{"record":{"id":"134e6e27d139c1a3","repo":"xai-org/grok-build","slug":"aws-lc-rs-supports-the-default-protocol-versions","errorCode":null,"errorMessage":"aws-lc-rs supports the default protocol versions","messagePattern":"aws-lc-rs supports the default protocol versions","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-extra-ca/src/lib.rs","lineNumber":144,"sourceCode":"                probe.add(der.clone()).is_ok()\n            })\n            .collect()\n    })\n}\n\n/// A rustls config over the process-wide roots: OS store, Mozilla bundle, extra.\nfn client_config_with_shared_roots() -> rustls::ClientConfig {\n    ensure_default_crypto_provider();\n    let mut roots = RootCertStore::empty();\n    roots.add_parsable_certificates(cached_native_der().iter().cloned());\n    roots.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());\n    roots.add_parsable_certificates(extra_root_ders().iter().cloned().map(CertificateDer::from));\n    #[expect(clippy::expect_used)]\n    rustls::ClientConfig::builder_with_provider(\n        rustls::crypto::aws_lc_rs::default_provider().into(),\n    )\n    .with_safe_default_protocol_versions()\n    .expect(\"aws-lc-rs supports the default protocol versions\")\n    .with_root_certificates(roots)\n    .with_no_client_auth()\n}\n\n/// Shared rustls config for TLS outside reqwest (WebSocket, HTTP/1.1 upgrade),\n/// pinned to this crate's provider.\npub fn rustls_client_config() -> Arc<rustls::ClientConfig> {\n    static CONFIG: OnceLock<Arc<rustls::ClientConfig>> = OnceLock::new();\n    CONFIG\n        .get_or_init(|| {\n            let mut config = client_config_with_shared_roots();\n            config.alpn_protocols = vec![b\"http/1.1\".to_vec()];\n            Arc::new(config)\n        })\n        .clone()\n}\n\n/// The configured extra roots as validated DER, loaded once per process.","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-extra-ca/src/lib.rs#L126-L162","documentation":"client_config_with_shared_roots builds a rustls ClientConfig with the aws-lc-rs default provider and .expect()s that with_safe_default_protocol_versions() succeeds. It panics only if the installed crypto provider does not support the safe default protocol versions (TLS 1.2/1.3), which the crate assumes is impossible with aws-lc-rs.","triggerScenarios":"Calling rustls_client_config (-> client_config_with_shared_roots) when the aws_lc_rs default provider cannot offer the safe default protocol versions - typically a rustls/crypto-provider version mismatch or a custom/feature-restricted provider build.","commonSituations":"Workspace with mixed rustls versions where the provider was built without TLS1.2/1.3 support; a vendored or patched rustls; feature flags (e.g. no tls12) removing expected versions; crypto provider globally installed and incompatible.","solutions":["Align rustls and rustls-pki-types/aws-lc-rs versions across the workspace (cargo update -p, check Cargo.lock duplicates)","Ensure the aws_lc_rs feature set includes the default protocol versions (don't strip tls12/tls13 features)","Explicitly select a protocol version set you know the provider supports via .with_protocol_versions(&[...]) instead of the safe default","Verify with a minimal repro that rustls::crypto::aws_lc_rs::default_provider() resolves to the expected provider"],"exampleFix":"// before\n.with_safe_default_protocol_versions()\n.expect(\"aws-lc-rs supports the default protocol versions\")\n// after\n.with_protocol_versions(&[&rustls::version::TLS13])\n.expect(\"provider supports TLS 1.3\")","handlingStrategy":"try-catch","validationCode":"// pre-flight: confirm the provider resolves and offers expected versions\nlet provider = rustls::crypto::aws_lc_rs::default_provider();\nassert!(!provider.cipher_suites.is_empty(), \"aws-lc-rs provider unavailable\");","typeGuard":"null","tryCatchPattern":"let cfg = std::panic::catch_unwind(rustls_client_config)\n    .map_err(|_| anyhow!(\"rustls provider lacks default protocol versions; check rustls/aws-lc-rs versions\"))?;","preventionTips":["Pin compatible rustls + aws-lc-rs versions; avoid duplicate rustls versions in Cargo.lock","Do not strip tls12/tls13 features from the provider build","Call build early at startup so misconfiguration fails immediately"],"tags":["tls","rustls","panics","configuration","rust"],"backgroundTag":"rustls-protocol-versions-unsupported","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}