Add AWS-LC provider build and CI infrastructure - #3419
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3419 +/- ##
=======================================
Coverage 78.20% 78.20%
=======================================
Files 695 695
Lines 124271 124281 +10
Branches 17265 17268 +3
=======================================
+ Hits 97186 97200 +14
+ Misses 26161 26159 -2
+ Partials 924 922 -2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
| - uses: ZedThree/clang-tidy-review@v0.23.1 | ||
| with: | ||
| apt_packages: libssl-dev | ||
| split_workflow: true | ||
| clang_tidy_version: 19 | ||
| install_commands: /github/workspace/util/build_compilation_database.sh | ||
| install_commands: >- | ||
| /github/workspace/util/build_compilation_database.sh | ||
| -DBUILD_AWSLC_PROVIDER=ON | ||
| -DAWSLC_PROVIDER_OPENSSL_ROOT=/usr |
There was a problem hiding this comment.
NP: This ensures that the clang-tidy run covers the "provider". What version of OpenSSL is in the libssl-dev package? Is this an OpenSSL version >= 3.5 that we intend to target?
| message(FATAL_ERROR | ||
| "BUILD_AWSLC_PROVIDER requires AWSLC_PROVIDER_OPENSSL_ROOT, the install " | ||
| "prefix of an OpenSSL 3.5 or later build supplying the provider headers.") | ||
| endif() |
There was a problem hiding this comment.
NP: Why require 3.5 and not 3.0.x?
| if(APPLE) | ||
| # OpenSSL's module loader appends .dylib on macOS, while CMake normally gives | ||
| # a MODULE library the .so suffix. | ||
| set_target_properties(awslc_provider PROPERTIES SUFFIX ".dylib") | ||
| endif() | ||
|
|
||
| if(APPLE) | ||
| target_link_options(awslc_provider PRIVATE "-Wl,-undefined,dynamic_lookup") | ||
| endif() |
There was a problem hiding this comment.
NP: These if(APPLE) blocks could merge.
| command -v nm > /dev/null 2>&1 || fail "nm is required for the export check" | ||
|
|
||
| exported="$(nm -g --defined-only "${MODULE}" 2>/dev/null || true)" | ||
| grep -q 'OSSL_provider_init' <<< "${exported}" \ |
There was a problem hiding this comment.
NP: grep -qw would avoid substring matches on the nm output.
| "${AWSLC_PROVIDER_OPENSSL_INCLUDE_DIR}") | ||
| set_target_properties(awslc_provider PROPERTIES | ||
| C_VISIBILITY_PRESET hidden | ||
| OUTPUT_NAME "awslc" |
There was a problem hiding this comment.
NP: Should we include a hyphen ("aws-lc") or underscore ("aws_lc")?
3 participants
Description of changes:
AWS-LC does not currently build an OpenSSL 3 provider module. This change adds
an opt-in CMake target for the module, requiring an OpenSSL 3.5 or later install
for provider headers, and adds dedicated CI that builds against pinned OpenSSL
3.5.5.
The module exports
OSSL_provider_init, but the function intentionally returnsfailure. This establishes the build, dependency, artifact, and CI contract
before provider behavior is introduced.
Call-outs:
The provider is disabled by default and is not expected to load in this change.
CI checks only that the module builds with the shipping AWS-LC configuration,
has the platform-appropriate module name, and exports the required entry point.
The provider source compiles against OpenSSL's provider headers while the module
is built in and linked from the AWS-LC CMake project. Provider functionality and
tests are intentionally outside this PR's scope.
Testing:
tests/ci/run_aws_lc_provider_tests.shbuilds pinned OpenSSL 3.5.5, configuresAWS-LC with
BUILD_AWSLC_PROVIDER=ON, builds the provider target, checks themodule artifact, and verifies that
OSSL_provider_initis exported.The provider target was also built locally on macOS against OpenSSL 3.6.1, and
nmconfirmed thatOSSL_provider_initis the exported symbol. The Linux-onlyCI runner was not executed locally.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.