From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 6 Oct 2026 08:35:28 +0000 (+0200)
Subject: CI: github: test AWS-LC 3.x and 4.x LTS branches
X-Git-Tag: v3.5-dev9~196
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=0866628299b2ff0649b7de5e2cc87778c3da3839;p=haproxy.git

CI: github: test AWS-LC 3.x and 4.x LTS branches

Add the fips-2024-09-27 (3.x) and fips-2025-09-12-lts (4.x) AWS-LC
branches to the VTest matrix for GCC and Clang, including QUIC support.

Resolve each branch head to a commit SHA when generating the matrix
and download the corresponding immutable archive in build-ssl.sh.
Read the AWS-LC version from that commit's header to display readable
job names such as ssl=aws_lc=4.2.0+37341efe.

Generate the SSL cache key from both the job name and SSL source,
retaining the full commit SHA even though the display uses only eight
characters. Builds are reused until the branch advances, and distinct
commits cannot share a cache entry because of a short SHA collision.

Validated branch resolution and version extraction against GitHub,
readable GCC and Clang jobs in development and stable matrices, commit
and tag archive URLs, cache reuse, shell syntax, and git diff --check.
---

diff --git a/.github/matrix.py b/.github/matrix.py
index 5443041a6..01f01ce2a 100755
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -82,6 +82,24 @@ def determine_latest_aws_lc(ssl):
     latest_tag = max(valid_tags, key=aws_lc_version_string_to_num)
     return "AWS_LC_VERSION={}".format(latest_tag[1:])
 
+@functools.lru_cache(5)
+def determine_aws_lc_branch(ssl):
+    branch = ssl.split("=branch-", 1)[1]
+    headers = {}
+    if environ.get("GITHUB_TOKEN") is not None:
+        headers["Authorization"] = "token {}".format(environ.get("GITHUB_TOKEN"))
+    url = "https://api.github.com/repos/aws/aws-lc/commits/{}".format(branch)
+    request = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(request) as response:
+        commit = json.loads(response.read().decode("utf-8"))
+    sha = commit["sha"]
+    url = "https://raw.githubusercontent.com/aws/aws-lc/{}/include/openssl/base.h".format(sha)
+    request = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(request) as response:
+        header = response.read().decode("utf-8")
+    release = re.search(r'^#define AWSLC_VERSION_NUMBER_STRING "([^"]+)"', header, re.MULTILINE).group(1)
+    return "AWS_LC_VERSION=git-{}".format(sha), "AWS_LC_VERSION={}+{}".format(release, sha[:8])
+
 def aws_lc_fips_version_string_to_num(version_string):
     return tuple(map(int, version_string[12:].split('.')))
 
@@ -243,6 +261,8 @@ def main(ref_name):
             "QUICTLS_VERSION=OpenSSL_1_1_1w-quic1",
             "WOLFSSL_VERSION=5.7.0",
             "AWS_LC_VERSION=1.39.0",
+            "AWS_LC_VERSION=branch-fips-2024-09-27",
+            "AWS_LC_VERSION=branch-fips-2025-09-12-lts",
             # "BORINGSSL=yes",
         ]
 
@@ -253,6 +273,7 @@ def main(ref_name):
             ]
 
         for ssl in ssl_versions:
+            ssl_name = None
             flags = ["USE_OPENSSL=1"]
             skipdup=0
             if "WOLFSSL" in ssl:
@@ -262,6 +283,8 @@ def main(ref_name):
             if ssl != "stock":
                 flags.append("SSL_LIB=${HOME}/opt/lib")
                 flags.append("SSL_INC=${HOME}/opt/include")
+            if ssl.startswith("AWS_LC_VERSION=branch-"):
+                ssl, ssl_name = determine_aws_lc_branch(ssl)
             if "LIBRESSL" in ssl and "latest" in ssl:
                 ssl = determine_latest_libressl(ssl)
                 skipdup=1
@@ -293,7 +316,7 @@ def main(ref_name):
 
             matrix.append(
                 {
-                    "name": "{}, {}, ssl={}".format(os, CC, clean_ssl(ssl)),
+                    "name": "{}, {}, ssl={}".format(os, CC, clean_ssl(ssl_name or ssl)),
                     "os": os,
                     "TARGET": TARGET,
                     "CC": CC,
diff --git a/.github/workflows/vtest.yml b/.github/workflows/vtest.yml
index fd546d5a7..74aa89d2b 100644
--- a/.github/workflows/vtest.yml
+++ b/.github/workflows/vtest.yml
@@ -50,12 +50,12 @@ jobs:
         fetch-depth: 100
 
 #
-# Github Action cache key cannot contain comma, so we calculate it based on job name
+# Github Action cache key cannot contain comma, so we calculate it based on job name and SSL source
 #
     - name: Generate cache key
       id: generate-cache-key
       run: |
-        echo "key=$(echo ${{ matrix.name }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
+        echo "key=$(echo ${{ matrix.name }} ${{ matrix.ssl }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
 
     - name: Cache SSL libs
       if: ${{ matrix.ssl && matrix.ssl != 'stock' && matrix.ssl != 'BORINGSSL=yes' && !contains(matrix.ssl, 'QUICTLS') }}
diff --git a/scripts/build-ssl.sh b/scripts/build-ssl.sh
index 3b1ad539f..9c3627c69 100755
--- a/scripts/build-ssl.sh
+++ b/scripts/build-ssl.sh
@@ -136,14 +136,16 @@ build_boringssl () {
 
 download_aws_lc () {
     if [ ! -f "${BUILDSSL_TMPDIR}/aws-lc-${AWS_LC_VERSION}.tar.gz" ]; then
-        if [ "${AWS_LC_VERSION#*FIPS}" != "${AWS_LC_VERSION}" ]; then
-            WGETFILE="${AWS_LC_VERSION}.tar.gz"
+        if [ "${AWS_LC_VERSION%%-*}" = "git" ]; then
+            WGETFILE="${AWS_LC_VERSION#git-}.tar.gz"
+        elif [ "${AWS_LC_VERSION#*FIPS}" != "${AWS_LC_VERSION}" ]; then
+            WGETFILE="refs/tags/${AWS_LC_VERSION}.tar.gz"
         else
-            WGETFILE="v${AWS_LC_VERSION}.tar.gz"
+            WGETFILE="refs/tags/v${AWS_LC_VERSION}.tar.gz"
         fi
 
         wget -q -O "${BUILDSSL_TMPDIR}/aws-lc-${AWS_LC_VERSION}.tar.gz" \
-          "https://github.com/aws/aws-lc/archive/refs/tags/${WGETFILE}"
+          "https://github.com/aws/aws-lc/archive/${WGETFILE}"
     fi
 }