aws · justsmth · Apr 25, 2024 · Apr 17, 2024 · Apr 18, 2024 · Apr 22, 2024
@@ -33,7 +33,7 @@ jobs:
         run: brew install bash coreutils
       - name: No-prefix build for ${{ matrix.os }}
         env:
-          AWS_LC_SYS_INTERNAL_NO_PREFIX: "1"
+          AWS_LC_SYS_NO_PREFIX: "1"
         run: |
           cargo test -p aws-lc-sys --features bindgen,ssl
       - name: Collect symbols
@@ -61,7 +61,7 @@ jobs:
         run: cargo install cross --locked --git https://github.com/cross-rs/cross
       - name: No-prefix build for ${{ matrix.target }}
         env:
-          AWS_LC_SYS_INTERNAL_NO_PREFIX: "1"
+          AWS_LC_SYS_NO_PREFIX: "1"
         run: |
           cross test -p aws-lc-sys --features bindgen,ssl --target ${{ matrix.target }}
       - name: Collect symbols
@@ -108,7 +108,7 @@ jobs:
         run: brew install bash coreutils
       - name: Generate bindings for ${{ matrix.os }}
         env:
-          AWS_LC_RUST_INTERNAL_BINDGEN: "1"
+          AWS_LC_SYS_INTERNAL_BINDGEN: "1"
         run: |
           cargo test -p aws-lc-sys --features bindgen,ssl
       - name: Commit & Push changes
@@ -131,7 +131,7 @@ jobs:
         run: cargo install cross --locked --git https://github.com/cross-rs/cross
       - name: Generate bindings for ${{ matrix.target }}
         env:
-          AWS_LC_RUST_INTERNAL_BINDGEN: "1"
+          AWS_LC_SYS_INTERNAL_BINDGEN: "1"
         run: |
           cross test -p aws-lc-sys --features bindgen,ssl --target ${{ matrix.target }}
       - name: Commit & Push changes

@@ -197,6 +197,34 @@ jobs:
         # See: https://github.com/rust-lang/cargo/issues/8531
         run: AWS_LC_SYS_STATIC=${{ matrix.static }}  cargo test --tests
 
+  build-env-external-bindgen-test:
+    if: github.repository_owner == 'aws'
+    name: aws-lc-rs FIPS - External bindgen test
+    runs-on: ${{ matrix.os }}
+    env:
+      AWS_LC_SYS_EXTERNAL_BINDGEN: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ ubuntu-latest, macos-12, macos-13-xlarge, windows-latest ]
+    steps:
+      - if: ${{ matrix.os == 'windows-latest' }}
+        uses: ilammy/setup-nasm@v1
+      - uses: actions/checkout@v3
+        with:
+          submodules: 'recursive'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install ninja-build tool
+        uses: seanmiddleditch/gha-setup-ninja@v4
+      - name: Install bindgen-cli
+        run: cargo install --locked bindgen-cli
+      - name: Remove bindings
+        run: |
+          rm ./aws-lc-fips-sys/src/x86_64* 
+          rm ./aws-lc-fips-sys/src/aarch64*
+      - name: Run cargo test
+        run: cargo test --tests -p aws-lc-rs --no-default-features --features aws-lc-sys
+
   build-env-fips-test:
     if: github.repository_owner == 'aws'
     name: aws-lc-rs build-env-fips-test

@@ -3,6 +3,10 @@ dockerfile = "./docker/linux-cross/Dockerfile"
 
 [build.env]
 passthrough = [
-    "AWS_LC_SYS_INTERNAL_NO_PREFIX", "AWS_LC_RUST_INTERNAL_BINDGEN", "AWS_LC_FIPS_SYS_INTERNAL_NO_PREFIX", "GOPROXY",
-    "AWS_LC_FIPS_SYS_STATIC", "AWS_LC_SYS_STATIC", "AWS_LC_SYS_CMAKE_BUILDER", "AWS_LC_SYS_CC_SRC_COLLECTOR"
+    "AWS_LC_SYS_NO_PREFIX", "AWS_LC_FIPS_SYS_NO_PREFIX",
+    "AWS_LC_SYS_INTERNAL_BINDGEN", "AWS_LC_FIPS_SYS_INTERNAL_BINDGEN",
+    "AWS_LC_SYS_EXTERNAL_BINDGEN", "AWS_LC_FIPS_SYS_EXTERNAL_BINDGEN",
+    "AWS_LC_SYS_STATIC", "AWS_LC_FIPS_SYS_STATIC",
+    "AWS_LC_SYS_CMAKE_BUILDER", "AWS_LC_SYS_CC_SRC_COLLECTOR",
+    "GOPROXY",
 ]
@@ -1,9 +1,9 @@
 [package]
 name = "aws-lc-rs"
 authors = ["AWS-LibCrypto"]
-version = "1.7.0"
+version = "1.7.1"
 # this crate re-exports whatever sys crate that was selected
-links = "aws_lc_rs_1_7_0_sys"
+links = "aws_lc_rs_1_7_1_sys"
 edition = "2021"
 rust-version = "1.61.0"
 keywords = ["crypto", "cryptography", "security"]
@@ -46,7 +46,7 @@ fips = ["dep:aws-lc-fips-sys"]
 
 [dependencies]
 untrusted = { version = "0.7.1", optional = true }
-aws-lc-sys = { version = "0.15.0", path = "../aws-lc-sys", optional = true }
+aws-lc-sys = { version = "0.16.0", path = "../aws-lc-sys", optional = true }
 aws-lc-fips-sys = { version = "0.12.0", path = "../aws-lc-fips-sys", optional = true }
 zeroize = "1.7"
 mirai-annotations = "1.12.0"

@@ -13,6 +13,10 @@ function(set_my_target_properties ...)
     endif()
 endfunction()
 
+if(BUILD_SHARED_LIBS)
+    add_definitions(-DBORINGSSL_SHARED_LIBRARY)
+endif()
+
 add_subdirectory(aws-lc aws-lc EXCLUDE_FROM_ALL)
 
 if (BUILD_LIBSSL)
@@ -53,4 +57,8 @@ if (BORINGSSL_PREFIX)
         set(TARGET_PREFIX "lib${BORINGSSL_PREFIX}")
     endif()
     set_my_target_properties(PREFIX ${TARGET_PREFIX})
+
+    # This BORINGSSL_PREFIX has an "_" appended, so we must remove it
+    string(REGEX REPLACE "_$" "" BORINGSSL_PREFIX_MACRO ${BORINGSSL_PREFIX})
+    add_definitions(-DBORINGSSL_PREFIX=${BORINGSSL_PREFIX_MACRO})
 endif ()
@@ -1,8 +1,8 @@
 [package]
 name = "aws-lc-sys"
 description = "AWS-LC is a general-purpose cryptographic library maintained by the AWS Cryptography team for AWS and their customers. It іs based on code from the Google BoringSSL project and the OpenSSL project."
-version = "0.15.0"
-links = "aws_lc_0_15_0"
+version = "0.16.0"
+links = "aws_lc_0_16_0"
 authors = ["AWS-LC"]
 edition = "2021"
 repository = "https://github.com/aws/aws-lc-rs"
@@ -67,4 +67,4 @@ libc = "0.2.121"
 paste = "1.0.11"
 
 [package.metadata.aws-lc-sys]
-commit-hash = "e7572ee050b470b2d90e458ee32b8949e76193d5"
+commit-hash = "10a389e1adda37889b4ef9186901df15c48846b5"
@@ -1,10 +1,7 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0 OR ISC
 
-use crate::{
-    get_aws_lc_include_path, get_aws_lc_sys_includes_path, get_generated_include_path,
-    get_rust_include_path,
-};
+use crate::{get_rust_include_path, BindingOptions, COPYRIGHT};
 use bindgen::callbacks::{ItemInfo, ParseCallbacks};
 use std::fmt::Debug;
 use std::path::Path;
@@ -34,47 +31,6 @@ impl ParseCallbacks for StripPrefixCallback {
     }
 }
 
-fn add_header_include_path(args: &mut Vec<String>, path: String) {
-    args.push("-I".to_string());
-    args.push(path);
-}
-
-fn prepare_clang_args(manifest_dir: &Path, options: &BindingOptions) -> Vec<String> {
-    let mut clang_args: Vec<String> = Vec::new();
-
-    add_header_include_path(
-        &mut clang_args,
-        get_rust_include_path(manifest_dir).display().to_string(),
-    );
-
-    if options.build_prefix.is_some() {
-        add_header_include_path(
-            &mut clang_args,
-            get_generated_include_path(manifest_dir)
-                .display()
-                .to_string(),
-        );
-    }
-
-    add_header_include_path(
-        &mut clang_args,
-        get_aws_lc_include_path(manifest_dir).display().to_string(),
-    );
-
-    if let Some(include_paths) = get_aws_lc_sys_includes_path() {
-        for path in include_paths {
-            add_header_include_path(&mut clang_args, path.display().to_string());
-        }
-    }
-
-    clang_args
-}
-
-const COPYRIGHT: &str = r"
-// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-// SPDX-License-Identifier: Apache-2.0 OR ISC
-";
-
 const PRELUDE: &str = r"
 #![allow(
     unused_imports,
@@ -97,15 +53,8 @@ const PRELUDE: &str = r"
 )]
 ";
 
-#[derive(Default)]
-pub(crate) struct BindingOptions {
-    pub build_prefix: Option<String>,
-    pub include_ssl: bool,
-    pub disable_prelude: bool,
-}
-
 fn prepare_bindings_builder(manifest_dir: &Path, options: &BindingOptions) -> bindgen::Builder {
-    let clang_args = prepare_clang_args(manifest_dir, options);
+    let clang_args = crate::prepare_clang_args(manifest_dir, options);
 
     let mut builder = bindgen::Builder::default()
         .derive_copy(true)

@@ -14,8 +14,8 @@ mod x86_64_unknown_linux_gnu;
 mod x86_64_unknown_linux_musl;
 
 use crate::{
-    cargo_env, env_var_to_bool, out_dir, target, target_arch, target_os, target_vendor,
-    test_command, OutputLibType,
+    cargo_env, env_var_to_bool, execute_command, out_dir, target, target_arch, target_os,
+    target_vendor, OutputLibType,
 };
 use std::path::PathBuf;
 
@@ -221,7 +221,7 @@ impl CcBuilder {
             .map(std::ffi::OsString::as_os_str)
             .collect();
         let memcmp_compile_result =
-            test_command(memcmp_compiler.path().as_os_str(), memcmp_args.as_slice());
+            execute_command(memcmp_compiler.path().as_os_str(), memcmp_args.as_slice());
         assert!(
             memcmp_compile_result.status,
             "COMPILER: {:?}\
@@ -240,7 +240,7 @@ impl CcBuilder {
 
         // We can only execute the binary when the host and target platforms match.
         if cargo_env("HOST") == target() {
-            let result = test_command(exec_path.as_os_str(), &[]);
+            let result = execute_command(exec_path.as_os_str(), &[]);
             assert!(
                 result.status,
                 "Your compiler ({}) is not supported due to a memcmp related bug reported in \

@@ -1,6 +1,6 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0 OR ISC
-// Tue Apr 16 16:46:43 UTC 2024
+// Tue Apr 23 13:29:48 UTC 2024
 
 use crate::cc_builder::Library;
 
@@ -186,6 +186,29 @@ pub(super) const CRYPTO_LIBRARY: Library = Library {
         "crypto/x509/t_req.c",
         "crypto/x509/t_x509.c",
         "crypto/x509/t_x509a.c",
+        "crypto/x509/v3_akey.c",
+        "crypto/x509/v3_akeya.c",
+        "crypto/x509/v3_alt.c",
+        "crypto/x509/v3_bcons.c",
+        "crypto/x509/v3_bitst.c",
+        "crypto/x509/v3_conf.c",
+        "crypto/x509/v3_cpols.c",
+        "crypto/x509/v3_crld.c",
+        "crypto/x509/v3_enum.c",
+        "crypto/x509/v3_extku.c",
+        "crypto/x509/v3_genn.c",
+        "crypto/x509/v3_ia5.c",
+        "crypto/x509/v3_info.c",
+        "crypto/x509/v3_int.c",
+        "crypto/x509/v3_lib.c",
+        "crypto/x509/v3_ncons.c",
+        "crypto/x509/v3_ocsp.c",
+        "crypto/x509/v3_pcons.c",
+        "crypto/x509/v3_pmaps.c",
+        "crypto/x509/v3_prn.c",
+        "crypto/x509/v3_purp.c",
+        "crypto/x509/v3_skey.c",
+        "crypto/x509/v3_utl.c",
         "crypto/x509/x509.c",
         "crypto/x509/x509_att.c",
         "crypto/x509/x509_cmp.c",
@@ -218,29 +241,6 @@ pub(super) const CRYPTO_LIBRARY: Library = Library {
         "crypto/x509/x_val.c",
         "crypto/x509/x_x509.c",
         "crypto/x509/x_x509a.c",
-        "crypto/x509v3/v3_akey.c",
-        "crypto/x509v3/v3_akeya.c",
-        "crypto/x509v3/v3_alt.c",
-        "crypto/x509v3/v3_bcons.c",
-        "crypto/x509v3/v3_bitst.c",
-        "crypto/x509v3/v3_conf.c",
-        "crypto/x509v3/v3_cpols.c",
-        "crypto/x509v3/v3_crld.c",
-        "crypto/x509v3/v3_enum.c",
-        "crypto/x509v3/v3_extku.c",
-        "crypto/x509v3/v3_genn.c",
-        "crypto/x509v3/v3_ia5.c",
-        "crypto/x509v3/v3_info.c",
-        "crypto/x509v3/v3_int.c",
-        "crypto/x509v3/v3_lib.c",
-        "crypto/x509v3/v3_ncons.c",
-        "crypto/x509v3/v3_ocsp.c",
-        "crypto/x509v3/v3_pcons.c",
-        "crypto/x509v3/v3_pmaps.c",
-        "crypto/x509v3/v3_prn.c",
-        "crypto/x509v3/v3_purp.c",
-        "crypto/x509v3/v3_skey.c",
-        "crypto/x509v3/v3_utl.c",
         "generated-src/err_data.c",
         "generated-src/ios-aarch64/crypto/chacha/chacha-armv8.S",
         "generated-src/ios-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",

@@ -1,6 +1,6 @@
 // Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0 OR ISC
-// Tue Apr 16 16:48:11 UTC 2024
+// Tue Apr 23 13:33:24 UTC 2024
 
 use crate::cc_builder::Library;
 
@@ -198,6 +198,29 @@ pub(super) const CRYPTO_LIBRARY: Library = Library {
         "crypto/x509/t_req.c",
         "crypto/x509/t_x509.c",
         "crypto/x509/t_x509a.c",
+        "crypto/x509/v3_akey.c",
+        "crypto/x509/v3_akeya.c",
+        "crypto/x509/v3_alt.c",
+        "crypto/x509/v3_bcons.c",
+        "crypto/x509/v3_bitst.c",
+        "crypto/x509/v3_conf.c",
+        "crypto/x509/v3_cpols.c",
+        "crypto/x509/v3_crld.c",
+        "crypto/x509/v3_enum.c",
+        "crypto/x509/v3_extku.c",
+        "crypto/x509/v3_genn.c",
+        "crypto/x509/v3_ia5.c",
+        "crypto/x509/v3_info.c",
+        "crypto/x509/v3_int.c",
+        "crypto/x509/v3_lib.c",
+        "crypto/x509/v3_ncons.c",
+        "crypto/x509/v3_ocsp.c",
+        "crypto/x509/v3_pcons.c",
+        "crypto/x509/v3_pmaps.c",
+        "crypto/x509/v3_prn.c",
+        "crypto/x509/v3_purp.c",
+        "crypto/x509/v3_skey.c",
+        "crypto/x509/v3_utl.c",
         "crypto/x509/x509.c",
         "crypto/x509/x509_att.c",
         "crypto/x509/x509_cmp.c",
@@ -230,29 +253,6 @@ pub(super) const CRYPTO_LIBRARY: Library = Library {
         "crypto/x509/x_val.c",
         "crypto/x509/x_x509.c",
         "crypto/x509/x_x509a.c",
-        "crypto/x509v3/v3_akey.c",
-        "crypto/x509v3/v3_akeya.c",
-        "crypto/x509v3/v3_alt.c",
-        "crypto/x509v3/v3_bcons.c",
-        "crypto/x509v3/v3_bitst.c",
-        "crypto/x509v3/v3_conf.c",
-        "crypto/x509v3/v3_cpols.c",
-        "crypto/x509v3/v3_crld.c",
-        "crypto/x509v3/v3_enum.c",
-        "crypto/x509v3/v3_extku.c",
-        "crypto/x509v3/v3_genn.c",
-        "crypto/x509v3/v3_ia5.c",
-        "crypto/x509v3/v3_info.c",
-        "crypto/x509v3/v3_int.c",
-        "crypto/x509v3/v3_lib.c",
-        "crypto/x509v3/v3_ncons.c",
-        "crypto/x509v3/v3_ocsp.c",
-        "crypto/x509v3/v3_pcons.c",
-        "crypto/x509v3/v3_pmaps.c",
-        "crypto/x509v3/v3_prn.c",
-        "crypto/x509v3/v3_purp.c",
-        "crypto/x509v3/v3_skey.c",
-        "crypto/x509v3/v3_utl.c",
         "generated-src/err_data.c",
         "generated-src/linux-aarch64/crypto/chacha/chacha-armv8.S",
         "generated-src/linux-aarch64/crypto/cipher_extra/chacha20_poly1305_armv8.S",
+2 −0		.github/workflows/windows-alt.yml
+38 −38		crypto/CMakeLists.txt
+4 −0		crypto/bio/bio_mem.c
+3 −1		crypto/bytestring/cbs.c
+23 −3		crypto/cipher_extra/cipher_test.cc
+1 −1		crypto/decrepit/x509/x509_decrepit.c
+14 −0		crypto/endian_test.cc
+2 −8		crypto/fipsmodule/bn/add.c
+10 −41		crypto/fipsmodule/bn/generic.c
+2 −6		crypto/fipsmodule/bn/mul.c
+19 −2		crypto/fipsmodule/cipher/cipher.c
+7 −6		crypto/fipsmodule/ec/p224-64.c
+2 −2		crypto/fipsmodule/ecdsa/ecdsa.c
+2 −2		crypto/fipsmodule/rsa/rsa.c
+2 −2		crypto/fipsmodule/service_indicator/service_indicator_test.cc
+167 −0		crypto/internal.h
+2 −0		crypto/mem.c
+0 −2		crypto/x509/asn1_gen.c
+0 −3		crypto/x509/by_dir.c
+0 −3		crypto/x509/by_file.c
+0 −0		crypto/x509/ext_dat.h
+125 −27		crypto/x509/internal.h
+0 −2		crypto/x509/policy.c
+1 −1		crypto/x509/t_crl.c
+0 −1		crypto/x509/t_req.c
+0 −1		crypto/x509/t_x509.c
+1 −1		crypto/x509/tab_test.cc
+1 −1		crypto/x509/v3_akey.c
+1 −1		crypto/x509/v3_akeya.c
+1 −2		crypto/x509/v3_alt.c
+1 −1		crypto/x509/v3_bcons.c
+1 −1		crypto/x509/v3_bitst.c
+0 −2		crypto/x509/v3_conf.c
+1 −1		crypto/x509/v3_cpols.c
+1 −2		crypto/x509/v3_crld.c
+1 −1		crypto/x509/v3_enum.c
+1 −1		crypto/x509/v3_extku.c
+1 −1		crypto/x509/v3_genn.c
+1 −1		crypto/x509/v3_ia5.c
+1 −1		crypto/x509/v3_info.c
+1 −1		crypto/x509/v3_int.c
+3 −2		crypto/x509/v3_lib.c
+2 −2		crypto/x509/v3_ncons.c
+1 −1		crypto/x509/v3_ocsp.c
+1 −1		crypto/x509/v3_pcons.c
+1 −1		crypto/x509/v3_pmaps.c
+1 −1		crypto/x509/v3_prn.c
+1 −2		crypto/x509/v3_purp.c
+1 −2		crypto/x509/v3_skey.c
+1 −1		crypto/x509/v3_utl.c
+0 −2		crypto/x509/x509_cmp.c
+0 −1		crypto/x509/x509_ext.c
+6 −85		crypto/x509/x509_lu.c
+1 −1		crypto/x509/x509_req.c
+0 −1		crypto/x509/x509_set.c
+0 −2		crypto/x509/x509_test.cc
+1 −2		crypto/x509/x509_trs.c
+0 −1		crypto/x509/x509_v3.c
+15 −65		crypto/x509/x509_vfy.c
+65 −113		crypto/x509/x509_vpm.c
+0 −1		crypto/x509/x_crl.c
+0 −1		crypto/x509/x_x509.c
+0 −195		crypto/x509v3/internal.h
+1 −1		fuzz/cert.cc
+0 −1		fuzz/conf.cc
+1 −1		include/openssl/base.h
+4 −0		include/openssl/bio.h
+11 −0		include/openssl/mem.h
+18 −34		include/openssl/pem.h
+11 −0		include/openssl/ssl.h
+1,092 −78		include/openssl/x509.h
+16 −1,108		include/openssl/x509v3.h
+124 −0		include/openssl/x509v3_errors.h
+5 −0		ssl/internal.h
+9 −0		ssl/ssl_cipher.cc
+33 −0		ssl/ssl_lib.cc
+77 −1		ssl/ssl_test.cc
+0 −1		ssl/ssl_x509.cc
+12 −5		util/make_errors.go