fix(crypto): gate libdd-common TLS features in obfuscation and capabilities-impl#1872
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intomainfrom Apr 13, 2026
Conversation
duncanista
force-pushed
the
jordan.gonzalez/crypto/fix-fips-feature-gates
branch
from
2a2cc7c to
2743c76
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1872 +/- ##
==========================================
- Coverage 71.79% 71.78% -0.02%
==========================================
Files 429 429
Lines 68082 68082
==========================================
- Hits 48877 48870 -7
- Misses 19205 19212 +7
🚀 New features to boost your workflow:
|
|
✅ Tests 🎉 All green!❄️ No new flaky tests detected 🎯 Code Coverage (details) 🔗 Commit SHA: 0e0729d | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback! |
duncanista
force-pushed
the
jordan.gonzalez/crypto/fix-fips-feature-gates
branch
from
2743c76 to
2bcf465
Compare
Contributor
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
gyuheon0h
approved these changes
Apr 13, 2026
…lities-impl libdd-trace-obfuscation and libdd-capabilities-impl depended on libdd-common with default features enabled, which unconditionally pulled in the https feature (and therefore ring). This breaks FIPS builds in downstream consumers because ring is forbidden. Add default-features = false on the libdd-common dependency and expose https/fips feature flags so downstream consumers can propagate the correct crypto provider choice, matching the pattern already used by libdd-trace-utils.
duncanista
force-pushed
the
jordan.gonzalez/crypto/fix-fips-feature-gates
branch
from
2bcf465 to
0e0729d
Compare
lym953
approved these changes
Apr 13, 2026
gh-worker-dd-mergequeue-cf854d
Bot
deleted the
jordan.gonzalez/crypto/fix-fips-feature-gates
branch
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: done
and removed
mergequeue-status: in_progress
labels
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Follows up on #1816 by gating
libdd-common's TLS features behindhttps/fipsfeature flags in the three internal crates that were still pulling inlibdd-commonwith default features. Without this, downstream consumers that build with--no-default-features --features fipsstill getringin the dependency tree via transitive default feature activation, breaking FIPS compliance checks.Changes:
libdd-trace-obfuscation/Cargo.toml: Addeddefault-features = falseon bothlibdd-commonandlibdd-trace-utils. Added[features]section withdefault = ["https"],https(forwarding tolibdd-common/httpsandlibdd-trace-utils/https), andfips(forwarding tolibdd-common/fipsandlibdd-trace-utils/fips).libdd-capabilities-impl/Cargo.toml: Addeddefault-features = falseonlibdd-common. Added[features]section withdefault = ["https"],https(forwarding tolibdd-common/https), andfips(forwarding tolibdd-common/fips).libdd-trace-utils/Cargo.toml: Addeddefault-features = falseonlibdd-capabilities-implin[target.'cfg(not(target_arch = "wasm32"))'.dependencies]. Updatedhttpsandfipsfeatures to also forward tolibdd-capabilities-impl/httpsandlibdd-capabilities-impl/fipsrespectively.Motivation
PR #1816 moved
ringbehindlibdd-common'shttpsfeature and introduced a separatefipsfeature that usesaws-lc-rswithout pulling inring. However, three internal crates (libdd-trace-obfuscation,libdd-capabilities-impl, andlibdd-trace-utilsvialibdd-capabilities-impl) still depended onlibdd-commonwith default features enabled. Since Cargo features are additive, this causedlibdd-common/default→https→rustls/ringto be activated regardless of what the downstream consumer configured.In
datadog-lambda-extension, the FIPS build (cargo clippy --no-default-features --features fips) was failing because the build.rs FIPS compliance check detectedringin the dependency tree through these transitive paths:This PR applies the same pattern already used by
libdd-trace-utilsfor itslibdd-commondependency (default-features = false+ explicithttps/fipsforwarding) to all internal crates in the dependency chain.Additional Notes
libdd-trace-utilsalready haddefault-features = falseonlibdd-commonand properhttps/fipsfeature gates. The only change tolibdd-trace-utilsis adding the same treatment for itslibdd-capabilities-impldependency.default = ["https"]feature on each crate preserves the existing behavior whereringis used as the crypto backend.default-features = falseon these crates and activate thefipsfeature explicitly. For example, indatadog-lambda-extension:How to test the change?
Verify default build compiles (ring path unchanged):
Verify ring is absent from a FIPS feature build of affected crates:
Verify aws-lc-rs is present in FIPS builds:
Verify ring is still present in default builds: