CI: github: test AWS-LC 3.x and 4.x LTS branches

Add the fips-2024-09-27 (3.x) and fips-2025-09-12-lts (4.x) AWS-LC
branches to the VTest matrix for GCC and Clang, including QUIC support.

Resolve each branch head to a commit SHA when generating the matrix
and download the corresponding immutable archive in build-ssl.sh.
Read the AWS-LC version from that commit's header to display readable
job names such as ssl=aws_lc=4.2.0+37341efe.

Generate the SSL cache key from both the job name and SSL source,
retaining the full commit SHA even though the display uses only eight
characters. Builds are reused until the branch advances, and distinct
commits cannot share a cache entry because of a short SHA collision.

Validated branch resolution and version extraction against GitHub,
readable GCC and Clang jobs in development and stable matrices, commit
and tag archive URLs, cache reuse, shell syntax, and git diff --check.

diff --git a/.github/matrix.py b/.github/matrix.py
index 5443041a6aefcbb7feb4f69dd70363849df927f0..01f01ce2a4f065a8b19c5ccf9e94dbb7dc6067c1 100755 (executable)
--- a/.github/matrix.py
+++ b/.github/matrix.py
@@ -82,6 +82,24 @@ def determine_latest_aws_lc(ssl):
     latest_tag = max(valid_tags, key=aws_lc_version_string_to_num)
     return "AWS_LC_VERSION={}".format(latest_tag[1:])
 
+@functools.lru_cache(5)
+def determine_aws_lc_branch(ssl):
+    branch = ssl.split("=branch-", 1)[1]
+    headers = {}
+    if environ.get("GITHUB_TOKEN") is not None:
+        headers["Authorization"] = "token {}".format(environ.get("GITHUB_TOKEN"))
+    url = "https://api.github.com/repos/aws/aws-lc/commits/{}".format(branch)
+    request = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(request) as response:
+        commit = json.loads(response.read().decode("utf-8"))
+    sha = commit["sha"]
+    url = "https://raw.githubusercontent.com/aws/aws-lc/{}/include/openssl/base.h".format(sha)
+    request = urllib.request.Request(url, headers=headers)
+    with urllib.request.urlopen(request) as response:
+        header = response.read().decode("utf-8")
+    release = re.search(r'^#define AWSLC_VERSION_NUMBER_STRING "([^"]+)"', header, re.MULTILINE).group(1)
+    return "AWS_LC_VERSION=git-{}".format(sha), "AWS_LC_VERSION={}+{}".format(release, sha[:8])
+
 def aws_lc_fips_version_string_to_num(version_string):
     return tuple(map(int, version_string[12:].split('.')))
 
@@ -243,6 +261,8 @@ def main(ref_name):
             "QUICTLS_VERSION=OpenSSL_1_1_1w-quic1",
             "WOLFSSL_VERSION=5.7.0",
             "AWS_LC_VERSION=1.39.0",
+            "AWS_LC_VERSION=branch-fips-2024-09-27",
+            "AWS_LC_VERSION=branch-fips-2025-09-12-lts",
             # "BORINGSSL=yes",
         ]
 
@@ -253,6 +273,7 @@ def main(ref_name):
             ]
 
         for ssl in ssl_versions:
+            ssl_name = None
             flags = ["USE_OPENSSL=1"]
             skipdup=0
             if "WOLFSSL" in ssl:
@@ -262,6 +283,8 @@ def main(ref_name):
             if ssl != "stock":
                 flags.append("SSL_LIB=${HOME}/opt/lib")
                 flags.append("SSL_INC=${HOME}/opt/include")
+            if ssl.startswith("AWS_LC_VERSION=branch-"):
+                ssl, ssl_name = determine_aws_lc_branch(ssl)
             if "LIBRESSL" in ssl and "latest" in ssl:
                 ssl = determine_latest_libressl(ssl)
                 skipdup=1
@@ -293,7 +316,7 @@ def main(ref_name):
 
             matrix.append(
                 {
-                    "name": "{}, {}, ssl={}".format(os, CC, clean_ssl(ssl)),
+                    "name": "{}, {}, ssl={}".format(os, CC, clean_ssl(ssl_name or ssl)),
                     "os": os,
                     "TARGET": TARGET,
                     "CC": CC,

diff --git a/.github/workflows/vtest.yml b/.github/workflows/vtest.yml
index fd546d5a7d885f561c76ccfefeecf2440ecc17cf..74aa89d2b19e0fa51b4da5d5e6102c921b405c68 100644 (file)
--- a/.github/workflows/vtest.yml
+++ b/.github/workflows/vtest.yml
@@ -50,12 +50,12 @@ jobs:
         fetch-depth: 100
 
 #
-# Github Action cache key cannot contain comma, so we calculate it based on job name
+# Github Action cache key cannot contain comma, so we calculate it based on job name and SSL source
 #
     - name: Generate cache key
       id: generate-cache-key
       run: |
-        echo "key=$(echo ${{ matrix.name }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
+        echo "key=$(echo ${{ matrix.name }} ${{ matrix.ssl }} | sha256sum | awk '{print $1}')" >> $GITHUB_OUTPUT
 
     - name: Cache SSL libs
       if: ${{ matrix.ssl && matrix.ssl != 'stock' && matrix.ssl != 'BORINGSSL=yes' && !contains(matrix.ssl, 'QUICTLS') }}

diff --git a/scripts/build-ssl.sh b/scripts/build-ssl.sh
index 3b1ad539f170809e66c26d985b236f574cf6e775..9c3627c6926ed977f5ef62256b438a59d652340e 100755 (executable)
--- a/scripts/build-ssl.sh
+++ b/scripts/build-ssl.sh
@@ -136,14 +136,16 @@ build_boringssl () {
 
 download_aws_lc () {
     if [ ! -f "${BUILDSSL_TMPDIR}/aws-lc-${AWS_LC_VERSION}.tar.gz" ]; then
-        if [ "${AWS_LC_VERSION#*FIPS}" != "${AWS_LC_VERSION}" ]; then
-            WGETFILE="${AWS_LC_VERSION}.tar.gz"
+        if [ "${AWS_LC_VERSION%%-*}" = "git" ]; then
+            WGETFILE="${AWS_LC_VERSION#git-}.tar.gz"
+        elif [ "${AWS_LC_VERSION#*FIPS}" != "${AWS_LC_VERSION}" ]; then
+            WGETFILE="refs/tags/${AWS_LC_VERSION}.tar.gz"
         else
-            WGETFILE="v${AWS_LC_VERSION}.tar.gz"
+            WGETFILE="refs/tags/v${AWS_LC_VERSION}.tar.gz"
         fi
 
         wget -q -O "${BUILDSSL_TMPDIR}/aws-lc-${AWS_LC_VERSION}.tar.gz" \
-          "https://github.com/aws/aws-lc/archive/refs/tags/${WGETFILE}"
+          "https://github.com/aws/aws-lc/archive/${WGETFILE}"
     fi
 }