CI: temporarily disable AWS-LC 3.x (fips-2024-09-27)

AWS-LC 3.x fails to build with recent GCC/glibc due to a
-Wdiscarded-qualifiers error in OPENSSL_memchr (C23 made memchr
const-correct, and glibc 2.41+ applies this even in C11 mode).

The fix exists upstream (aws/aws-lc#3008) but has not been
cherry-picked to the fips-2024-09-27 branch yet.

See https://github.com/aws/aws-lc/issues/3759

diff --git a/.github/matrix.py b/.github/matrix.py
index 1d452d02d6c4a48c178d5517ebcfc14ca5093e97..f7d5819e01d691cdad8c5c2630e42541bcf27a6e 100755 (executable)
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -272,7 +272,8 @@ def main(ref_name):
             "OPENSSL_VERSION=1.1.1s",
             "OPENSSL_VERSION=3.5.1",
             "QUICTLS_VERSION=OpenSSL_1_1_1w-quic1",
-            "AWS_LC_VERSION=branch-fips-2024-09-27",
+            # disabled: aws-lc 3.x compile error, see https://github.com/aws/aws-lc/issues/3759
+            # "AWS_LC_VERSION=branch-fips-2024-09-27",
             "AWS_LC_VERSION=branch-fips-2025-09-12-lts",
             # "BORINGSSL=yes",
         ]

diff --git a/.github/workflows/aws-lc-fips.yml b/.github/workflows/aws-lc-fips.yml
index 8b31b04b7fadbc8b7f93787540f7d25cbcf9ec2b..212c481e795d7d899ecb221e0965a9096d762390 100644 (file)
--- a/.github/workflows/aws-lc-fips.yml
+++ b/.github/workflows/aws-lc-fips.yml
@@ -15,14 +15,14 @@ jobs:
     strategy:
       matrix:
         include:
-          # Same AWS-LC sources as in the VTest job, built in FIPS mode
-          - name: AWS-LC 3.x (FIPS)
-            ssl: AWS_LC_VERSION=branch-fips-2024-09-27
-            # Shared by runs-on and the cache key for all three jobs.
-            os: &runner ubuntu-latest
+          # disabled: aws-lc 3.x compile error, see https://github.com/aws/aws-lc/issues/3759
+          # - name: AWS-LC 3.x (FIPS)
+          #   ssl: AWS_LC_VERSION=branch-fips-2024-09-27
+          #   # Shared by runs-on and the cache key for all three jobs.
+          #   os: &runner ubuntu-latest
           - name: AWS-LC 4.x (FIPS)
             ssl: AWS_LC_VERSION=branch-fips-2025-09-12-lts
-            os: *runner
+            os: &runner ubuntu-latest
           - name: AWS-LC latest (FIPS)
             ssl: AWS_LC_VERSION=latest
             os: *runner