Release 0.17.12

[briansmith]

There are 3 notable changes planned for this release:

• PR Increase MSRV to 1.66.0 to avoid bugs in earlier versions. #2437: Increase MSRV to 1.66. This will let us use use CPUID from Rust.
• PR aes_gcm/x86_64: Enable AVX2 VAES-CLMUL implementation. #2436: Enable AVX2 Vectorized AES-GCM. This will be a notable performance improvement for most newish systems. This will likely raise the minimum binutils version supported for very old Linux distros.
• PR cpu::intel: Do CPU feature detection in Rust. #2439: Do CPUID-based feature detection in Rust. This is a step in the "oxidation" process of ring.

Please take a look at these changes, especially PR #2439.

[djc]

IIRC previously you held back the MSRV mainly for rustls. Rustls currently has 1.71 as its MSRV. Are there concrete reasons to stick with 1.66 now?

[briansmith]

Even the change to MSRV 1.66 I am not so sure about. I have also been considering just vendoring the __cpuid() implementation from std_detect and leaving the MSRV at 1.63. But I suspect future changes will cause us to inch the MSRV upward. I think when we talk to potential sponsors it will become clearer what to do.

[briansmith]

OK, change of plans. 0.17.2 was just released which does not contain any of the aforementioned changes, but instead contains the panic fix at #2447. The PR for the release was #2448.

In order to avoid disrupting the main branch by backing out already-committed changes, I did the 0.17.2 release on branch release-branch/0.17.12.

Because of the time I spent on that issue, I will prepare release 0.17.3 without PR #2439, on the main branch. See #2449.

Obviously, it is very weird timing to suddenly have a real bug report amid all the uncertainty regarding the project. Regardless, I am glad people are reporting bugs they find.

[briansmith]

I filed an advisory for the bug: rustsec/advisory-db#2240. I also have done additional testing; see #2455.