Install OpenSSL-compat libcrypto.pc and libssl.pc with the shim - #3370
Open
justsmth wants to merge 3 commits into
Open
Install OpenSSL-compat libcrypto.pc and libssl.pc with the shim#3370justsmth wants to merge 3 commits into
justsmth wants to merge 3 commits into
Conversation
Contributor
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3370 +/- ##
==========================================
- Coverage 78.44% 78.19% -0.25%
==========================================
Files 695 695
Lines 124223 124220 -3
Branches 17267 17263 -4
==========================================
- Hits 97451 97139 -312
- Misses 25850 26158 +308
- Partials 922 923 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
justsmth
force-pushed
the
shim-compat-pkgconfig
branch
from
July 27, 2026 13:44
ab11829 to
96c53a8
Compare
OpenSSL installs three pkg-config files: openssl.pc, libcrypto.pc and libssl.pc. pkg-config resolves packages by filename, so third-party .pc files declaring 'Requires.private: libcrypto' (libssh2, among others) fail to resolve when only openssl.pc exists. Install compatibility libcrypto.pc and libssl.pc whenever the OpenSSL shim is enabled and the libraries carry the -awslc suffix. The compatibility files mirror genuine OpenSSL semantics: includedir is the plain include/ directory (where the shim installs its include/openssl symlink) rather than the cohabitant include/aws-lc directory, so the cohabitant include path does not leak into consumers resolving OpenSSL through the compat names. Libs still reference the suffixed libraries. openssl.pc now requires the unsuffixed package names, matching genuine OpenSSL.
…LD_LIBSSL, test default-build pc files - Trim the OpenSSL compat pc-file comment in CMakeLists.txt - Skip libssl.pc (primary and compat) when BUILD_LIBSSL=OFF and drop libssl from the product pc Requires line so crypto-only builds do not reference a package that is not installed - Extend run_install_shared_and_static.sh to assert the pkg-config files installed by default (non-dist-pkg) Linux builds, covering the shared config that gains the OpenSSL-named compat files
justsmth
force-pushed
the
shim-compat-pkgconfig
branch
from
August 5, 2026 13:09
96c53a8 to
79cfb50
Compare
geedo0
approved these changes
Aug 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes:
OpenSSL installs three pkg-config files:
openssl.pc,libcrypto.pc, andlibssl.pc; the OpenSSL shim currently installs onlyopenssl.pc. Since pkg-config resolves packages by filename, third-party packages whose.pcfiles declareRequires.private: libcrypto(libssh2, among others) fail to resolve against a shim install -- sometimes silently, e.g. the Rust cratelibssh2-sysfalls back to its vendored libssh2 instead of using the shim.This installs compat
libcrypto.pcandlibssl.pcwhenever the shim is enabled and the libraries carry the-awslcsuffix. The compat files are generated with OpenSSL-identical content rather than symlinked to the suffixed pc files: the suffixed files'Cflags: -I.../include/aws-lcleaks transitively into every consumer oflibcrypto, and that extra path can displace other packages' include dirs in toolchains that treat pkg-config include paths as single-valued (cargo links-metadata is last-wins, which breakslibgit2-sysvialibssh2-sys). The compat files instead pointincludedirat the plaininclude/directory, where the shim already installs itsinclude/opensslsymlink.Libs:still references the suffixed libraries.Call-outs:
openssl.pcunder the shim now hasRequires: libssl libcryptoinstead of the suffixed names, matching genuine OpenSSL and picking up the compat include dir.ENABLE_DIST_PKG) also enable the shim with suffixed libraries, so they gain the compat pc files too -- consistent with those builds already installing thelibcrypto.so/libssl.sosymlinks andopenssl.pc.BUILD_LIBSSL=OFFbuilds no longer installlibssl.pc(previously a dangling one was installed) and droplibsslfrom theRequires:line ofaws-lc.pc/openssl.pc.Testing:
Extended
tests/ci/run_dist_pkg_install_tests.sh: with the shim enabled, asserts the compat files exist, all three OpenSSL names resolve without leaking the cohabitant include dir, the compile-and-run smoke test passes against thelibcryptoname, and a synthetic consumer pc file withRequires.private: libcryptoresolves (the libssh2 pattern, without needing libssh2). With the shim disabled, asserts none of the three names are installed.Also extended
tests/ci/run_install_shared_and_static.shto assert the pc files installed by default (non-dist-pkg) Linux builds, covering the shared config that newly gains the compat files.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.