From 3f6cd90d6a0fe523349e52e6df0554f67167130f Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Fri, 8 Nov 2024 12:03:11 -0800
Subject: [PATCH] Update Rust crate tough to 0.19.0 (#6974)

---
 Cargo.lock                                    | 438 ++++++++----------
 Cargo.toml                                    |   5 +-
 dev-tools/releng/src/tuf.rs                   |   2 +-
 tufaceous-lib/Cargo.toml                      |   5 +-
 tufaceous-lib/src/key.rs                      |  72 +--
 tufaceous-lib/src/repository.rs               |   2 +-
 tufaceous-lib/src/root.rs                     |   5 +-
 tufaceous/src/dispatch.rs                     |  15 +-
 .../tests/integration-tests/command_tests.rs  |   4 +-
 workspace-hack/Cargo.toml                     |  16 +-
 10 files changed, 231 insertions(+), 333 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5334ef2bac..de46e4f49f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -570,6 +570,34 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd82dba44d209fddb11c190e0a94b78651f95299598e472215667417a03ff1d"
+dependencies = [
+ "aws-lc-sys",
+ "mirai-annotations",
+ "paste",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df7a4168111d7eb622a31b214057b8509c0a7e1794f44c546d742330dc793972"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "libc",
+ "paste",
+]
+
 [[package]]
 name = "backoff"
 version = "0.4.0"
@@ -898,7 +926,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -1326,7 +1354,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1341,7 +1369,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1394,6 +1422,15 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cmake"
+version = "0.1.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1e43aa7fd152b1f968787f7dbcdeb306d1867ff373c69955211876c053f91a"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "cobs"
 version = "0.2.3"
@@ -1421,7 +1458,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1752,7 +1789,7 @@ dependencies = [
  "crucible-workspace-hack",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -1811,7 +1848,7 @@ dependencies = [
  "crucible-workspace-hack",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -2031,7 +2068,7 @@ dependencies = [
  "oxnet",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "slog",
@@ -2369,7 +2406,7 @@ dependencies = [
  "hickory-proto",
  "hickory-resolver",
  "hickory-server",
- "http 1.1.0",
+ "http",
  "internal-dns-types",
  "omicron-common",
  "omicron-test-utils",
@@ -2411,11 +2448,11 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "expectorate",
- "http 1.1.0",
+ "http",
  "internal-dns-types",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -2454,7 +2491,7 @@ dependencies = [
  "anyhow",
  "chrono",
  "futures",
- "http 1.1.0",
+ "http",
  "omicron-workspace-hack",
  "omicron-zone-package",
  "progenitor",
@@ -2462,7 +2499,7 @@ dependencies = [
  "quote",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "rustfmt-wrapper",
  "schemars",
  "serde",
@@ -2489,9 +2526,9 @@ dependencies = [
  "form_urlencoded",
  "futures",
  "hostname 0.4.0",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "indexmap 2.6.0",
  "multer",
@@ -2560,6 +2597,12 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.17"
@@ -2684,7 +2727,7 @@ dependencies = [
  "dhcproto",
  "futures",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "humantime",
  "internet-checksum",
  "ispf",
@@ -2694,7 +2737,7 @@ dependencies = [
  "omicron-workspace-hack",
  "oxide-client",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "russh",
  "russh-keys",
  "serde",
@@ -3056,6 +3099,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -3204,7 +3253,7 @@ dependencies = [
  "gateway-messages",
  "omicron-common",
  "omicron-workspace-hack",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "slog",
@@ -3226,7 +3275,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -3463,25 +3512,6 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92620684d99f750bae383ecb3be3748142d6095760afd5cbcf2261e9a279d780"
 
-[[package]]
-name = "h2"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap 2.6.0",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.6"
@@ -3493,7 +3523,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.1.0",
+ "http",
  "indexmap 2.6.0",
  "slab",
  "tokio",
@@ -3583,7 +3613,7 @@ dependencies = [
  "base64 0.21.7",
  "bytes",
  "headers-core",
- "http 1.1.0",
+ "http",
  "httpdate",
  "mime",
  "sha1",
@@ -3595,7 +3625,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -3817,17 +3847,6 @@ dependencies = [
  "windows",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.1.0"
@@ -3839,17 +3858,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -3857,7 +3865,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -3868,8 +3876,8 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -3908,9 +3916,9 @@ dependencies = [
  "futures-timer",
  "futures-util",
  "headers",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "lazy_static",
  "log",
@@ -3938,9 +3946,9 @@ dependencies = [
  "crossbeam-channel",
  "form_urlencoded",
  "futures",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "log",
  "once_cell",
@@ -3998,30 +4006,6 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
-[[package]]
-name = "hyper"
-version = "0.14.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a152ddd61dfaec7273fe8419ab357f33aee0d914c5f4efbf0d96fa749eea5ec9"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "hyper"
 version = "1.4.1"
@@ -4031,9 +4015,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
@@ -4050,8 +4034,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-util",
  "log",
  "rustls 0.22.4",
@@ -4069,8 +4053,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-util",
  "rustls 0.23.14",
  "rustls-pki-types",
@@ -4087,10 +4071,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc4bce64c32578957926e75f832032f81ebb30bcee74f86c5848b13a69e547eb"
 dependencies = [
  "futures-util",
- "http 1.1.0",
+ "http",
  "http-range",
  "httpdate",
- "hyper 1.4.1",
+ "hyper",
  "mime_guess",
  "percent-encoding",
  "rand",
@@ -4107,7 +4091,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -4124,9 +4108,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
- "hyper 1.4.1",
+ "http",
+ "http-body",
+ "hyper",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -4233,7 +4217,7 @@ dependencies = [
  "crucible-smf",
  "dropshot",
  "futures",
- "http 1.1.0",
+ "http",
  "ipnetwork",
  "libc",
  "macaddr",
@@ -4361,7 +4345,7 @@ dependencies = [
  "futures",
  "hex",
  "hex-literal",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "installinator-client",
  "installinator-common",
@@ -4374,7 +4358,7 @@ dependencies = [
  "omicron-workspace-hack",
  "partial-io",
  "proptest",
- "reqwest 0.12.8",
+ "reqwest",
  "sha2",
  "sled-hardware",
  "sled-hardware-types",
@@ -4399,7 +4383,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "dropshot",
- "hyper 1.4.1",
+ "hyper",
  "installinator-common",
  "omicron-common",
  "omicron-workspace-hack",
@@ -4418,7 +4402,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -4492,7 +4476,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "qorb",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "sled",
@@ -4790,7 +4774,7 @@ dependencies = [
  "propolis-server-config",
  "rand",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ron 0.7.1",
  "serde",
  "slog",
@@ -5188,7 +5172,7 @@ dependencies = [
  "chrono",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -5255,6 +5239,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "mirai-annotations"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
+
 [[package]]
 name = "mockall"
 version = "0.13.0"
@@ -5290,7 +5280,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http 1.1.0",
+ "http",
  "httparse",
  "memchr",
  "mime",
@@ -5387,8 +5377,8 @@ dependencies = [
  "dropshot",
  "futures",
  "headers",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "newtype_derive",
  "nexus-db-fixed-data",
  "nexus-db-model",
@@ -5427,7 +5417,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -5618,8 +5608,8 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "dropshot",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "ipnetwork",
  "nexus-types",
  "omicron-common",
@@ -5666,7 +5656,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "serde_json",
  "sled-agent-client",
  "slog",
@@ -5724,7 +5714,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "oxnet",
- "reqwest 0.12.8",
+ "reqwest",
  "sled-agent-client",
  "slog",
  "uuid",
@@ -5768,7 +5758,7 @@ dependencies = [
  "omicron-workspace-hack",
  "oxnet",
  "pq-sys",
- "reqwest 0.12.8",
+ "reqwest",
  "sled-agent-client",
  "slog",
  "slog-error-chain",
@@ -5909,9 +5899,9 @@ dependencies = [
  "gateway-test-utils",
  "headers",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "illumos-utils",
  "internal-dns-resolver",
  "internal-dns-types",
@@ -5967,7 +5957,7 @@ dependencies = [
  "dropshot",
  "futures",
  "gateway-client",
- "http 1.1.0",
+ "http",
  "humantime",
  "internal-dns-types",
  "ipnetwork",
@@ -6307,7 +6297,7 @@ dependencies = [
  "clickward",
  "dropshot",
  "expectorate",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "nexus-test-utils",
  "omicron-common",
@@ -6346,7 +6336,7 @@ dependencies = [
  "csv",
  "dropshot",
  "expectorate",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "nexus-test-utils",
  "omicron-common",
@@ -6390,7 +6380,7 @@ dependencies = [
  "expectorate",
  "futures",
  "hex",
- "http 1.1.0",
+ "http",
  "ipnetwork",
  "libc",
  "macaddr",
@@ -6404,7 +6394,7 @@ dependencies = [
  "proptest",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "semver 1.0.23",
  "serde",
@@ -6431,7 +6421,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "progenitor-client",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "sled-hardware-types",
  "slog",
@@ -6495,8 +6485,8 @@ dependencies = [
  "gateway-test-utils",
  "gateway-types",
  "hex",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "illumos-utils",
  "ipcc",
  "omicron-common",
@@ -6549,7 +6539,7 @@ dependencies = [
  "omicron-test-utils",
  "omicron-workspace-hack",
  "pq-sys",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "slog",
  "slog-error-chain",
@@ -6615,11 +6605,11 @@ dependencies = [
  "headers",
  "hex",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
  "httptest",
  "hubtools",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.26.0",
  "illumos-utils",
  "internal-dns-resolver",
@@ -6682,7 +6672,7 @@ dependencies = [
  "rcgen",
  "ref-cast",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "rustls 0.22.4",
  "rustls-pemfile 2.2.0",
@@ -6740,7 +6730,7 @@ dependencies = [
  "gateway-client",
  "gateway-messages",
  "gateway-test-utils",
- "http 1.1.0",
+ "http",
  "humantime",
  "indicatif",
  "internal-dns-resolver",
@@ -6803,7 +6793,7 @@ dependencies = [
  "omicron-zone-package",
  "petgraph",
  "rayon",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "semver 1.0.23",
  "serde",
@@ -6855,7 +6845,7 @@ dependencies = [
  "omicron-workspace-hack",
  "omicron-zone-package",
  "once_cell",
- "reqwest 0.12.8",
+ "reqwest",
  "semver 1.0.23",
  "serde",
  "sha2",
@@ -6910,8 +6900,8 @@ dependencies = [
  "guppy",
  "hex",
  "hex-literal",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-staticfile",
  "illumos-utils",
  "installinator-common",
@@ -6946,7 +6936,7 @@ dependencies = [
  "rcgen",
  "repo-depot-api",
  "repo-depot-client",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "semver 1.0.23",
  "serde",
@@ -7001,7 +6991,7 @@ dependencies = [
  "gethostname",
  "headers",
  "hex",
- "http 1.1.0",
+ "http",
  "libc",
  "libfalcon",
  "nexus-config",
@@ -7010,7 +7000,7 @@ dependencies = [
  "pem",
  "rcgen",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "rustls 0.22.4",
  "serde",
@@ -7042,6 +7032,7 @@ dependencies = [
  "ahash",
  "aho-corasick",
  "anyhow",
+ "aws-lc-rs",
  "base16ct",
  "base64 0.22.1",
  "base64ct",
@@ -7089,7 +7080,7 @@ dependencies = [
  "hex",
  "hickory-proto",
  "hmac",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.27.3",
  "hyper-util",
  "indexmap 2.6.0",
@@ -7127,11 +7118,11 @@ dependencies = [
  "regex",
  "regex-automata",
  "regex-syntax 0.8.5",
- "reqwest 0.12.8",
- "ring 0.17.8",
+ "reqwest",
  "rsa",
  "rustix",
  "rustls 0.23.14",
+ "rustls-webpki 0.102.8",
  "schemars",
  "scopeguard",
  "semver 1.0.23",
@@ -7188,7 +7179,7 @@ dependencies = [
  "futures",
  "futures-util",
  "hex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.16.20",
  "semver 1.0.23",
  "serde",
@@ -7413,13 +7404,13 @@ dependencies = [
  "chrono",
  "futures",
  "hickory-resolver",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "omicron-workspace-hack",
  "progenitor",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "thiserror",
@@ -7483,7 +7474,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "slog",
  "uuid",
@@ -7517,7 +7508,7 @@ dependencies = [
  "oximeter-db",
  "qorb",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -7576,7 +7567,7 @@ dependencies = [
  "quote",
  "reedline",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "rustyline",
  "schemars",
  "serde",
@@ -7605,8 +7596,8 @@ dependencies = [
  "chrono",
  "dropshot",
  "futures",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "kstat-rs",
  "libc",
  "omicron-workspace-hack",
@@ -8580,7 +8571,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "percent-encoding",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -8593,7 +8584,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d85934a440963a69f9f04f48507ff6e7aa2952a5b2d8f96cc37fa3dd5c270f66"
 dependencies = [
  "heck 0.5.0",
- "http 1.1.0",
+ "http",
  "indexmap 2.6.0",
  "openapiv3",
  "proc-macro2",
@@ -8636,7 +8627,7 @@ dependencies = [
  "futures",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -8657,7 +8648,7 @@ dependencies = [
  "futures",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -8679,11 +8670,11 @@ dependencies = [
  "clap",
  "dropshot",
  "futures",
- "hyper 1.4.1",
+ "hyper",
  "progenitor",
  "propolis_types",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -9195,50 +9186,12 @@ version = "0.1.0"
 dependencies = [
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
 ]
 
-[[package]]
-name = "reqwest"
-version = "0.11.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
-dependencies = [
- "base64 0.21.7",
- "bytes",
- "encoding_rs",
- "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.30",
- "ipnet",
- "js-sys",
- "log",
- "mime",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper 0.1.2",
- "system-configuration 0.5.1",
- "tokio",
- "tokio-util",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
- "winreg",
-]
-
 [[package]]
 name = "reqwest"
 version = "0.12.8"
@@ -9253,11 +9206,11 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.27.3",
  "hyper-tls",
  "hyper-util",
@@ -9276,8 +9229,8 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
- "system-configuration 0.6.1",
+ "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls 0.26.0",
@@ -9661,6 +9614,7 @@ version = "0.23.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "415d9944693cb90382053259f89fbb077ea730ad7273047ec63b19bc9b160ba8"
 dependencies = [
+ "aws-lc-rs",
  "log",
  "once_cell",
  "ring 0.17.8",
@@ -9723,6 +9677,7 @@ version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
+ "aws-lc-rs",
  "ring 0.17.8",
  "rustls-pki-types",
  "untrusted 0.9.0",
@@ -10381,7 +10336,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -11095,12 +11050,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
 [[package]]
 name = "sync_wrapper"
 version = "1.0.1"
@@ -11110,17 +11059,6 @@ dependencies = [
  "futures-core",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "system-configuration-sys 0.5.0",
-]
-
 [[package]]
 name = "system-configuration"
 version = "0.6.1"
@@ -11129,17 +11067,7 @@ checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
 dependencies = [
  "bitflags 2.6.0",
  "core-foundation",
- "system-configuration-sys 0.6.0",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
+ "system-configuration-sys",
 ]
 
 [[package]]
@@ -11743,12 +11671,13 @@ checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
 
 [[package]]
 name = "tough"
-version = "0.17.1"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8d7a87d51ca5a113542e1b9f5ee2b14b6864bf7f34d103740086fa9c3d57d3b"
+checksum = "d4f60327896014cd6f78d6a15ef07de21d21b1046efc86e8046ecd48e688fc12"
 dependencies = [
  "async-recursion",
  "async-trait",
+ "aws-lc-rs",
  "bytes",
  "chrono",
  "dyn-clone",
@@ -11760,8 +11689,8 @@ dependencies = [
  "olpc-cjson",
  "pem",
  "percent-encoding",
- "reqwest 0.11.27",
- "ring 0.17.8",
+ "reqwest",
+ "rustls 0.23.14",
  "serde",
  "serde_json",
  "serde_plain",
@@ -11770,7 +11699,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "typed-path",
- "untrusted 0.9.0",
+ "untrusted 0.7.1",
  "url",
  "walkdir",
 ]
@@ -11889,6 +11818,8 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
+ "aws-lc-rs",
+ "base64 0.22.1",
  "buf-list",
  "bytes",
  "camino",
@@ -11906,7 +11837,6 @@ dependencies = [
  "omicron-workspace-hack",
  "parse-size",
  "rand",
- "ring 0.17.8",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -11939,7 +11869,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http",
  "httparse",
  "log",
  "rand",
@@ -11958,7 +11888,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http",
  "httparse",
  "log",
  "rand",
@@ -11976,7 +11906,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http",
  "httparse",
  "log",
  "rand",
@@ -11998,9 +11928,9 @@ dependencies = [
 
