Repository navigation
Add brainpool EC_group symbols; make public API symbol registration self-service - #3423
Merged
Merged
Conversation
The EC_group_brainpoolP*r1 functions added in aws#3286 were never added to the libcrypto symbol registry, so "local: *;" in crypto/libcrypto.map demoted all five to local symbols in ENABLE_DIST_PKG builds. They are compiled into libcrypto, but applications cannot link against them: nm -D --defined-only libcrypto-awslc.so | grep brainpool # nothing nm libcrypto-awslc.so | grep brainpool # t EC_group_... Add them to the open AWS_LC_1.0 node and regenerate the version script, matching how EVP_AEAD_CTX_copy (aws#3332) and CRYPTO_cts128_* (aws#3308) were registered. This clears two checks that are currently red on main: the dist-pkg-install-tests-* silent-drop test and the libcrypto symbol check (baseline).
Registering new API required hand-editing the symbol registry, which the docs
tell contributors not to do. The command documented in tests/ci/README.md was
./util/update_symbol_version.sh AWS_LC_1.0
which always failed with "AWS_LC_1.0 already exists in the registry", because the
script could only open a new version node. There was no supported way to do what
every symbol addition so far has actually done: add to the node that is already
open. A contributor who hit the baseline check and followed the documented
remediation reached a dead end.
- update_symbol_version.sh now takes --current to add to the newest node, or a
version to open a new one. Exactly one is required, so the node is always an
explicit choice and never a silent default. Passing a node that already exists
points at --current rather than dead-ending.
- Re-sort the registry under LC_ALL=C. The committed registries are in byte
order, matching what generate_version_script emits; re-sorting under a UTF-8
locale rewrote the entire file and buried the real change.
- The dist-pkg silent-drop failure printed no remediation at all. It and the
baseline check now both name the command and explain the consequence: the
symbols are compiled in but cannot be linked against.
- Document that new API goes into the open node, that opening a node closes the
previous one and is a release-level decision, and describe the built-library
check, which was previously undocumented.
Contributor
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3423 +/- ##
=======================================
Coverage 78.23% 78.24%
=======================================
Files 696 696
Lines 124462 124462
Branches 17275 17278 +3
=======================================
+ Hits 97371 97383 +12
+ Misses 26167 26157 -10
+ Partials 924 922 -2 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
WillChilds-Klein
approved these changes
Aug 12, 2026
Comment on lines
+190
to
+193
| # The re-sort runs under LC_ALL=C so the registry stays in byte order. That is | ||
| # the order generate_version_script emits symbols in, and the order the | ||
| # committed registries are already in; sorting under a UTF-8 locale instead | ||
| # would silently rewrite the whole file and bury the real change in a |
Contributor
There was a problem hiding this comment.
nice. thanks for figuring this out!
WillChilds-Klein
enabled auto-merge (squash)
August 12, 2026 19:27
dougch
approved these changes
Aug 12, 2026
justsmth
disabled auto-merge
August 12, 2026 20:00
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
aws-lc 5.6.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## What's Changed * Fix thread-local destructors with MSYS2 clang64 by @justsmth in aws/aws-lc#3405 * Share Bedrock model settings between autofix and util/backport by @tianyiy-tim in aws/aws-lc#3395 * ci: remove Graviton5 c9g fleet and job by @nebeid in aws/aws-lc#3400 * Fix `grpc-master-x86_64` integration test by @nhatnghiho in aws/aws-lc#3346 * Update MySQL CI integration to mysql-cluster-9.7.2 by @WillChilds-Klein in aws/aws-lc#3409 * BoringSSL: Fix beeu_mod_inverse_vartime on aarch64 by @geedo0 in aws/aws-lc#3381 * Avoid /usr/bin/env dependency in FIPS compiler wrapper by @justsmth in aws/aws-lc#3411 * Add brainpoolP224r1, brainpoolP256r1, brainpoolP320r1, brainpoolP384r1, brainpoolP512r1 EC group support by @sfarestam-iproov in aws/aws-lc#3286 * Document how to build applications against AWS-LC by @WillChilds-Klein in aws/aws-lc#3386 * Harden CLI input validation and file output by @nhatnghiho in aws/aws-lc#3347 * Add brainpool EC_group symbols; make public API symbol registration self-service by @justsmth in aws/aws-lc#3423 * Add CPython 3.15 integration test by @WillChilds-Klein in aws/aws-lc#3422 * Add memcached integration test by @WillChilds-Klein in aws/aws-lc#3410 * Add Keccak-256 (Ethereum-style, original 0x01 padding) by @fabrice102 in aws/aws-lc#3245 * ci: pin security review to the PR head commit by @jakemas in aws/aws-lc#3425 * Reject GCM IV lengths below 8 in EVP_CTRL_GCM_IV_GEN by @dougch in aws/aws-lc#3424 * Add Backport Tool Analysis by @tianyiy-tim in aws/aws-lc#3389 * Enable mtr retries in MariaDB CI integration by @justsmth in aws/aws-lc#3427 * ci: install Rust in the Linux docker images by @justsmth in aws/aws-lc#3393 * Fix Windows OPENSSL_SMALL Debug builds with NASM 2.16.01 by @justsmth in aws/aws-lc#3420 * ci: use preinstalled Rust in pyopenssl integration by @geedo0 in aws/aws-lc#3430 * ci: re-enable gcc-14 + FIPS build in gcc-14-hardened job by @dougch in aws/aws-lc#3428 * Add backport apply command by @tianyiy-tim in aws/aws-lc#3414 * Add AWS-LC provider build and CI infrastructure by @geedo0 in aws/aws-lc#3419 * Update pull request template by @justsmth in aws/aws-lc#3436 * Move network-dependent s_client tests into integration_test by @justsmth in aws/aws-lc#3407 * Add latest compiler coverage to CI by @justsmth in aws/aws-lc#3406 * Bump the cargo-ci-lambda group in /tests/ci/lambda with 4 updates by @dependabot[bot] in aws/aws-lc#3390 * Decouple symbol versioning from distribution packaging mode by @justsmth in aws/aws-lc#3426 * Upgrade JDK to JDK21 for ACCP tests by @geedo0 in aws/aws-lc#3440 * Fix ML-DSA externalMu JSON tags by @JunMin765677 in aws/aws-lc#3439 * Pin librelp to a release, wrap `SSL_get_shutdown` for failing integration test by @prasden in aws/aws-lc#3431 * Install OpenSSL-compat libcrypto.pc and libssl.pc with the shim by @justsmth in aws/aws-lc#3370 * ci: stop deployment noise for maintainers by @prasden in aws/aws-lc#3445 * ci: consolidate android-omnibus deployments on external PRs by @prasden in aws/aws-lc#3447 * Define BN_FLG_CONSTTIME as zero for source compatibility by @WillChilds-Klein in aws/aws-lc#3446 * Re-import mlkem-native and mldsa-native; drop custom meta headers by @hanno-becker in aws/aws-lc#3367 * Prepare 5.6.0 by @justsmth in aws/aws-lc#3448 ## New Contributors * @sfarestam-iproov made their first contribution in aws/aws-lc#3286 * @JunMin765677 made their first contribution in aws/aws-lc#3439 **Full Changelog**: https://github.com/aws/aws-lc/compare/v5.5.0...v5.6.0</pre> <p>View the full release notes at <a href="https://github.com/aws/aws-lc/releases/tag/v5.6.0">https://github.com/aws/aws-lc/releases/tag/v5.6.0</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!17855
justsmth
added a commit
to justsmth/aws-lc
that referenced
this pull request
Oct 12, 2026
glibc resolves a versioned symbol by node name alone, with no regard for which library provides it, so a FIPS build and a mainline build that share AWS_LC_<major>.<minor> can cross-bind when both are loaded into one process. Rename the nodes to AWS_LC_FIPS5_<major>.<minor>, before a versioned release freezes the old name. The FIPS major version is part of the prefix because the FIPS 4 branch (AWS_LC_FIPS4) can carry the same node numbers. The registries and .map files carry the node name, so they are rewritten too. The scripts that parsed it stopped at a fixed AWS_LC_ prefix: the Go generator's version sort and the update script's node arithmetic now match the namespace instead, and the symbol-version test asserts the branch's prefix rather than accepting any node that starts with AWS_LC_. Ported from the FIPS 4 backport's 0c9a9d3 with FIPS4 -> FIPS5. Two hunks were re-applied by hand against the text aws#3423 rewrote.
justsmth
added a commit
that referenced
this pull request
Nov 5, 2026
### Description of changes: Backports merged mainline OpenSSL CLI, symbol-versioning, and crypto-policy support to `fips-2026-06-26-snapshot`, the FIPS 5 snapshot based on v5.1.0. This is the FIPS 5 counterpart of #3615 and #3618, including self-service symbol registration and the latest EOF, Windows build, and integration-CI fixes listed below. The branch contains 54 cherry-picks with upstream commit references: 46 carry unchanged upstream edits, and eight document their FIPS-branch adaptations. Three additional branch-specific commits establish the `AWS_LC_FIPS5_<major>.<minor>` namespace, align the documentation, and add the FIPS silent-drop check. Nothing in the FIPS module itself changes; the only edit under `crypto/fipsmodule/` is the test-only `rand_isolated_test.cc` warning fix from #3648, which is not part of `bcm.o`. | PR | Change | Deviation | | --- | --- | --- | | #3331 | Fix libgit2/xtrabackup/grpc tests; add OSSL3 peer cert APIs | | | #3096 | Symbol versioning | Keeps `ABI_VERSION` 0. Registers `FIPS_module_name` (from #3474) | | #3338 | Symbol versioning follow-ups | | | #3343 | Pin libssh2 integration | | | #3341 | `SSL_OP_IGNORE_UNEXPECTED_EOF` over sockets | | | #3373 | Flaky `s_client` cipher tests | | | #3386 | Document building against AWS-LC | | | #3347 | Harden CLI input validation | | | #3423 | Self-service symbol registration | Drops the brainpool entries (#3286 is not on this branch) | | #3407 | Network `s_client` tests to integration | | | #3426 | Decouple symbol versioning from dist-pkg | | | #3370 | OpenSSL-compat `.pc` files with the shim | | | #3446 | `BN_FLG_CONSTTIME` as zero | Drops the krb5 patch removal; the #3308 pick below simply never adds that patch | | #3469 | `req -extensions` / `-reqexts` | | | #3481 | OpenSSL long names for ML-DSA OIDs | | | #3492 | `bssl client -tls1_2`/`-tls1_3` | | | #3501 | `ERR_num_errors`/`ERR_pop_to_count` | | | #3529 | Error-queue suppression scope | | | #3502 | Crypto-policies reader | Leaves `cpu_getauxval_linux.h` (in `bcm.o`) untouched and defines `AT_SECURE` in `crypto_policy.cc` | | #3527 | Export the reader; CI job | | | #3536 | CLI exit codes | | | #3503 | Seed ciphers and version bounds | | | #3548 | `verify`/`x509` compatibility | | | #3532 | `pkcs12` import | | | #3499 | Quote shell args in tool tests | | | #3551 | SIGPIPE race in linkage checks | | | #3560 | Reject malformed end-of-contents | | | #3563 | `rehash -compat` | | | #3543 | Harden code paths | Drops the `e_aesccm.c` guard (in `bcm.o`) | | #3568 | `ca` fails on unwritable cert | | | #3504 | Seed groups and sigalgs | No `SSL_CTX_set1_group_ids` (#3346) here, so the deduped list is installed into `supported_group_list` directly. ML-DSA sigalg merge unchanged | | #3575 | `pkcs12 -export`, `req -batch` | | | #3592 | CSR proof-of-possession on `x509 -req` | | | #3605 | RSA enc/dec and more ciphers | | | #3484 | OpenSSL 3.x unexpected-EOF behavior and retry guard; CLI/shim adaptations | | | #3645 | Fix Windows `-Wunused-but-set-global` build failure | | | #3430 | Use preinstalled Rust in pyOpenSSL integration | | | #3431 | Pin librelp and wrap `SSL_get_shutdown` in its integration test | | | #3507 | Fix tpm2-tss integration build without SM4 | | | #3648 | Fix Windows `-Wunused-but-set-global` in `rand_isolated_test.cc` | Test-only file under `crypto/fipsmodule/`; `bcm.o` unchanged | | #3666 | Cipher name as command (`openssl aes-256-cbc`) | | | #3680 | PKCS12 password prompt test isolation on OpenBSD | | | #3664 | `rand` subcommand | | | #3665 | Password-based key derivation in `enc` | | | #3636 | `x509 -serial`/`-addtrust`/`-trustout` | | | #3634 | CA signing, revocation, and CRLs in `ca` | | | #3635 | `ocsp` command | | | #3687 | Self-contained `s_client` TLS 1.1 integration tests | | | #3690 | Fix wrapper escape in `rand` | | | #3703 | `dgst -r` coreutils output flag | | | #3308 | CTS mode (`<openssl/modes.h>`, `CRYPTO_cts128_*`) and krb5 integration test | Leaves `crypto/fipsmodule/modes/internal.h` untouched (its hunk only re-homed the `cbc128_f` typedef and removed a dead declaration; no TU includes both headers). Registers the two symbols under `AWS_LC_FIPS5_1.0`. Omits the `BN_FLG_CONSTTIME` krb5 patch that #3446 removed on main. Integration script symlinks `libcrypto.so*` rather than hardcoding `.so.1` (this branch is `ABI_VERSION` 0) | | #3349 | Built-in Camellia in the krb5 patch; CTS doc label | Drops its `bn.h` comment hunk, superseded by #3446 | | #3405 | Register the thread-exit TLS callback on MinGW/clang64 | | | #3669 | Run the msys2 `mingw64 - MSYS Makefiles` job in the MSYS2 shell | | ### Call-outs: - #3308 is the one backport that adds public API: a new installed header `include/openssl/modes.h` and two new exported functions, `CRYPTO_cts128_encrypt` and `CRYPTO_cts128_decrypt`, registered under `AWS_LC_FIPS5_1.0`. MIT krb5's OpenSSL backend requires them, and they were two of the symbols the release ABI check reports as missing relative to mainline. The implementation lives outside the module in `crypto/cipher_extra/cts.c` and is driven by a caller-supplied `cbc128_f`, so it is not a module service. - The complete #3484 backport changes non-ignored unexpected transport EOF from `SSL_ERROR_SYSCALL` to `SSL_ERROR_SSL` with `SSL_R_UNEXPECTED_EOF_WHILE_READING`, matching main. It also fixes retryable reads being treated as EOF; the shared CLI transport enables `SSL_OP_IGNORE_UNEXPECTED_EOF` as upstream does. - `ABI_VERSION` remains 0 (`libcrypto-awslc.so.0`), `SOFTWARE_NAME` remains `awslc`, and symbol nodes use `AWS_LC_FIPS5_1.0`, distinct from versioned mainline's `AWS_LC_*` nodes. A product rename at release would also require updating distribution-package documentation and test globs. - #3430 relies on Rust/Cargo in the shared CI images; their presence was confirmed in the existing pyOpenSSL job log. Independently rebuilt branch images must also supply Rust (main's image setup is #3393). ### Testing: Latest validation covers #3405 and #3669, which fix the `windows-alt` failures that surfaced once #3645/#3648 let the msys2 jobs compile: `ThreadTest.ThreadLocal` on `clang64` (LLD 22 no longer emits the TLS directory, so the thread-exit callback never ran) and the `mingw64 - MSYS Makefiles` ABI-detection failure. Both picks are patch-identical to main. - Windows Server 2022, msys2 clang64 (Clang/LLD 22.1.8) Release, static non-FIPS with Go/Perl disabled: reproduced the `ThreadTest.ThreadLocal` failure at `5b192eb85`, then at the new head confirmed `llvm-readobj --coff-tls-directory` shows a TLS directory with `AddressOfCallBacks`, `ThreadTest.*` 6/6 pass, and the full `crypto_test` passes (2,700 passed, 1 skipped). - #3669 is workflow-only; the msys2 job section of `windows-alt.yml` now matches main. CI on this push is the verification. Latest validation covers the #3308/#3349 picks: - Ubuntu 24.04 ARM64 Release with `FIPS=1`, shared libraries, symbol versioning, and crypto policies: clean build; `bcm.o` is byte-identical (SHA-256 match) to a same-path build of the previous head `8c966f08e`; all 6 `CTS128Test` cases and the full `crypto_test` (3,761 passed, 2 skipped) pass; `nm --with-symbol-versions` shows both `CRYPTO_cts128_*` exported as `@@AWS_LC_FIPS5_1.0`, and `AWS_LC_FIPS5_1.0` remains the only version node. - `util/update_symbol_version.sh --current` reports no unregistered symbols and leaves the tree unchanged, so the manual registry entries match what the tooling produces. - Ran `tests/ci/integration/run_krb5_integration.sh krb5-1.22.2-final` end to end in an `ubuntu:22.04` container on ARM64 (gcc 11): both krb5 patches apply, krb5 configures and builds against the installed AWS-LC, `check-linkage.sh` confirms `kinit` links our `libcrypto.so.0`, and `make check` under `src/lib/crypto` passes, including the `aes-test` CTS vectors and the built-in Camellia test. Exit status 0. - `cts.c`, `cts_test.cc`, `modes.h`, and the krb5 patches are byte-identical to main; the script differs from main only by the `libcrypto.so*` symlink loop and the absent `record_repo_commit` call (that helper is not on this branch). Validation of the eleven CLI/CI cherry-picks (#3648 through #3703), all of which