From: William Lallemand <wlallemand@irq6.net>
Date: Tue, 10 Nov 2026 13:36:05 +0000 (+0000)
Subject: CI: temporarily disable AWS-LC 3.x (fips-2024-09-27)
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D/1?a=commitdiff_plain;h=9fc468fe5d90e155cd86ed6b51430fedc04e02bf;p=haproxy.git

CI: temporarily disable AWS-LC 3.x (fips-2024-09-27)

AWS-LC 3.x fails to build with recent GCC/glibc due to a
-Wdiscarded-qualifiers error in OPENSSL_memchr (C23 made memchr
const-correct, and glibc 2.41+ applies this even in C11 mode).

The fix exists upstream (aws/aws-lc#3008) but has not been
cherry-picked to the fips-2024-09-27 branch yet.

See https://github.com/aws/aws-lc/issues/3759
---

diff --git a/.github/matrix.py b/.github/matrix.py
index 1d452d02d..f7d5819e0 100755
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -272,7 +272,8 @@ def main(ref_name):
             "OPENSSL_VERSION=1.1.1s",
             "OPENSSL_VERSION=3.5.1",
             "QUICTLS_VERSION=OpenSSL_1_1_1w-quic1",
-            "AWS_LC_VERSION=branch-fips-2024-09-27",
+            # disabled: aws-lc 3.x compile error, see https://github.com/aws/aws-lc/issues/3759
+            # "AWS_LC_VERSION=branch-fips-2024-09-27",
             "AWS_LC_VERSION=branch-fips-2025-09-12-lts",
             # "BORINGSSL=yes",
         ]
diff --git a/.github/workflows/aws-lc-fips.yml b/.github/workflows/aws-lc-fips.yml
index 8b31b04b7..212c481e7 100644
--- a/.github/workflows/aws-lc-fips.yml
+++ b/.github/workflows/aws-lc-fips.yml
@@ -15,14 +15,14 @@ jobs:
     strategy:
       matrix:
         include:
-          # Same AWS-LC sources as in the VTest job, built in FIPS mode
-          - name: AWS-LC 3.x (FIPS)
-            ssl: AWS_LC_VERSION=branch-fips-2024-09-27
-            # Shared by runs-on and the cache key for all three jobs.
-            os: &runner ubuntu-latest
+          # disabled: aws-lc 3.x compile error, see https://github.com/aws/aws-lc/issues/3759
+          # - name: AWS-LC 3.x (FIPS)
+          #   ssl: AWS_LC_VERSION=branch-fips-2024-09-27
+          #   # Shared by runs-on and the cache key for all three jobs.
+          #   os: &runner ubuntu-latest
           - name: AWS-LC 4.x (FIPS)
             ssl: AWS_LC_VERSION=branch-fips-2025-09-12-lts
-            os: *runner
+            os: &runner ubuntu-latest
           - name: AWS-LC latest (FIPS)
             ssl: AWS_LC_VERSION=latest
             os: *runner