Skip to content

Add openssl version -a and -p flag support#3092

Open
geedo0 wants to merge 3 commits intoaws:mainfrom
geedo0:version-a
Open

Add openssl version -a and -p flag support#3092
geedo0 wants to merge 3 commits intoaws:mainfrom
geedo0:version-a

Conversation

@geedo0
Copy link
Contributor

@geedo0 geedo0 commented Mar 11, 2026

Description of changes:

For compatibility, we should implement these CLI flags to prevent certain test scripts from erroring out.

Add -a (all) and -p (platform) boolean flags to the version subcommand:

  • No flags: print version line only (preserves existing behavior)
  • -a: print version, built on, platform, compiler, OPENSSLDIR
  • -p: print platform line only

Call-outs:

This doesn't actually print anything useful, but it does call the OpenSSL APIs and prints the stub strings that we had in place. If I had to hazard a guess this was either an intentional attempt to avoid leaking implementation details or they were lazy (Occam's razor suggests the latter).

Testing:

How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer?

# Sample outputs
➜  aws-lc git:(version-a) ✗ ./build/tool-openssl/openssl version -p
platform: n/a
➜  aws-lc git:(version-a) ✗ ./build/tool-openssl/openssl version -a
OpenSSL 1.1.1 (compatible; AWS-LC 1.69.0)
built on: n/a
platform: n/a
compiler: n/a
OPENSSLDIR: n/a

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

@codecov-commenter
Copy link

codecov-commenter commented Mar 11, 2026

Codecov Report

❌ Patch coverage is 0% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.20%. Comparing base (c15e28d) to head (4b0f863).

Files with missing lines Patch % Lines
tool-openssl/version.cc 0.00% 19 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3092   +/-   ##
=======================================
  Coverage   78.20%   78.20%           
=======================================
  Files         689      689           
  Lines      122048   122066   +18     
  Branches    17030    17032    +2     
=======================================
+ Hits        95446    95461   +15     
- Misses      25698    25702    +4     
+ Partials      904      903    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@geedo0 geedo0 marked this pull request as ready for review March 12, 2026 20:10
@geedo0 geedo0 requested a review from a team as a code owner March 12, 2026 20:10
@geedo0 geedo0 enabled auto-merge (squash) March 12, 2026 20:11
Copy link
Contributor

@justsmth justsmth left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Out of scope, but this might be a rare PR for which we have motivation to provide a proper implementation of OpenSSL_version

const char *OpenSSL_version(int which) {
  switch (which) {
    case OPENSSL_VERSION:
      return AWSLC_VERSION_STRING;
    case OPENSSL_CFLAGS:
      return "compiler: n/a";
    case OPENSSL_BUILT_ON:
      return "built on: n/a";
    case OPENSSL_PLATFORM:
      return "platform: n/a";
    case OPENSSL_DIR:
      return "OPENSSLDIR: n/a";
    default:
      return "not available";
  }
}

testssl.sh validates its openssl binary by running 'openssl version -a'
and checking for exit code 0. The AWS-LC openssl shim previously rejected
all flags with 'Unknown flag', causing testssl.sh to error out.

Add -a (all) and -p (platform) boolean flags to the version subcommand:
- No flags: print version line only (preserves existing behavior)
- -a: print version, built on, platform, compiler, OPENSSLDIR
- -p: print platform line only
@geedo0
Copy link
Contributor Author

geedo0 commented Mar 20, 2026

Out of scope, but this might be a rare PR for which we have motivation to provide a proper implementation of OpenSSL_version

We still have no motivation here beyond aesthetics. The compatibility issue I'm addressing merely needs these commands to exit without error. Implementing these would require plumbing down all the values from CMake into the source. I looked into the original BoringSSL commit that added these stubs and they similarly didn't really care to do much beyond just preventing things from failing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants