Skip to content

Install OpenSSL-compat libcrypto.pc and libssl.pc with the shim - #3370

Open
justsmth wants to merge 3 commits into
aws:mainfrom
justsmth:shim-compat-pkgconfig
Open

Install OpenSSL-compat libcrypto.pc and libssl.pc with the shim#3370
justsmth wants to merge 3 commits into
aws:mainfrom
justsmth:shim-compat-pkgconfig

Conversation

@justsmth

@justsmth justsmth commented Jul 23, 2026

Copy link
Copy Markdown
Collaborator

Description of changes:

OpenSSL installs three pkg-config files: openssl.pc, libcrypto.pc, and libssl.pc; the OpenSSL shim currently installs only openssl.pc. Since pkg-config resolves packages by filename, third-party packages whose .pc files declare Requires.private: libcrypto (libssh2, among others) fail to resolve against a shim install -- sometimes silently, e.g. the Rust crate libssh2-sys falls back to its vendored libssh2 instead of using the shim.

This installs compat libcrypto.pc and libssl.pc whenever the shim is enabled and the libraries carry the -awslc suffix. The compat files are generated with OpenSSL-identical content rather than symlinked to the suffixed pc files: the suffixed files' Cflags: -I.../include/aws-lc leaks transitively into every consumer of libcrypto, and that extra path can displace other packages' include dirs in toolchains that treat pkg-config include paths as single-valued (cargo links-metadata is last-wins, which breaks libgit2-sys via libssh2-sys). The compat files instead point includedir at the plain include/ directory, where the shim already installs its include/openssl symlink. Libs: still references the suffixed libraries.

Call-outs:

  • openssl.pc under the shim now has Requires: libssl libcrypto instead of the suffixed names, matching genuine OpenSSL and picking up the compat include dir.
  • Default Linux shared builds (no ENABLE_DIST_PKG) also enable the shim with suffixed libraries, so they gain the compat pc files too -- consistent with those builds already installing the libcrypto.so/libssl.so symlinks and openssl.pc.
  • When libraries are unsuffixed (macOS, Windows, default static), the primary pc files already have the OpenSSL filenames and output is byte-identical to before.
  • New in this revision: BUILD_LIBSSL=OFF builds no longer install libssl.pc (previously a dangling one was installed) and drop libssl from the Requires: line of aws-lc.pc/openssl.pc.

Testing:

Extended tests/ci/run_dist_pkg_install_tests.sh: with the shim enabled, asserts the compat files exist, all three OpenSSL names resolve without leaking the cohabitant include dir, the compile-and-run smoke test passes against the libcrypto name, and a synthetic consumer pc file with Requires.private: libcrypto resolves (the libssh2 pattern, without needing libssh2). With the shim disabled, asserts none of the three names are installed.

Also extended tests/ci/run_install_shared_and_static.sh to assert the pc files installed by default (non-dist-pkg) Linux builds, covering the shared config that newly gains the compat files.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@github-actions

Copy link
Copy Markdown
Contributor

🔒 Security ReviewView Report

Please review before merging.

@codecov-commenter

codecov-commenter commented Jul 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.19%. Comparing base (8cca33b) to head (3c5eed8).

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3370      +/-   ##
==========================================
- Coverage   78.44%   78.19%   -0.25%     
==========================================
  Files         695      695              
  Lines      124223   124220       -3     
  Branches    17267    17263       -4     
==========================================
- Hits        97451    97139     -312     
- Misses      25850    26158     +308     
- Partials      922      923       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

OpenSSL installs three pkg-config files: openssl.pc, libcrypto.pc and
libssl.pc. pkg-config resolves packages by filename, so third-party .pc
files declaring 'Requires.private: libcrypto' (libssh2, among others)
fail to resolve when only openssl.pc exists. Install compatibility
libcrypto.pc and libssl.pc whenever the OpenSSL shim is enabled and the
libraries carry the -awslc suffix.

The compatibility files mirror genuine OpenSSL semantics: includedir is
the plain include/ directory (where the shim installs its
include/openssl symlink) rather than the cohabitant include/aws-lc
directory, so the cohabitant include path does not leak into consumers
resolving OpenSSL through the compat names. Libs still reference the
suffixed libraries. openssl.pc now requires the unsuffixed package
names, matching genuine OpenSSL.
…LD_LIBSSL, test default-build pc files

- Trim the OpenSSL compat pc-file comment in CMakeLists.txt
- Skip libssl.pc (primary and compat) when BUILD_LIBSSL=OFF and drop
  libssl from the product pc Requires line so crypto-only builds do not
  reference a package that is not installed
- Extend run_install_shared_and_static.sh to assert the pkg-config
  files installed by default (non-dist-pkg) Linux builds, covering the
  shared config that gains the OpenSSL-named compat files
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants