fix(rust): use ERE-compatible regex in start_release.sh version check (#2351)

* fix(rust): use ERE-compatible regex in start_release.sh version check

The version check used the PCRE escape \d in an egrep pattern:

  REGEX_VERSION='^\d+\.\d+\.\d+$'
  MATCHES=$(echo "$1" | egrep $REGEX_VERSION | wc -l)

egrep uses POSIX Extended Regular Expressions, which do not support \d.
The pattern therefore matched nothing, every input was treated as
invalid, and the script always exited with:

  Version "X.Y.Z" must be N.N.N

This caused the 'Run start_release.sh and open a release PR' job to fail
with exit code 1 even though VERSION=1.3.0 had already passed the
workflow's own pre-check (which uses bash regex ^[0-9]+\.[0-9]+\.[0-9]+$).

Replace \d with [0-9] so the regex actually matches N.N.N, and quote the
variable expansion in egrep for safety.

* fix(rust): align aws-lc-sys with aws-lc-rs to remove duplicate native crate

CI's 'no duplicate aws-lc native crate' check failed on the default
build with:

    aws-lc-sys v0.41.0
    └── aws-db-esdk (direct dependency)

    aws-lc-sys v0.42.0
    └── aws-lc-rs v1.17.1
        └── aws-db-esdk (transitive via aws-lc-rs/aws-sdk-*)

Our Cargo.toml pinned the direct optional dep at aws-lc-sys = "0.41",
while aws-lc-rs 1.17.1 (which we depend on, and which the AWS SDK
crates pull in transitively) resolves aws-lc-sys 0.42. Cargo cannot
unify across a semver-major boundary, so two copies of aws-lc-sys
compile in the same build.

Beyond the ~2x native C build cost, this is also a correctness/safety
concern: the SDK's raw FFI path (aws_lc_sys_impl::*) binds to the
version WE declare, while aws-lc-rs binds to the version it pulls in,
so the raw path can drift onto a stale/vulnerable AWS-LC independently
of aws-lc-rs.

Bump the direct dep to aws-lc-sys = "0.42" so it unifies with the
version aws-lc-rs resolves to. aws-lc-fips-sys is unchanged; the fips
build was not flagged by the duplicate check.

* chore: enable local testing

Author: josecorella

DynamoDbEncryption/runtimes/rust/Cargo.toml

@@ -17,7 +17,7 @@ readme = "README.md"
 [dependencies]
 aws-config = "1.8.12"
 aws-lc-rs = {version = "1.17.0"}
-aws-lc-sys = { version = "0.41", optional = true }
+aws-lc-sys = { version = "0.42", optional = true }
 aws-lc-fips-sys = { version = "0.13.1", optional = true }
 aws-sdk-dynamodb = "1.103.0"
 aws-sdk-kms = "1.98.0"

DynamoDbEncryption/runtimes/rust/start_release.sh

@@ -9,9 +9,11 @@ fi
 # Go to the directory of this script
 cd $( dirname ${BASH_SOURCE[0]} )
 
-# Check if the provided argument matches the version pattern
-REGEX_VERSION='^\d+\.\d+\.\d+$'
-MATCHES=$(echo "$1" | egrep $REGEX_VERSION | wc -l)
+# Check if the provided argument matches the version pattern.
+# Note: egrep uses POSIX ERE, which does not support PCRE escapes like \d.
+# Use [0-9] instead so the regex actually matches N.N.N versions.
+REGEX_VERSION='^[0-9]+\.[0-9]+\.[0-9]+$'
+MATCHES=$(echo "$1" | egrep "$REGEX_VERSION" | wc -l)
 if [ $MATCHES -eq 0 ]; then
    echo 1>&2 "Version \"$1\" must be N.N.N"
    exit 1

project.properties

@@ -1,5 +1,5 @@
-projectJavaVersion=4.1.0
-mplDependencyJavaVersion=1.11.1
+projectJavaVersion=4.1.0-SNAPSHOT
+mplDependencyJavaVersion=1.11.1-SNAPSHOT
 mplDependencyNetVersion=2.0.0-SNAPSHOT
 dafnyVersion=4.9.0
 dafnyVerifyVersion=4.9.1