feat: add an aws-lc-rs patch shim

Cargo.toml

@@ -1,7 +1,7 @@
 # Each member takes a crates.io crate's name, so a binary's [patch.crates-io]
 # finds it here by that name.
 [workspace]
-members = ["ring"]
+members = ["ring", "aws-lc-rs"]
 resolver = "3"
 
 [workspace.package]

README.md

@@ -29,6 +29,33 @@ lists what it leaves out and what behaves differently from ring.
 rind's own CI builds and runs a fixture through this patch, with rind-ring
 from rind's checkout, so a rind-ring change is tested here before its release.
 
+## aws-lc-rs
+
+[`aws-lc-rs/`](aws-lc-rs) re-exports
+[rind-aws-lc-rs](https://crates.io/crates/rind-aws-lc-rs) under aws-lc-rs's
+name. A binary patches it in its workspace's root `Cargo.toml`, then runs
+`cargo update -p aws-lc-rs`:
+
+```toml
+[patch.crates-io]
+aws-lc-rs = { git = "https://github.com/moq-dev/rind-patch" }
+```
+
+The shim's version, 1.999.0, satisfies compatible aws-lc-rs 1.x requirements.
+Check that `cargo tree -i aws-lc-rs` prints only `aws-lc-rs v1.999.0` from
+this repository and `cargo tree -i aws-lc-sys` finds no package. An exact or
+bounded requirement can keep crates.io's aws-lc-rs, as can an old lockfile.
+The `aws-lc-sys` feature is accepted but links no C library; `fips` is
+refused. The adapter's own `wipe` feature is forwarded too.
+
+Call `aws_lc_rs::cpu::check()` at startup to refuse an unsupported CPU.
+[rind-aws-lc-rs's README](https://github.com/moq-dev/rind/blob/main/rind-aws-lc-rs/README.md)
+lists its API gaps. s2n-quic-crypto and jsonwebtoken's `aws_lc_rs` feature
+build on the shim. rustls's `aws_lc_rs`, rustls-webpki's `aws-lc-rs`, and
+rcgen's `aws_lc_rs` features do not: they name ML-DSA, and rustls also names
+ML-KEM-1024, which rind lacks. Use their ring features with the ring patch,
+or rind's dedicated adapters.
+
 ## License
 
 Apache-2.0 OR ISC OR MIT-0, at your option, as rind is:

aws-lc-rs/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "aws-lc-rs"
+# Above crates.io's 1.x releases, so compatible requirements select the patch.
+version = "1.999.0"
+edition.workspace = true
+publish.workspace = true
+repository.workspace = true
+license.workspace = true
+description = "rind-aws-lc-rs under aws-lc-rs's name, for a binary's [patch.crates-io]"
+
+# Forward aws-lc-rs's features, except fips: rind is not FIPS validated.
+[features]
+default = ["aws-lc-sys", "alloc", "ring-io", "ring-sig-verify"]
+alloc = ["rind-aws-lc-rs/alloc"]
+asan = ["rind-aws-lc-rs/asan"]
+aws-lc-sys = ["rind-aws-lc-rs/aws-lc-sys"]
+bindgen = ["rind-aws-lc-rs/bindgen"]
+dev-tests-only = ["rind-aws-lc-rs/dev-tests-only"]
+legacy-des = ["rind-aws-lc-rs/legacy-des"]
+non-fips = ["rind-aws-lc-rs/non-fips"]
+prebuilt-nasm = ["rind-aws-lc-rs/prebuilt-nasm"]
+ring-io = ["rind-aws-lc-rs/ring-io"]
+ring-sig-verify = ["rind-aws-lc-rs/ring-sig-verify"]
+test_logging = ["rind-aws-lc-rs/test_logging"]
+unstable = ["rind-aws-lc-rs/unstable"]
+wipe = ["rind-aws-lc-rs/wipe"]
+
+[dependencies]
+rind-aws-lc-rs = { version = "1", default-features = false }

aws-lc-rs/src/lib.rs

@@ -0,0 +1,5 @@
+//! [rind-aws-lc-rs](https://docs.rs/rind-aws-lc-rs) under aws-lc-rs's name,
+//! so one `[patch.crates-io]` line moves a binary's aws-lc-rs 1.x tree to rind.
+//! rind-aws-lc-rs's README lists the items it leaves out.
+
+pub use rind_aws_lc_rs::*;