustls/rustls#1913)

However, I would imagine the Neo4j libraries also need to have FIPS compliance options for some users, so you might consider having a neo4rs feature to use aws-lc-rs, but it probably shouldn't be the default.

But that is purely up to your choice for organizing the crate.

[knutwalker]

Thanks @madchicken for taking care of this! @daddycocoaman does this work for you now? Can you work on the branch or do you need a new release?

[daddycocoaman]

@knutwalker Just checked it out on Windows and it appears to build the repo without an issue.

[knutwalker]

Thanks for checking!