 [[package]]
 name = "typed-path"
-version = "0.7.1"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668404597c2c687647f6f8934f97c280fd500db28557f52b07c56b92d3dc500a"
+checksum = "82205ffd44a9697e34fc145491aa47310f9871540bb7909eaa9365e0a9a46607"
 
 [[package]]
 name = "typed-rng"
@@ -12629,7 +12559,7 @@ dependencies = [
  "owo-colors",
  "proptest",
  "ratatui",
- "reqwest 0.12.8",
+ "reqwest",
  "rpassword",
  "serde",
  "serde_json",
@@ -12728,10 +12658,10 @@ dependencies = [
  "gateway-test-utils",
  "hex",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
  "hubtools",
- "hyper 1.4.1",
+ "hyper",
  "illumos-utils",
  "installinator",
  "installinator-api",
@@ -12753,7 +12683,7 @@ dependencies = [
  "openapiv3",
  "oxnet",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -12809,7 +12739,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -13145,7 +13075,7 @@ dependencies = [
  "flate2",
  "futures",
  "omicron-workspace-hack",
- "reqwest 0.12.8",
+ "reqwest",
  "sha2",
  "slog",
  "slog-async",
diff --git a/Cargo.toml b/Cargo.toml
index 7327bfec53..67fe816748 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -299,6 +299,7 @@ async-bb8-diesel = "0.2"
 async-trait = "0.1.83"
 atomicwrites = "0.4.4"
 authz-macros = { path = "nexus/authz-macros" }
+aws-lc-rs = "1.10.0"
 backoff = { version = "0.4.0", features = [ "tokio" ] }
 base64 = "0.22.1"
 bcs = "0.1.6"
@@ -618,7 +619,7 @@ tokio-tungstenite = "0.23.1"
 tokio-util = { version = "0.7.12", features = ["io", "io-util"] }
 toml = "0.8.19"
 toml_edit = "0.22.22"
-tough = { version = "0.17.1", features = [ "http" ] }
+tough = { version = "0.19.0", features = [ "http" ] }
 trybuild = "1.0.100"
 tufaceous = { path = "tufaceous" }
 tufaceous-lib = { path = "tufaceous-lib" }
@@ -726,6 +727,8 @@ opt-level = 3
 opt-level = 3
 [profile.dev.package.aes-gcm]
 opt-level = 3
+[profile.dev.package.aws-lc-sys]
+opt-level = 3
 [profile.dev.package.bcrypt-pbkdf]
 opt-level = 3
 [profile.dev.package.blake2]
diff --git a/dev-tools/releng/src/tuf.rs b/dev-tools/releng/src/tuf.rs
index e2c277ea5a..011b2ddd47 100644
--- a/dev-tools/releng/src/tuf.rs
+++ b/dev-tools/releng/src/tuf.rs
@@ -126,7 +126,7 @@ pub(crate) async fn build_tuf_repo(
     let manifest = ArtifactManifest::from_deserialized(&output_dir, manifest)?;
     manifest.verify_all_present()?;
     // Assemble the repo.
-    let keys = vec![Key::generate_ed25519()];
+    let keys = vec![Key::generate_ed25519()?];
     let expiry = Utc::now().with_nanosecond(0).unwrap() + Duration::weeks(1);
     OmicronRepoAssembler::new(
         &logger,
diff --git a/tufaceous-lib/Cargo.toml b/tufaceous-lib/Cargo.toml
index 61224e6080..f5b7bab393 100644
--- a/tufaceous-lib/Cargo.toml
+++ b/tufaceous-lib/Cargo.toml
@@ -11,6 +11,8 @@ workspace = true
 [dependencies]
 anyhow = { workspace = true, features = ["backtrace"] }
 async-trait.workspace = true
+aws-lc-rs.workspace = true
+base64.workspace = true
 buf-list.workspace = true
 bytes.workspace = true
 camino.workspace = true
@@ -24,9 +26,9 @@ hex.workspace = true
 hubtools.workspace = true
 itertools.workspace = true
 omicron-common.workspace = true
+omicron-workspace-hack.workspace = true
 parse-size.workspace = true
 rand.workspace = true
-ring = { workspace = true, features = ["std"] }
 serde.workspace = true
 serde_json.workspace = true
 serde_path_to_error.workspace = true
@@ -38,7 +40,6 @@ toml.workspace = true
 tough.workspace = true
 url.workspace = true
 zip.workspace = true
-omicron-workspace-hack.workspace = true
 
