ci: re-enable gcc-14 + FIPS build in gcc-14-hardened job - #3428
Open
dougch wants to merge 6 commits into
Open
Conversation
The Build Project and Run tests steps in the gcc-14-hardened job have been skipped when gccversion=14 and fips=1 since aws#1622 (2024-06), pending resolution of the delocator issue tracked in aws#2977. That fix landed 2026-02 but these CI guards were never removed. Consequence: the fips=1 variant is a no-op that reports green. Removing the two 'if:' guards so the gcc-14/fips=1 variant actually builds and runs tests. Filing as draft because this may surface latent -Werror=stringop-overflow false-positives under -fhardened (implies -D_FORTIFY_SOURCE=2); those would need the same push/ignored/pop pattern used in aws#3201.
Contributor
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3428 +/- ##
==========================================
+ Coverage 78.42% 78.47% +0.04%
==========================================
Files 696 698 +2
Lines 124513 124583 +70
Branches 17282 17288 +6
==========================================
+ Hits 97650 97764 +114
+ Misses 25939 25891 -48
- Partials 924 928 +4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
The gcc-14-hardened job installs the default gcc-14 on ubuntu-24.04, which is 14.2. New -Wstringop-overflow analysis in 14.3+ can produce warnings that 14.2 doesn't fire, so a 14.2-only public gate can miss build breaks that surface downstream on 14.4. Switch this job to the official gcc:14.4 Docker image so the public gate exercises the same GCC minor as recent downstream builds. The container is Debian-based; add a small step to install ninja-build and print gcc --version for future audits.
justsmth
reviewed
Aug 17, 2026
justsmth
left a comment
justsmth
left a comment
Collaborator
There was a problem hiding this comment.
- The jobs are now failing with
Error: spawn cmake ENOENT - This compiler error actually occurs with GCC 14.4.0 for both the FIPS and non-FIPS builds.
…on-fatal in tests The gcc:14.4 image ships neither cmake nor ninja-build, and perl is only present transitively, so the gcc-14-hardened job died at 'Setup CMake' with spawn cmake ENOENT. Install all three explicitly (Go comes from setup-go) and set GOFLAGS=-buildvcs=false like the other container jobs. GCC 14.4 also surfaces a -Wstringop-overflow false positive in x509_test.cc (single-element vector init in libstdc++), fatal under the blanket -Werror. Demote GCC's object-access warnings to non-fatal for test targets only via PUBLIC options on boringssl_gtest; library targets keep -Werror.
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:32 — with 
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
had a problem deploying
to
manual-approval
August 17, 2026 14:33 — with
GitHub Actions
Error
GitHub Actions
Error
justsmth
previously approved these changes
Aug 17, 2026
Comment on lines
530
to
533
| matrix: | ||
| gccversion: | ||
| - "14" | ||
| fips: |
Collaborator
There was a problem hiding this comment.
NP: I'm not sure this gccversion is still used now that we have a container.
justsmth
approved these changes
Aug 18, 2026
dougch
marked this pull request as ready for review
August 18, 2026 16:56
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-enable the
Build ProjectandRun testssteps in thegcc-14-hardenedCI job'sfips=1matrix variant. These steps have been guarded off since #1622 (2024-06), pending resolution of the delocator issue tracked in #2977. That fix landed 2026-02, but the CI guards were never removed.Testing
-Werror=stringop-overflowfalse-positives under-fhardened(which implies-D_FORTIFY_SOURCE=2); those would need the same#pragma GCC diagnostic push / ignored / poppattern used in Silence two stringop-overflow false-positives #3201.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.