RFC: Separate out the OpenSSL shim from AWS-LC #2852
Draft
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issues:
Part of addressing #1098
Description of changes:
This enables
aws-lcandopensslto be installed concurrently, including the-develpackages. We keep a shim around that can be packaged as a separate compat RPM in order to build unmodified software againstaws-lcrather thanopenssl. I've also added/modified pkgconfig to have an explicit aws-lc one as well as an openssl compat one, and by putting these in separate RPMs it's possible to build packages in a way that allows individual packages to opt-in to using AWS-LC or to have the-openssl-compat-develsubpackage come in and let unmodified software link against it.The headers are now
include/aws-lc/opensslrather thaninclude/opensslto clearly differentiateaws-lcfromopenssl, and enable a situation where both-develpackages can be installed simultaneously.i.e. this results in AWS-LC very much having its own identity rather than when installed system-wide entirely pretending to be OpenSSL.
Call-outs:
Probably the most important change is this one:
That enables the unversioned
.solibraries to exist, and thus be installed correctly, and enables the explicit linking againstlibssl-awslc.sorather thanlibssl.so.Testing:
I've built an RPM with this change, and used it to do test builds of a number of packages in Amazon Linux 2023 against
aws-lcrather than OpenSSL. I have not finished building everything, nor have I run any tests that aren't just the%checksections of said packages.Testing I've done has focused on was getting the
-devel,-openssl-compat-devel, and unversioned.sofor the-develpackage going.This is very RFC for the moment, suitable for discussion.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.