 [dev-dependencies]
 omicron-test-utils.workspace = true
diff --git a/tufaceous-lib/src/key.rs b/tufaceous-lib/src/key.rs
index 96282ee377..b5aa558df6 100644
--- a/tufaceous-lib/src/key.rs
+++ b/tufaceous-lib/src/key.rs
@@ -1,8 +1,7 @@
 use anyhow::{bail, Result};
-use hex::FromHex;
-use rand::{rngs::OsRng, RngCore};
-use ring::rand::SecureRandom;
-use ring::signature::Ed25519KeyPair;
+use aws_lc_rs::rand::SystemRandom;
+use aws_lc_rs::signature::Ed25519KeyPair;
+use base64::{engine::general_purpose::URL_SAFE, Engine};
 use std::fmt::Display;
 use std::str::FromStr;
 use tough::async_trait;
@@ -15,43 +14,25 @@ pub(crate) fn boxed_keys(keys: Vec<Key>) -> Vec<Box<dyn KeySource>> {
 
 #[derive(Debug, Clone)]
 pub enum Key {
-    Ed25519(
-        // We could store this as a `ring::signature::Ed25519KeyPair`, but that
-        // doesn't impl `Clone`.
-        [u8; 32],
-    ),
+    Ed25519 { pkcs8: Vec<u8> },
 }
 
 impl Key {
-    pub fn generate_ed25519() -> Key {
-        let mut key = [0; 32];
-        OsRng.fill_bytes(&mut key);
-        Key::Ed25519(key)
+    pub fn generate_ed25519() -> Result<Key> {
+        let pkcs8 = Ed25519KeyPair::generate_pkcs8(&SystemRandom::new())?;
+        Ok(Key::Ed25519 { pkcs8: pkcs8.as_ref().to_vec() })
     }
 
-    pub(crate) fn as_sign(&self) -> SignKeyPair {
+    fn as_sign_key_pair(&self) -> Result<SignKeyPair> {
         match self {
-            Key::Ed25519(key) => SignKeyPair::ED25519(
-                Ed25519KeyPair::from_seed_unchecked(key)
-                    .expect("ed25519 key length mismatch"),
-            ),
+            Key::Ed25519 { pkcs8 } => {
+                Ok(SignKeyPair::ED25519(Ed25519KeyPair::from_pkcs8(pkcs8)?))
+            }
         }
     }
-}
 
-#[async_trait]
-impl Sign for Key {
-    fn tuf_key(&self) -> tough::schema::key::Key {
-        self.as_sign().tuf_key()
-    }
-
-    async fn sign(
-        &self,
-        msg: &[u8],
-        rng: &(dyn SecureRandom + Sync),
-    ) -> Result<Vec<u8>, Box<dyn std::error::Error + Send + Sync + 'static>>
-    {
-        self.as_sign().sign(msg, rng).await
+    pub(crate) fn as_tuf_key(&self) -> Result<tough::schema::key::Key> {
+        Ok(self.as_sign_key_pair()?.tuf_key())
     }
 }
 
@@ -61,7 +42,7 @@ impl KeySource for Key {
         &self,
     ) -> Result<Box<dyn Sign>, Box<dyn std::error::Error + Send + Sync + 'static>>
     {
-        Ok(Box::new(self.clone()))
+        Ok(Box::new(self.as_sign_key_pair()?))
     }
 
     async fn write(
@@ -78,7 +59,9 @@ impl FromStr for Key {
 
     fn from_str(s: &str) -> Result<Key> {
         match s.split_once(':') {
-            Some(("ed25519", hex)) => Ok(Key::Ed25519(FromHex::from_hex(hex)?)),
+            Some(("ed25519", base64)) => {
+                Ok(Key::Ed25519 { pkcs8: URL_SAFE.decode(base64)? })
+            }
             Some((kind, _)) => bail!("Invalid key source kind: {}", kind),
             None => bail!("Invalid key source (format is `kind:data`)"),
         }
@@ -88,25 +71,8 @@ impl FromStr for Key {
 impl Display for Key {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
-            Key::Ed25519(key) => {
-                write!(f, "ed25519:{}", hex::encode(key))
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::Key;
-    use ring::signature::Ed25519KeyPair;
-    use std::str::FromStr;
-
-    #[test]
-    fn test_from_str() {
-        let key = Key::from_str("ed25519:9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60").unwrap();
-        match key {
-            Key::Ed25519(key) => {
-                let _ = Ed25519KeyPair::from_seed_unchecked(&key).unwrap();
+            Key::Ed25519 { pkcs8 } => {
+                write!(f, "ed25519:{}", URL_SAFE.encode(pkcs8))
             }
         }
     }
diff --git a/tufaceous-lib/src/repository.rs b/tufaceous-lib/src/repository.rs
index 416d5c9990..7fef2565a8 100644
--- a/tufaceous-lib/src/repository.rs
+++ b/tufaceous-lib/src/repository.rs
@@ -373,7 +373,7 @@ mod tests {
             &logctx.log,
             tempdir.path(),
             "0.0.0".parse().unwrap(),
-            vec![Key::generate_ed25519()],
+            vec![Key::generate_ed25519().unwrap()],
             Utc::now() + Days::new(1),
         )
         .await
diff --git a/tufaceous-lib/src/root.rs b/tufaceous-lib/src/root.rs
index cf5f7129c5..f8fc2d0c06 100644
--- a/tufaceous-lib/src/root.rs
+++ b/tufaceous-lib/src/root.rs
@@ -1,12 +1,11 @@
 use crate::key::Key;
 use anyhow::Result;
+use aws_lc_rs::rand::SystemRandom;
 use chrono::{DateTime, Utc};
-use ring::rand::SystemRandom;
 use std::collections::HashMap;
 use std::num::NonZeroU64;
 use tough::editor::signed::SignedRole;
 use tough::schema::{KeyHolder, RoleKeys, RoleType, Root};
-use tough::sign::Sign;
 
 pub(crate) async fn new_root(
     keys: Vec<Key>,
@@ -22,7 +21,7 @@ pub(crate) async fn new_root(
         _extra: HashMap::new(),
     };
     for key in &keys {
-        let key = key.as_sign().tuf_key();
+        let key = key.as_tuf_key()?;
         root.keys.insert(key.key_id()?, key);
     }
     for kind in [
diff --git a/tufaceous/src/dispatch.rs b/tufaceous/src/dispatch.rs
index fc86c948df..ed0c63f787 100644
--- a/tufaceous/src/dispatch.rs
+++ b/tufaceous/src/dispatch.rs
@@ -44,7 +44,7 @@ impl Args {
 
         match self.command {
             Command::Init { system_version, no_generate_key } => {
-                let keys = maybe_generate_keys(self.keys, no_generate_key);
+                let keys = maybe_generate_keys(self.keys, no_generate_key)?;
 
                 let repo = OmicronRepo::initialize(
                     &log,
@@ -161,7 +161,7 @@ impl Args {
                     manifest.verify_all_present()?;
                 }
 
-                let keys = maybe_generate_keys(self.keys, no_generate_key);
+                let keys = maybe_generate_keys(self.keys, no_generate_key)?;
                 let mut assembler = OmicronRepoAssembler::new(
                     &log,
                     manifest,
@@ -245,12 +245,15 @@ enum Command {
     },
 }
 
-fn maybe_generate_keys(keys: Vec<Key>, no_generate_key: bool) -> Vec<Key> {
-    if !no_generate_key && keys.is_empty() {
-        let key = Key::generate_ed25519();
+fn maybe_generate_keys(
+    keys: Vec<Key>,
+    no_generate_key: bool,
+) -> Result<Vec<Key>> {
+    Ok(if !no_generate_key && keys.is_empty() {
+        let key = Key::generate_ed25519()?;
         crate::hint::generated_key(&key);
         vec![key]
     } else {
         keys
-    }
+    })
 }
diff --git a/tufaceous/tests/integration-tests/command_tests.rs b/tufaceous/tests/integration-tests/command_tests.rs
index 20c6a06d66..fcdaf949e6 100644
--- a/tufaceous/tests/integration-tests/command_tests.rs
+++ b/tufaceous/tests/integration-tests/command_tests.rs
@@ -18,7 +18,7 @@ use tufaceous_lib::{Key, OmicronRepo};
 async fn test_init_and_add() -> Result<()> {
     let logctx = test_setup_log("test_init_and_add");
     let tempdir = tempfile::tempdir().unwrap();
-    let key = Key::generate_ed25519();
+    let key = Key::generate_ed25519()?;
 
     let mut cmd = make_cmd_with_repo(tempdir.path(), &key);
     cmd.args(["init", "0.0.0"]);
@@ -114,7 +114,7 @@ async fn test_init_and_add() -> Result<()> {
 fn test_assemble_fake() -> Result<()> {
     let logctx = test_setup_log("test_assemble_fake");
     let tempdir = tempfile::tempdir().unwrap();
-    let key = Key::generate_ed25519();
+    let key = Key::generate_ed25519()?;
 
     let archive_path = tempdir.path().join("archive.zip");
 
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index c893112051..77eee17b10 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -21,6 +21,7 @@ workspace = true
 ahash = { version = "0.8.11" }
 aho-corasick = { version = "1.1.3" }
 anyhow = { version = "1.0.92", features = ["backtrace"] }
+aws-lc-rs = { version = "1.10.0", features = ["prebuilt-nasm"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
 base64ct = { version = "1.6.0", default-features = false, features = ["std"] }
@@ -98,8 +99,9 @@ regex = { version = "1.11.0" }
 regex-automata = { version = "0.4.8", default-features = false, features = ["dfa", "hybrid", "meta", "nfa", "perf", "unicode"] }
 regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.8", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
-ring = { version = "0.17.8", features = ["std"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
+rustls = { version = "0.23.14", features = ["ring"] }
+rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.21", features = ["bytes", "chrono", "uuid1"] }
 scopeguard = { version = "1.2.0" }
 semver = { version = "1.0.23", features = ["serde"] }
@@ -137,6 +139,7 @@ zip = { version = "0.6.6", default-features = false, features = ["bzip2", "defla
 ahash = { version = "0.8.11" }
 aho-corasick = { version = "1.1.3" }
 anyhow = { version = "1.0.92", features = ["backtrace"] }
+aws-lc-rs = { version = "1.10.0", features = ["prebuilt-nasm"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
 base64ct = { version = "1.6.0", default-features = false, features = ["std"] }
@@ -215,8 +218,9 @@ regex = { version = "1.11.0" }
 regex-automata = { version = "0.4.8", default-features = false, features = ["dfa", "hybrid", "meta", "nfa", "perf", "unicode"] }
 regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.8", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
-ring = { version = "0.17.8", features = ["std"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
+rustls = { version = "0.23.14", features = ["ring"] }
+rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.21", features = ["bytes", "chrono", "uuid1"] }
 scopeguard = { version = "1.2.0" }
 semver = { version = "1.0.23", features = ["serde"] }
@@ -262,7 +266,6 @@ linux-raw-sys = { version = "0.4.14", default-features = false, features = ["elf
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-unknown-linux-gnu.build-dependencies]
@@ -274,7 +277,6 @@ linux-raw-sys = { version = "0.4.14", default-features = false, features = ["elf
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-apple-darwin.dependencies]
@@ -284,7 +286,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-apple-darwin.build-dependencies]
@@ -294,7 +295,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.aarch64-apple-darwin.dependencies]
@@ -304,7 +304,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.aarch64-apple-darwin.build-dependencies]
@@ -314,7 +313,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-unknown-illumos.dependencies]
@@ -326,7 +324,6 @@ indicatif = { version = "0.17.8", features = ["rayon"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }
 
@@ -339,7 +336,6 @@ indicatif = { version = "0.17.8", features = ["rayon"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }