From 29206ac84ee808d20d38dcf2aa620faee6d1dbeb Mon Sep 17 00:00:00 2001 From: Jose Corella Date: Tue, 30 Jun 2026 14:43:28 -0700 Subject: [PATCH 1/3] fix(rust): use ERE-compatible regex in start_release.sh version check The version check used the PCRE escape \d in an egrep pattern: REGEX_VERSION='^\d+\.\d+\.\d+$' MATCHES=$(echo "$1" | egrep $REGEX_VERSION | wc -l) egrep uses POSIX Extended Regular Expressions, which do not support \d. The pattern therefore matched nothing, every input was treated as invalid, and the script always exited with: Version "X.Y.Z" must be N.N.N This caused the 'Run start_release.sh and open a release PR' job to fail with exit code 1 even though VERSION=1.3.0 had already passed the workflow's own pre-check (which uses bash regex ^[0-9]+\.[0-9]+\.[0-9]+$). Replace \d with [0-9] so the regex actually matches N.N.N, and quote the variable expansion in egrep for safety. --- DynamoDbEncryption/runtimes/rust/start_release.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/DynamoDbEncryption/runtimes/rust/start_release.sh b/DynamoDbEncryption/runtimes/rust/start_release.sh index e41d2f364f..b67b6f9146 100755 --- a/DynamoDbEncryption/runtimes/rust/start_release.sh +++ b/DynamoDbEncryption/runtimes/rust/start_release.sh @@ -9,9 +9,11 @@ fi # Go to the directory of this script cd $( dirname ${BASH_SOURCE[0]} ) -# Check if the provided argument matches the version pattern -REGEX_VERSION='^\d+\.\d+\.\d+$' -MATCHES=$(echo "$1" | egrep $REGEX_VERSION | wc -l) +# Check if the provided argument matches the version pattern. +# Note: egrep uses POSIX ERE, which does not support PCRE escapes like \d. +# Use [0-9] instead so the regex actually matches N.N.N versions. +REGEX_VERSION='^[0-9]+\.[0-9]+\.[0-9]+$' +MATCHES=$(echo "$1" | egrep "$REGEX_VERSION" | wc -l) if [ $MATCHES -eq 0 ]; then echo 1>&2 "Version \"$1\" must be N.N.N" exit 1 From aea7607d383c73eb10d4f38e15035ccdaba57f64 Mon Sep 17 00:00:00 2001 From: Jose Corella Date: Tue, 30 Jun 2026 14:50:14 -0700 Subject: [PATCH 2/3] fix(rust): align aws-lc-sys with aws-lc-rs to remove duplicate native crate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI's 'no duplicate aws-lc native crate' check failed on the default build with: aws-lc-sys v0.41.0 └── aws-db-esdk (direct dependency) aws-lc-sys v0.42.0 └── aws-lc-rs v1.17.1 └── aws-db-esdk (transitive via aws-lc-rs/aws-sdk-*) Our Cargo.toml pinned the direct optional dep at aws-lc-sys = "0.41", while aws-lc-rs 1.17.1 (which we depend on, and which the AWS SDK crates pull in transitively) resolves aws-lc-sys 0.42. Cargo cannot unify across a semver-major boundary, so two copies of aws-lc-sys compile in the same build. Beyond the ~2x native C build cost, this is also a correctness/safety concern: the SDK's raw FFI path (aws_lc_sys_impl::*) binds to the version WE declare, while aws-lc-rs binds to the version it pulls in, so the raw path can drift onto a stale/vulnerable AWS-LC independently of aws-lc-rs. Bump the direct dep to aws-lc-sys = "0.42" so it unifies with the version aws-lc-rs resolves to. aws-lc-fips-sys is unchanged; the fips build was not flagged by the duplicate check. --- DynamoDbEncryption/runtimes/rust/Cargo.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/DynamoDbEncryption/runtimes/rust/Cargo.toml b/DynamoDbEncryption/runtimes/rust/Cargo.toml index 23782f1c60..21e2acc338 100644 --- a/DynamoDbEncryption/runtimes/rust/Cargo.toml +++ b/DynamoDbEncryption/runtimes/rust/Cargo.toml @@ -17,7 +17,7 @@ readme = "README.md" [dependencies] aws-config = "1.8.12" aws-lc-rs = {version = "1.17.0"} -aws-lc-sys = { version = "0.41", optional = true } +aws-lc-sys = { version = "0.42", optional = true } aws-lc-fips-sys = { version = "0.13.1", optional = true } aws-sdk-dynamodb = "1.103.0" aws-sdk-kms = "1.98.0" From 653e0fabf9449b5d38f024362a45155bc1484456 Mon Sep 17 00:00:00 2001 From: Jose Corella Date: Tue, 30 Jun 2026 15:09:53 -0700 Subject: [PATCH 3/3] chore: enable local testing --- project.properties | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/project.properties b/project.properties index 892de3fdd4..0882831f70 100644 --- a/project.properties +++ b/project.properties @@ -1,5 +1,5 @@ -projectJavaVersion=4.1.0 -mplDependencyJavaVersion=1.11.1 +projectJavaVersion=4.1.0-SNAPSHOT +mplDependencyJavaVersion=1.11.1-SNAPSHOT mplDependencyNetVersion=2.0.0-SNAPSHOT dafnyVersion=4.9.0 dafnyVerifyVersion=4.9.1