Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #3092 +/- ##
=======================================
Coverage 78.20% 78.20%
=======================================
Files 689 689
Lines 122048 122066 +18
Branches 17030 17032 +2
=======================================
+ Hits 95446 95461 +15
- Misses 25698 25702 +4
+ Partials 904 903 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Out of scope, but this might be a rare PR for which we have motivation to provide a proper implementation of OpenSSL_version
const char *OpenSSL_version(int which) {
switch (which) {
case OPENSSL_VERSION:
return AWSLC_VERSION_STRING;
case OPENSSL_CFLAGS:
return "compiler: n/a";
case OPENSSL_BUILT_ON:
return "built on: n/a";
case OPENSSL_PLATFORM:
return "platform: n/a";
case OPENSSL_DIR:
return "OPENSSLDIR: n/a";
default:
return "not available";
}
}
testssl.sh validates its openssl binary by running 'openssl version -a' and checking for exit code 0. The AWS-LC openssl shim previously rejected all flags with 'Unknown flag', causing testssl.sh to error out. Add -a (all) and -p (platform) boolean flags to the version subcommand: - No flags: print version line only (preserves existing behavior) - -a: print version, built on, platform, compiler, OPENSSLDIR - -p: print platform line only
We still have no motivation here beyond aesthetics. The compatibility issue I'm addressing merely needs these commands to exit without error. Implementing these would require plumbing down all the values from CMake into the source. I looked into the original BoringSSL commit that added these stubs and they similarly didn't really care to do much beyond just preventing things from failing. |
Description of changes:
For compatibility, we should implement these CLI flags to prevent certain test scripts from erroring out.
Add -a (all) and -p (platform) boolean flags to the version subcommand:
Call-outs:
This doesn't actually print anything useful, but it does call the OpenSSL APIs and prints the stub strings that we had in place. If I had to hazard a guess this was either an intentional attempt to avoid leaking implementation details or they were lazy (Occam's razor suggests the latter).
Testing:
How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer?
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.