From 6628e5f761fd2c4a563f3a890dd145a39a27ce18 Mon Sep 17 00:00:00 2001
From: Matt Topol <zotthewizard@gmail.com>
Date: Tue, 22 Sep 2026 11:39:32 -0400
Subject: [PATCH] NO-SNOW: FIPS F7: take ring out of the shipped dependency
 graph

Reshaped against main. The #1345 import already set `default-features = false`
on the AWS SDK crates, which removed the legacy ring-backed TLS stack (an older
rustls 0.21 on hyper 0.14) -- the bulk of what this change originally did. What
remains is two feature choices, both of which re-link `ring`.

`sigv4a` goes. It pulls `aws-runtime/sigv4a` -> `aws-sigv4/sigv4a` ->
`dep:ring`, and it only signs S3 multi-region access point ARNs. Snowflake
stages are ordinary region-scoped buckets, so nothing here can reach that
signer.

This does not disable request signing, and the naming invites exactly that
misreading. SigV4 and SigV4a are separate algorithms in separate modules:
plain SigV4 is `aws-sigv4::sign::v4`, carries no `#[cfg]` on this feature, and
still signs every S3 request. Only the asymmetric variant (`sign::v4a`, and the
`SigningParams::V4a` arm) is gated off. Verified: `aws-sigv4` remains in the
dependency graph, SigV4a's own deps (`crypto-bigint`, `base16ct`) drop out, and
the S3/WIF/transfer tests pass.

`sso` goes too, which is the change from the previous revision of this commit.
It hard-requires `dep:ring` and cannot be ported -- it is the IAM Identity
Center *credential provider*, not a transport, so there is no aws-lc-backed
equivalent to swap in. It can only be carried or dropped.

Dropping it removes Identity Center from the SDK's default credential chain.
That is a support decision, not a regression in what the driver needs: the
chain still resolves env keys, IMDS, IRSA / web-identity tokens, instance roles
and `credentials-process`, which covers both ambient call sites.
`workload_identity/aws.rs` is discovering a *workload* identity rather than a
human's cached `aws sso login` session, and `telemetry/platform_detection/aws.rs`
passes no provider at all. `file_manager/s3_transfer.rs` supplies explicit
Snowflake-issued credentials and is unaffected either way. Identity Center is
therefore unsupported on this core, matching JDBC and .NET.

With both features off, `ring` is gone from the shipped graph: `cargo tree -p
sf_core -e normal -i ring` finds nothing, and `odbc`, `jdbc_bridge`,
`python_bridge` and `nodejs_bridge` all report the same. It retains a
`Cargo.lock` entry only through `rcgen` under `[dev-dependencies]` for test
certificate generation, which no artifact links.

Still not fixable here, and now the only item on this line: `aws-sigv4`
computes plain SigV4's HMAC-SHA256 through RustCrypto unconditionally, on every
stage transfer. The `fips-tls` feature comment is updated to say that rather
than pointing at ring, which is no longer linked.

2313 tests pass by default, 2314 with `--features fips-tls`.
---
 Cargo.lock                                    | 184 ++----------------
 python/Cargo.lock.sdist                       | 184 ++----------------
 sf_core/Cargo.toml                            |  47 ++++-
 tests/performance/drivers/core/app/Cargo.lock | 128 ------------
 4 files changed, 65 insertions(+), 478 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 34c2efdf5..965ca2629 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -650,20 +650,15 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint 0.5.5",
  "form_urlencoded",
  "hex",
  "hmac",
  "http 0.2.12",
  "http 1.3.1",
- "p256",
  "percent-encoding",
- "ring",
  "sha2",
- "subtle",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
@@ -911,12 +906,6 @@ dependencies = [
  "windows-link 0.2.0",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -1484,28 +1473,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
-[[package]]
-name = "crypto-bigint"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -1580,16 +1547,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "der"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -1717,44 +1674,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
-[[package]]
-name = "ecdsa"
-version = "0.14.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
-dependencies = [
- "der 0.6.1",
- "elliptic-curve",
- "rfc6979",
- "signature 1.6.4",
-]
-
 [[package]]
 name = "either"
 version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
-[[package]]
-name = "elliptic-curve"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
-dependencies = [
- "base16ct",
- "crypto-bigint 0.4.9",
- "der 0.6.1",
- "digest",
- "ff",
- "generic-array",
- "group",
- "pkcs8 0.9.0",
- "rand_core 0.6.4",
- "sec1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "embed-resource"
 version = "3.0.9"
@@ -1871,16 +1796,6 @@ dependencies = [
  "simdutf8",
 ]
 
-[[package]]
-name = "ff"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.2"
@@ -2119,17 +2034,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
-[[package]]
-name = "group"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.12"
@@ -3711,17 +3615,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
-[[package]]
-name = "p256"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "sha2",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3830,22 +3723,12 @@ checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
 dependencies = [
  "aes",
  "cbc",
- "der 0.7.10",
+ "der",
  "des",
  "pbkdf2",
  "scrypt",
  "sha2",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
-dependencies = [
- "der 0.6.1",
- "spki 0.6.0",
+ "spki",
 ]
 
 [[package]]
@@ -3854,10 +3737,10 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.10",
+ "der",
  "pkcs5",
  "rand_core 0.6.4",
- "spki 0.7.3",
+ "spki",
 ]
 
 [[package]]
@@ -4464,17 +4347,6 @@ dependencies = [
  "webpki-roots",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
-dependencies = [
- "crypto-bigint 0.4.9",
- "hmac",
- "zeroize",
-]
-
 [[package]]
 name = "rgb"
 version = "0.8.53"
@@ -4693,20 +4565,6 @@ dependencies = [
  "sha2",
 ]
 
-[[package]]
-name = "sec1"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
-dependencies = [
- "base16ct",
- "der 0.6.1",
- "generic-array",
- "pkcs8 0.9.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -4874,7 +4732,7 @@ dependencies = [
  "const-oid",
  "criterion",
  "ctor",
- "der 0.7.10",
+ "der",
  "der-parser",
  "des",
  "dirs",
@@ -4906,7 +4764,7 @@ dependencies = [
  "opentelemetry_sdk",
  "os_info",
  "pin-project-lite",
- "pkcs8 0.10.2",
+ "pkcs8",
  "pprof",
  "prost 0.14.1",
  "proto_generator",
@@ -4924,10 +4782,10 @@ dependencies = [
  "sf_core",
  "sf_params_spec",
  "sha2",
- "signature 2.2.0",
+ "signature",
  "snafu 0.8.9",
  "sonic-rs",
- "spki 0.7.3",
+ "spki",
  "temp-env",
  "tempfile",
  "test-case",
@@ -5047,16 +4905,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "1.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
-dependencies = [
- "digest",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "2.2.0"
@@ -5192,16 +5040,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spki"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
-dependencies = [
- "base64ct",
- "der 0.6.1",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -5209,7 +5047,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.10",
+ "der",
 ]
 
 [[package]]
@@ -6680,8 +6518,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid",
- "der 0.7.10",
- "spki 0.7.3",
+ "der",
+ "spki",
  "tls_codec",
 ]
 
diff --git a/python/Cargo.lock.sdist b/python/Cargo.lock.sdist
index 7ede785ca..506c62bbb 100644
--- a/python/Cargo.lock.sdist
+++ b/python/Cargo.lock.sdist
@@ -641,20 +641,15 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint 0.5.5",
  "form_urlencoded",
  "hex",
  "hmac",
  "http 0.2.12",
  "http 1.3.1",
- "p256",
  "percent-encoding",
- "ring",
  "sha2",
- "subtle",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
@@ -902,12 +897,6 @@ dependencies = [
  "windows-link 0.2.0",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -1441,28 +1430,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
-[[package]]
-name = "crypto-bigint"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
@@ -1537,16 +1504,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "der"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -1674,44 +1631,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
-[[package]]
-name = "ecdsa"
-version = "0.14.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
-dependencies = [
- "der 0.6.1",
- "elliptic-curve",
- "rfc6979",
- "signature 1.6.4",
-]
-
 [[package]]
 name = "either"
 version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e5e8f6c15a24b9a3ee5efec809ccd006d3b30e8b3bb63c39af737c7f87daa1d"
 
-[[package]]
-name = "elliptic-curve"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
-dependencies = [
- "base16ct",
- "crypto-bigint 0.4.9",
- "der 0.6.1",
- "digest",
- "ff",
- "generic-array",
- "group",
- "pkcs8 0.9.0",
- "rand_core 0.6.4",
- "sec1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1814,16 +1739,6 @@ dependencies = [
  "simdutf8",
 ]
 
-[[package]]
-name = "ff"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.2"
@@ -2062,17 +1977,6 @@ version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
-[[package]]
-name = "group"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.12"
@@ -3450,17 +3354,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
-[[package]]
-name = "p256"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "sha2",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3569,22 +3462,12 @@ checksum = "e847e2c91a18bfa887dd028ec33f2fe6f25db77db3619024764914affe8b69a6"
 dependencies = [
  "aes",
  "cbc",
- "der 0.7.10",
+ "der",
  "des",
  "pbkdf2",
  "scrypt",
  "sha2",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
-dependencies = [
- "der 0.6.1",
- "spki 0.6.0",
+ "spki",
 ]
 
 [[package]]
@@ -3593,10 +3476,10 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.10",
+ "der",
  "pkcs5",
  "rand_core 0.6.4",
- "spki 0.7.3",
+ "spki",
 ]
 
 [[package]]
@@ -4203,17 +4086,6 @@ dependencies = [
  "webpki-roots",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
-dependencies = [
- "crypto-bigint 0.4.9",
- "hmac",
- "zeroize",
-]
-
 [[package]]
 name = "rgb"
 version = "0.8.53"
@@ -4432,20 +4304,6 @@ dependencies = [
  "sha2",
 ]
 
-[[package]]
-name = "sec1"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
-dependencies = [
- "base16ct",
- "der 0.6.1",
- "generic-array",
- "pkcs8 0.9.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -4591,7 +4449,7 @@ dependencies = [
  "const-oid",
  "criterion",
  "ctor",
- "der 0.7.10",
+ "der",
  "der-parser",
  "des",
  "dirs",
@@ -4623,7 +4481,7 @@ dependencies = [
  "opentelemetry_sdk",
  "os_info",
  "pin-project-lite",
- "pkcs8 0.10.2",
+ "pkcs8",
  "pprof",
  "prost 0.14.1",
  "proto_generator",
@@ -4641,10 +4499,10 @@ dependencies = [
  "sf_core",
  "sf_params_spec",
  "sha2",
- "signature 2.2.0",
+ "signature",
  "snafu 0.8.9",
  "sonic-rs",
- "spki 0.7.3",
+ "spki",
  "temp-env",
  "tempfile",
  "test-case",
@@ -4732,16 +4590,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "1.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
-dependencies = [
- "digest",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "2.2.0"
@@ -4877,16 +4725,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spki"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
-dependencies = [
- "base64ct",
- "der 0.6.1",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4894,7 +4732,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.10",
+ "der",
 ]
 
 [[package]]
@@ -6183,8 +6021,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid",
- "der 0.7.10",
- "spki 0.7.3",
+ "der",
+ "spki",
  "tls_codec",
 ]
 
diff --git a/sf_core/Cargo.toml b/sf_core/Cargo.toml
index 7f893f3e1..6462c1f62 100644
--- a/sf_core/Cargo.toml
+++ b/sf_core/Cargo.toml
@@ -24,9 +24,10 @@ sonic-json = ["sonic-rs"]
 #
 # The name stays because the *claim* is not yet complete:
 #   - SigV4 request signing computes HMAC-SHA256 outside the module:
-#     `aws-sigv4` uses RustCrypto unconditionally, and `aws-sdk-s3` enables
-#     `sigv4a` by default, which links ring. That is every stage transfer, not
-#     an edge case; see F7.
+#     `aws-sigv4` uses RustCrypto unconditionally. That is every stage
+#     transfer, not an edge case; see F7. `ring` itself is no longer linked --
+#     its only two sources, `sigv4a` and `sso`, are both off (see the AWS SDK
+#     block below) -- so this bullet is now about RustCrypto alone.
 #   - OAuth CSRF and PKCE randomness comes from `oauth2`, which draws on `rand`
 #     rather than the module's DRBG; see F8.
 #   - The `aws-lc-rs` bound below keeps `aws-lc-fips-sys` on 0.13.x; it
@@ -125,7 +126,45 @@ prost = { version = "0.14.1", optional = true }
 proto_utils = { path = "../proto_utils", optional = true }
 
 # AWS SDK dependencies
-aws-sdk-s3 = { version = "1.106.0", default-features = false, features = ["rt-tokio", "sigv4a"] }
+#
+# Feature selection here is about crypto provenance, not build size. The
+# `default-features = false` lines below keep the SDK's legacy ring-backed TLS
+# stack out of the build (an older rustls 0.21 on hyper 0.14). Two features
+# that would each re-link `ring` are then deliberately left off: `sigv4a` and
+# `sso`. With both off, `ring` is absent from the normal dependency graph
+# entirely -- `cargo tree -p sf_core -e normal -i ring` finds nothing, and all
+# four binding crates report the same. It does still have a `Cargo.lock`
+# entry, reached only through `rcgen` under `[dev-dependencies]` for test
+# certificate generation; nothing shipped links it.
+#
+# `sigv4a` is OFF. It pulls `aws-runtime/sigv4a` -> `aws-sigv4/sigv4a` ->
+# `dep:ring`, and it only signs S3 multi-region access point ARNs. Snowflake
+# stages are ordinary region-scoped buckets, so nothing here can reach that
+# signer.
+#
+# This does **not** disable request signing. SigV4 and SigV4a are separate
+# algorithms in separate modules: plain SigV4 is `aws-sigv4::sign::v4`, carries
+# no `#[cfg]` on this feature, and still signs every S3 request. Only the
+# asymmetric variant (`sign::v4a`, and the `SigningParams::V4a` arm) is gated
+# off. Turning `sigv4a` back on to "restore signing" would be a misreading --
+# it would only re-link ring.
+#
+# `sso` is OFF. It hard-requires `dep:ring` with no aws-lc-backed equivalent to
+# swap in, because it is the IAM Identity Center *credential provider* rather
+# than a transport -- so it cannot be ported, only carried or dropped. Leaving
+# it out takes Identity Center out of the SDK's default credential chain, which
+# is a support decision rather than an oversight: Identity Center is not
+# supported on this core, matching JDBC and .NET.
+#
+# Nothing that needs ambient credentials loses them. The default chain still
+# resolves env keys, IMDS, IRSA / web-identity tokens, instance roles and
+# `credentials-process`, which is the whole set the two ambient call sites use
+# -- `workload_identity/aws.rs`, where WIF is discovering a *workload*
+# identity rather than a human's cached `aws sso login` session, and
+# `telemetry/platform_detection/aws.rs`, which passes no provider at all.
+# `file_manager/s3_transfer.rs` is unaffected either way; it supplies explicit
+# Snowflake-issued credentials.
+aws-sdk-s3 = { version = "1.106.0", default-features = false, features = ["rt-tokio"] }
 aws-sdk-sts = { version = "1.96.0", default-features = false, features = ["rt-tokio"] }
 aws-config = { version = "1.8.12", default-features = false, features = ["rt-tokio", "credentials-process"] }
 aws-runtime = { version = "1.5.18", default-features = false }
diff --git a/tests/performance/drivers/core/app/Cargo.lock b/tests/performance/drivers/core/app/Cargo.lock
index f86ba053f..d6392925f 100644
--- a/tests/performance/drivers/core/app/Cargo.lock
+++ b/tests/performance/drivers/core/app/Cargo.lock
@@ -586,18 +586,14 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint",
  "form_urlencoded",
  "hex",
  "hmac 0.13.0",
  "http",
- "p256",
  "percent-encoding",
  "sha2 0.11.0",
- "subtle",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
@@ -860,12 +856,6 @@ dependencies = [
  "tower-service",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -1265,18 +1255,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
-[[package]]
-name = "crypto-bigint"
-version = "0.5.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
-dependencies = [
- "generic-array",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.1.7"
@@ -1423,7 +1401,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid 0.9.6",
  "crypto-common 0.1.7",
  "subtle",
 ]
@@ -1503,46 +1480,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
-[[package]]
-name = "ecdsa"
-version = "0.16.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
-dependencies = [
- "der",
- "digest 0.10.7",
- "elliptic-curve",
- "rfc6979",
- "signature",
- "spki",
-]
-
 [[package]]
 name = "either"
 version = "1.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
 
-[[package]]
-name = "elliptic-curve"
-version = "0.13.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
-dependencies = [
- "base16ct",
- "crypto-bigint",
- "digest 0.10.7",
- "ff",
- "generic-array",
- "group",
- "pem-rfc7468",
- "pkcs8",
- "rand_core 0.6.4",
- "sec1",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "encoding_rs"
 version = "0.8.42"
@@ -1630,16 +1573,6 @@ dependencies = [
  "simdutf8",
 ]
 
-[[package]]
-name = "ff"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.14"
@@ -1818,7 +1751,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
- "zeroize",
 ]
 
 [[package]]
@@ -1863,17 +1795,6 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
-[[package]]
-name = "group"
-version = "0.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
-dependencies = [
- "ff",
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.19"
@@ -3057,18 +2978,6 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a80800c0488c3a21695ea981a54918fbb37abf04f4d0720c453632255e2ff0e"
 
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "ecdsa",
- "elliptic-curve",
- "primeorder",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "pbkdf2"
 version = "0.12.2"
@@ -3220,15 +3129,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "primeorder"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
-dependencies = [
- "elliptic-curve",
-]
-
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -3581,16 +3481,6 @@ dependencies = [
  "webpki-roots",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
-dependencies = [
- "hmac 0.12.1",
- "subtle",
-]
-
 [[package]]
 name = "ring"
 version = "0.17.14"
@@ -3788,20 +3678,6 @@ dependencies = [
  "sha2 0.10.9",
 ]
 
-[[package]]
-name = "sec1"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
-dependencies = [
- "base16ct",
- "der",
- "generic-array",
- "pkcs8",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -4078,10 +3954,6 @@ name = "signature"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
-dependencies = [
- "digest 0.10.7",
- "rand_core 0.6.4",
-]
 
 [[package]]
 name = "simd-adler32"