xai-org/grok-build · error

aws-lc-rs supports the default protocol versions

Error message

aws-lc-rs supports the default protocol versions

What it means

client_config_with_shared_roots builds a rustls ClientConfig with the aws-lc-rs default provider and .expect()s that with_safe_default_protocol_versions() succeeds. It panics only if the installed crypto provider does not support the safe default protocol versions (TLS 1.2/1.3), which the crate assumes is impossible with aws-lc-rs.

Source

Thrown at crates/codegen/xai-grok-extra-ca/src/lib.rs:144

                probe.add(der.clone()).is_ok()
            })
            .collect()
    })
}

/// A rustls config over the process-wide roots: OS store, Mozilla bundle, extra.
fn client_config_with_shared_roots() -> rustls::ClientConfig {
    ensure_default_crypto_provider();
    let mut roots = RootCertStore::empty();
    roots.add_parsable_certificates(cached_native_der().iter().cloned());
    roots.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
    roots.add_parsable_certificates(extra_root_ders().iter().cloned().map(CertificateDer::from));
    #[expect(clippy::expect_used)]
    rustls::ClientConfig::builder_with_provider(
        rustls::crypto::aws_lc_rs::default_provider().into(),
    )
    .with_safe_default_protocol_versions()
    .expect("aws-lc-rs supports the default protocol versions")
    .with_root_certificates(roots)
    .with_no_client_auth()
}

/// Shared rustls config for TLS outside reqwest (WebSocket, HTTP/1.1 upgrade),
/// pinned to this crate's provider.
pub fn rustls_client_config() -> Arc<rustls::ClientConfig> {
    static CONFIG: OnceLock<Arc<rustls::ClientConfig>> = OnceLock::new();
    CONFIG
        .get_or_init(|| {
            let mut config = client_config_with_shared_roots();
            config.alpn_protocols = vec![b"http/1.1".to_vec()];
            Arc::new(config)
        })
        .clone()
}

/// The configured extra roots as validated DER, loaded once per process.

View on GitHub (pinned to bc7f02eddd)

Solutions

1. Align rustls and rustls-pki-types/aws-lc-rs versions across the workspace (cargo update -p, check Cargo.lock duplicates)
2. Ensure the aws_lc_rs feature set includes the default protocol versions (don't strip tls12/tls13 features)
3. Explicitly select a protocol version set you know the provider supports via .with_protocol_versions(&[...]) instead of the safe default
4. Verify with a minimal repro that rustls::crypto::aws_lc_rs::default_provider() resolves to the expected provider

Example fix

// before
.with_safe_default_protocol_versions()
.expect("aws-lc-rs supports the default protocol versions")
// after
.with_protocol_versions(&[&rustls::version::TLS13])
.expect("provider supports TLS 1.3")

// pre-flight: confirm the provider resolves and offers expected versions
let provider = rustls::crypto::aws_lc_rs::default_provider();
assert!(!provider.cipher_suites.is_empty(), "aws-lc-rs provider unavailable");

null

let cfg = std::panic::catch_unwind(rustls_client_config)
    .map_err(|_| anyhow!("rustls provider lacks default protocol versions; check rustls/aws-lc-rs versions"))?;

When it happens

Trigger: Calling rustls_client_config (-> client_config_with_shared_roots) when the aws_lc_rs default provider cannot offer the safe default protocol versions - typically a rustls/crypto-provider version mismatch or a custom/feature-restricted provider build.

Common situations: Workspace with mixed rustls versions where the provider was built without TLS1.2/1.3 support; a vendored or patched rustls; feature flags (e.g. no tls12) removing expected versions; crypto provider globally installed and incompatible.

Related errors

• default reqwest client builds
• failed to build shared HTTP client
• failed to build shared upload HTTP client
• hook HTTP client config is valid
• Custom sandbox profile '{name}' not found. Define it in ~/.g

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/134e6e27d139c1a3. Report an issue: GitHub.