applied without conflicts and are patch-identical to their mainline commits: - Ubuntu 24.04 ARM64 Release with `FIPS=1`, shared libraries, symbol versioning, and crypto policies: clean build; `tool_openssl_test` 846 passed / 0 failed / 4 pre-existing skips (CLI comparisons used OpenSSL 3.0.13), `rand_isolated_test` passed, and all 5 `SClientIntegrationTest` cases passed, including the `Tls1_1` cases that failed in the previous `ocsp-external` CI run and that #3687 fixes. - Windows Server 2022 msys2 clang64 (Clang 22) Release, static non-FIPS with Go/Perl disabled: `rand_isolated_test`, `openssl`, `tool_openssl_test`, and `integration_test` build cleanly, confirming #3648 resolves the previous `-Werror,-Wunused-but-set-global` failure; `rand_isolated_test` and the 218 tests in the new/changed CLI suites (`RandTest`, `CipherAliasTest`, `DgstTest`, `EncTest`, `OcspTest`, `CATest`, `X509Test`, `PKCS12Test`) passed against the msys2 OpenSSL. - `git diff` against the base still touches nothing in `bcm.o`; the only `crypto/` library change in the new picks is the static `b64_ctrl` flush fix from #3664, so no exported-symbol registry updates are needed. Previous validation (through #3507): - Ubuntu 24.04 ARM64 Release with `FIPS=1`, shared libraries, distribution packaging/OpenSSL shim, symbol versioning, and crypto policies: 3,755 crypto, 2,669 SSL, 744 CLI, and 7 bssl tests passed; all 69 selected SSL shutdown runner cases passed. CLI comparisons used OpenSSL 3.0.13. Unavailable system-policy cases and other configuration-dependent cases skipped. - Windows Server 2022 clang64 Release, static non-FIPS with Go/Perl disabled: build succeeded using pregenerated sources; 27 targeted UBE/EOF/shutdown tests passed. - Regenerated SSL error metadata and `generated-src/err_data.c` with the repository generators; independently verified the error table matches generator output. The committed tree is identical to the tested tree. - Original PR base and updated `bcm.o` are byte-identical in same-path Linux ARM64 builds. No new exported symbols require registry updates. - Modified integration scripts pass `bash -n`; external integration suites were not rerun end to end. Whitespace checking reports only inherited whitespace inside the unchanged upstream librelp patch. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license. --------- Co-authored-by: Will Childs-Klein <childw@amazon.com> Co-authored-by: Sean McGrail <549813+skmcgrail@users.noreply.github.com> Co-authored-by: Prasanth Dendukuri <prasden@amazon.com> Co-authored-by: Nghi Ho <nhatnghi.ho01@gmail.com> Co-authored-by: Spencer Walgren <86751956+spwalgren@users.noreply.github.com> Co-authored-by: torben-hansen <50673096+torben-hansen@users.noreply.github.com> Co-authored-by: Samuel Chiang <sachiang@amazon.com> Co-authored-by: Gerardo Ravago <gcr@amazon.com> Co-authored-by: Matthew Ma <mtthman@amazon.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Spencer Walgren <swalgren@amazon.com>
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context/Motivation
The five
EC_group_brainpoolP*r1()functions added in #3286 were never registered.OPENSSL_EXPORTsymbols that are not added to the symbol registry are compiled into shared libraries but hidden by the version script, preventing applications from linking against them.Description of changes:
This PR registers the Brainpool EC group APIs in
AWS_LC_1.0and makes the registration path when updating the current node explicit with./util/update_symbol_version.sh --current.The symbol-versioning tool now distinguishes adding API to the current open node from opening a new node, rejects accidental reuse of an existing version node, and uses a deterministic byte-order sort. Documentation and CI failure messages now explain the impact of unregistered symbols and how to remediate them.
Call-outs:
Opening a new symbol-version node is now documented and treated as a release-level decision. Most API additions should use
--current; providing a version creates a new node and closes the current one by convention.Testing:
git diff --checkBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.