Add integration patches/CI for Ruby main and 3.3 #2071
+1,263
−39
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2071 +/- ##
==========================================
- Coverage 79.04% 79.03% -0.01%
==========================================
Files 612 612
Lines 106064 106064
Branches 14994 14995 +1
==========================================
- Hits 83833 83824 -9
- Misses 21579 21587 +8
- Partials 652 653 +1 ☔ View full report in Codecov by Sentry. |
samuel40791765
force-pushed
the
ruby-integration-main
branch
2 times, most recently
from
e146fd0 to
584efab
Compare
|
Per a recent test run, it looks like we need to implement Even when under review, these integration tests help us respond to upstream changes :) |
Are we planning to submit a PR upstream to Ruby? |
|
Ahh I'll put up a PR to add support for
Yeah I've submitted a PR upstream and cut an issue to GnuTLS as well. ruby/openssl#830 |
samuel40791765
force-pushed
the
ruby-integration-main
branch
from
abf9d23 to
a9d4a6e
Compare
samuel40791765
force-pushed
the
ruby-integration-main
branch
from
a9d4a6e to
3e0243d
Compare
samuel40791765
added a commit
that referenced
this pull request
Jan 22, 2025
Ruby's made a couple larger refactors to require versions later than OpenSSL 1.1.1. These changes require us to make a few tweaks to the patch in #2071 and have exposed a couple minor symbols that we don't support. Adding support for the ones that aren't complicated in this commit. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
samuel40791765
force-pushed
the
ruby-integration-main
branch
3 times, most recently
from
01e7f25 to
3ee9bb3
Compare
manastasova
pushed a commit
to manastasova/aws-lc
that referenced
this pull request
Jan 30, 2025
Ruby's made a couple larger refactors to require versions later than OpenSSL 1.1.1. These changes require us to make a few tweaks to the patch in aws#2071 and have exposed a couple minor symbols that we don't support. Adding support for the ones that aren't complicated in this commit. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
samuel40791765
added a commit
that referenced
this pull request
Feb 5, 2025
Ruby has added a binding for an additional function called `PKCS12_set_mac` in it's master branch: ruby/ruby@c79b435. This was discovered prior to the PR for Ruby's CI integration with the master branch being merged: #2071 OpenSSL's implementation of the function directly sets a designated mac field within the `PKCS12` structure. Our `PKCS12` structure is folded into a string of bytes along with its length and there aren't any available fields for us to directly set. This means that AWS-LC's implementation of `PKCS12_set_mac` has to parse the proper contents from `PKCS12` and rerun the key and mac generation with the new parameters provided. ### Call-outs: 1. The parsing logic is similar to `PKCS12_get_key_and_certs`, but the logic can't be shared. This is because we need to maintain pointers to certain parts of the CBS parsers in `PKCS12_set_mac`, so that we can properly rewrite the contents later. 2. I've abstracted the key and mac generation in `PKCS12_create` and `PKCS12_set_mac` to a single function called `pkcs12_gen_and_write_mac`. 3. OpenSSL 3.0 uses SHA-256 as the default hash, yet OpenSSL 1.1.1 uses SHA-1. We've decided to go with SHA-1 for now for better 1.1.1 compatibility. HMAC's security also does not rely on the hash function's collision resistance property. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
samuel40791765
force-pushed
the
ruby-integration-main
branch
from
3ee9bb3 to
1a761ae
Compare
justsmth
previously approved these changes
Feb 5, 2025
samuel40791765
force-pushed
the
ruby-integration-main
branch
from
1a761ae to
eddc0c7
Compare
justsmth
previously approved these changes
Feb 5, 2025
samuel40791765
force-pushed
the
ruby-integration-main
branch
2 times, most recently
from
a89863d to
356f180
Compare
samuel40791765
force-pushed
the
ruby-integration-main
branch
from
356f180 to
8c472c9
Compare
WillChilds-Klein
approved these changes
Feb 12, 2025
| make test-all TESTS="test/rubygems/test*.rb" | ||
|
|
||
| if [[ "${branch}" != "master" ]]; then |
There was a problem hiding this comment.
can we drop a comment as to why we don't run DRB tests against master?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issues:
Resolves
CryptoAlg-2784Description of changes:
Ruby 3.3 is relatively the same as 3.2 with just one more test failure due to conflicting error messages.
Ruby's master branch has added much more however.
test/openssl/pkey_rsa.rbgenerated by certtool isn't parsable by us. I've pinned down the reason to a missingNULLfield in the ASN1 contents. I've cut an issue to gnutls, more details can be found there.I've replaced the file that Ruby's been using for the time being and replaced the original generation to use OpenSSL instead. OpenSSL's PKCS8 files adhere to the RFC.
Call-outs:
N/A
Testing:
New CI
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.