Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package aws-crt-cpp for openSUSE:Factory checked in at 2026-07-10 17:44:05 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/aws-crt-cpp (Old) and /work/SRC/openSUSE:Factory/.aws-crt-cpp.new.1991 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "aws-crt-cpp" Fri Jul 10 17:44:05 2026 rev:55 rq:1364857 version:0.40.1 Changes: -------- --- /work/SRC/openSUSE:Factory/aws-crt-cpp/aws-crt-cpp.changes 2026-06-08 14:27:40.126902716 +0200 +++ /work/SRC/openSUSE:Factory/.aws-crt-cpp.new.1991/aws-crt-cpp.changes 2026-07-10 17:46:38.264093284 +0200 @@ -1,0 +2,12 @@ +Fri Jun 19 09:56:34 UTC 2026 - John Paul Adrian Glaubitz <[email protected]> + +- Update to version 0.40.1 + * copy object fix by @TingDaoK in (#864) +- from version 0.40.0 + * Update aws-crt-builder to v0.9.93 by @sfod in (#860) + * Support s2n-tls on macOS by @sfod in (#855) + * Fix: Zero-initialize m_metricsStorage in Mqtt5ClientOptions + by @rakshil14-2 in (#861) + * Update submodules by @sfod in (#862) + +------------------------------------------------------------------- Old: ---- v0.39.1.tar.gz New: ---- v0.40.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ aws-crt-cpp.spec ++++++ --- /var/tmp/diff_new_pack.NHP51w/_old 2026-07-10 17:46:42.832249290 +0200 +++ /var/tmp/diff_new_pack.NHP51w/_new 2026-07-10 17:46:42.832249290 +0200 @@ -20,7 +20,7 @@ %define library_soversion 1 Name: aws-crt-cpp -Version: 0.39.1 +Version: 0.40.1 Release: 0 Summary: AWS C++ wrapper for AWS SDK C libraries License: Apache-2.0 ++++++ v0.39.1.tar.gz -> v0.40.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/.github/workflows/ci.yml new/aws-crt-cpp-0.40.1/.github/workflows/ci.yml --- old/aws-crt-cpp-0.39.1/.github/workflows/ci.yml 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/.github/workflows/ci.yml 2026-06-11 22:18:31.000000000 +0200 @@ -7,7 +7,7 @@ - 'docs' env: - BUILDER_VERSION: v0.9.92 + BUILDER_VERSION: v0.9.93 BUILDER_SOURCE: releases BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net PACKAGE_NAME: aws-crt-cpp @@ -307,6 +307,36 @@ steps: - uses: aws-actions/configure-aws-credentials@v4 with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + - name: Build ${{ env.PACKAGE_NAME }} + consumers + run: | + python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')" + chmod a+x builder + ./builder build -p ${{ env.PACKAGE_NAME }} --spec=downstream + + macos-s2n: + runs-on: macos-14 # latest + env: + AWS_CRT_USE_NON_FIPS_TLS_13: 1 + steps: + - uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + - name: Build ${{ env.PACKAGE_NAME }} + consumers + run: | + python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')" + chmod a+x builder + ./builder build -p ${{ env.PACKAGE_NAME }} --spec=downstream + + macos-x64-s2n: + runs-on: macos-14-large # latest + env: + AWS_CRT_USE_NON_FIPS_TLS_13: 1 + steps: + - uses: aws-actions/configure-aws-credentials@v4 + with: role-to-assume: ${{ env.CRT_CI_ROLE }} aws-region: ${{ env.AWS_DEFAULT_REGION }} - name: Build ${{ env.PACKAGE_NAME }} + consumers diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/CMakeLists.txt new/aws-crt-cpp-0.40.1/CMakeLists.txt --- old/aws-crt-cpp-0.39.1/CMakeLists.txt 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/CMakeLists.txt 2026-06-11 22:18:31.000000000 +0200 @@ -60,7 +60,9 @@ endif() add_subdirectory(crt/aws-c-common) - if(UNIX AND NOT APPLE AND NOT BYO_CRYPTO) + # Build s2n-tls and aws-lc on all Unix platforms except non-macOS Apple (iOS, tvOS). + # On macOS (Darwin), both Secure Transport and s2n are built; the TLS backend is selected at runtime. + if(UNIX AND NOT BYO_CRYPTO AND (NOT APPLE OR CMAKE_SYSTEM_NAME STREQUAL "Darwin")) if(NOT USE_OPENSSL) include(AwsPrebuildDependency) @@ -102,7 +104,19 @@ if(ENFORCE_SUBMODULE_VERSIONS) check_submodule_commit("s2n" "crt/s2n") endif() + + # On Intel Macs, Homebrew installs to /usr/local which is in the default header search path. + # Without this, s2n's libcrypto detection picks up Homebrew's OpenSSL instead of bundled aws-lc. + # ARM Macs use /opt/homebrew (not in default search paths) so they don't need this. + if(APPLE AND CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "x86_64") + set(_AWS_CRT_PREV_NO_SYSTEM_FROM_IMPORTED ${CMAKE_NO_SYSTEM_FROM_IMPORTED}) + set(CMAKE_NO_SYSTEM_FROM_IMPORTED ON) + endif() add_subdirectory(crt/s2n) + if(APPLE AND CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL "x86_64") + set(CMAKE_NO_SYSTEM_FROM_IMPORTED ${_AWS_CRT_PREV_NO_SYSTEM_FROM_IMPORTED}) + unset(_AWS_CRT_PREV_NO_SYSTEM_FROM_IMPORTED) + endif() endif() if(ENFORCE_SUBMODULE_VERSIONS) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/README.md new/aws-crt-cpp-0.40.1/README.md --- old/aws-crt-cpp-0.39.1/README.md 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/README.md 2026-06-11 22:18:31.000000000 +0200 @@ -49,9 +49,12 @@ If your application uses OpenSSL, configure with `-DUSE_OPENSSL=ON`. aws-crt-cpp does not use OpenSSL for TLS. -On Apple and Windows devices, the OS's default TLS library is used. -On Unix devices, [s2n-tls](https://github.com/aws/s2n-tls) is used. -But s2n-tls uses libcrypto, the cryptography math library bundled with OpenSSL. +On Windows, the OS's default TLS library (Schannel) is used. +On Linux, [s2n-tls](https://github.com/aws/s2n-tls) is used. +On macOS, Apple Secure Transport is used by default, but s2n-tls can be enabled at runtime +(see [macOS TLS Configuration](#macos-tls-configuration) below). + +s2n-tls uses libcrypto, the cryptography math library bundled with OpenSSL. To simplify the build process, the source code for s2n-tls and libcrypto are included as git submodules and built along with aws-crt-cpp. But if your application is also loading the system installation of OpenSSL @@ -61,7 +64,7 @@ Setting `-DUSE_OPENSSL=ON` will cause aws-crt-cpp to link against your system's existing `libcrypto`, instead of building its own copy. -You can ignore all this on Windows and Apple platforms, where aws-crt-cpp uses the OS's default libraries for TLS and cryptography math. +You can ignore all this on Windows, where aws-crt-cpp uses the OS's default libraries for TLS and cryptography math. ## Dependencies? @@ -131,7 +134,31 @@ non-blocking and event driven, this handles most of the "callback hell" inherent in the design. Assuming you aren't partitioning threads for particular use-cases, you can have a single instance of this that you pass to multiple clients. -## Mac-Only TLS Behavior +## macOS TLS Configuration + +By default on macOS, aws-crt-cpp uses Apple Secure Transport for TLS. This provides FIPS-compliant cryptography +and integration with the macOS Keychain (e.g. PKCS#12 credentials), but is limited to TLS 1.2. + +To enable TLS 1.3 on macOS, set the environment variable: + +``` +export AWS_CRT_USE_NON_FIPS_TLS_13=1 +``` + +This switches the TLS backend from Apple Secure Transport to [s2n-tls](https://github.com/aws/s2n-tls) with +[aws-lc](https://github.com/aws/aws-lc) as the underlying libcrypto. The tradeoffs are: + +| | Secure Transport (default) | s2n-tls (`AWS_CRT_USE_NON_FIPS_TLS_13=1`) | +|---|---|---| +| TLS versions | Up to TLS 1.2 | Up to TLS 1.3 | +| FIPS compliance | Yes | No | +| macOS Keychain integration | Yes (PKCS#12, system certs) | No | + +This variable is checked at runtime and only affects macOS. It has no effect on Linux (which always uses s2n-tls) +or Windows (which always uses Schannel). Both TLS backends are compiled into the binary when building on macOS; +the environment variable selects which one is used. + +### Keychain Behavior Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v0.8.10, when a stored private key from the Keychain is used, the following will be logged at the "info" log level: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/VERSION new/aws-crt-cpp-0.40.1/VERSION --- old/aws-crt-cpp-0.39.1/VERSION 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/VERSION 2026-06-11 22:18:31.000000000 +0200 @@ -1 +1 @@ -0.39.1 +0.40.1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/source/mqtt/Mqtt5Client.cpp new/aws-crt-cpp-0.40.1/source/mqtt/Mqtt5Client.cpp --- old/aws-crt-cpp-0.39.1/source/mqtt/Mqtt5Client.cpp 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/source/mqtt/Mqtt5Client.cpp 2026-06-11 22:18:31.000000000 +0200 @@ -211,6 +211,7 @@ m_sdkMetrics = Crt::ScopedResource<Mqtt::IoTDeviceSDKMetrics>( Crt::New<Mqtt::IoTDeviceSDKMetrics>(allocator), [allocator](Mqtt::IoTDeviceSDKMetrics *metrics) { Crt::Delete(metrics, allocator); }); + AWS_ZERO_STRUCT(m_metricsStorage); m_sdkMetrics->initializeRawOptions(m_metricsStorage); m_socketOptions.SetSocketType(Io::SocketType::Stream); AWS_ZERO_STRUCT(m_packetConnectViewStorage); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/tests/CMakeLists.txt new/aws-crt-cpp-0.40.1/tests/CMakeLists.txt --- old/aws-crt-cpp-0.39.1/tests/CMakeLists.txt 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/tests/CMakeLists.txt 2026-06-11 22:18:31.000000000 +0200 @@ -226,6 +226,10 @@ add_net_test_case(Mqtt5DirectConnectionWithBasicAuth) add_net_test_case(Mqtt5DirectConnectionWithMetricsCollection) add_net_test_case(Mqtt5DirectConnectionWithTLS) + if(NOT USE_OPENSSL) + # System OpenSSL (USE_OPENSSL=ON) may lack the TLS 1.3 support. + add_net_test_case(Mqtt5DirectConnectionWithTLS13) + endif() add_net_test_case(Mqtt5DirectConnectionWithMutualTLS) add_net_test_case(Mqtt5DirectConnectionWithMutualTLSAndALPN) add_net_test_case(Mqtt5DirectConnectionWithHttpProxy) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/tests/Mqtt5ClientCredentialsTest.cpp new/aws-crt-cpp-0.40.1/tests/Mqtt5ClientCredentialsTest.cpp --- old/aws-crt-cpp-0.39.1/tests/Mqtt5ClientCredentialsTest.cpp 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/tests/Mqtt5ClientCredentialsTest.cpp 2026-06-11 22:18:31.000000000 +0200 @@ -103,6 +103,9 @@ // Needed to return "success" instead of skip in Codebuild so it doesn't count as a failure AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_codebuild, "CODEBUILD_BUILD_ID"); +// When set, TLS backend on macOS switches from Secure Transport to s2n-tls, which doesn't support PKCS#12. +AWS_STATIC_STRING_FROM_LITERAL(s_test_envName_non_fips_tls13, "AWS_CRT_USE_NON_FIPS_TLS_13"); + static int s_GetEnvVariable(Aws::Crt::Allocator *allocator, const aws_string *variableName, aws_string **output) { int error = aws_get_environment_value(allocator, variableName, output); @@ -733,6 +736,15 @@ */ static int s_TestIoTMqtt5ConnectWithPKCS12(Aws::Crt::Allocator *allocator, void *) { + struct aws_string *non_fips_tls13 = NULL; + s_GetEnvVariable(allocator, s_test_envName_non_fips_tls13, &non_fips_tls13); + if (non_fips_tls13) + { + printf("Skipping PKCS12 test: AWS_CRT_USE_NON_FIPS_TLS_13 is set\n"); + aws_string_destroy(non_fips_tls13); + return AWS_OP_SKIP; + } + struct aws_string *endpoint = NULL; struct aws_string *pkcs12_key = NULL; struct aws_string *pkcs12_password = NULL; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/tests/Mqtt5ClientTest.cpp new/aws-crt-cpp-0.40.1/tests/Mqtt5ClientTest.cpp --- old/aws-crt-cpp-0.39.1/tests/Mqtt5ClientTest.cpp 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/tests/Mqtt5ClientTest.cpp 2026-06-11 22:18:31.000000000 +0200 @@ -167,15 +167,20 @@ AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_private_key, "AWS_TEST_MQTT5_KEY_FILE"); AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_iot_hostname, "AWS_TEST_MQTT5_IOT_CORE_HOST"); +AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_iot_tls13_hostname, "AWS_TEST_MQTT5_IOT_CORE_TLS13_HOST"); AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_iot_certificate, "AWS_TEST_MQTT5_IOT_CORE_RSA_CERT"); AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_iot_key, "AWS_TEST_MQTT5_IOT_CORE_RSA_KEY"); +// When set, TLS backend on macOS switches from Secure Transport to s2n-tls. +AWS_STATIC_STRING_FROM_LITERAL(s_mqtt5_test_envName_non_fips_tls13, "AWS_CRT_USE_NON_FIPS_TLS_13"); + enum Mqtt5TestType { MQTT5CONNECT_DIRECT, MQTT5CONNECT_DIRECT_BASIC_AUTH, MQTT5CONNECT_DIRECT_TLS, MQTT5CONNECT_DIRECT_IOT_CORE, + MQTT5CONNECT_DIRECT_IOT_CORE_TLS13, MQTT5CONNECT_DIRECT_IOT_CORE_ALPN, MQTT5CONNECT_WS, MQTT5CONNECT_WS_BASIC_AUTH, @@ -349,6 +354,30 @@ break; } + case MQTT5CONNECT_DIRECT_IOT_CORE_TLS13: + { + m_error |= aws_get_environment_value(allocator, s_mqtt5_test_envName_iot_tls13_hostname, &m_hostname); + m_error |= + aws_get_environment_value(allocator, s_mqtt5_test_envName_iot_certificate, &m_certificate_path); + m_error |= aws_get_environment_value(allocator, s_mqtt5_test_envName_iot_key, &m_private_key_path); + + if (m_error != AWS_OP_SUCCESS) + { + return; + } + if (m_hostname == NULL || m_certificate_path == NULL || m_private_key_path == NULL) + { + m_error = AWS_OP_ERR; + return; + } + { + m_hostname_string = aws_string_c_str(m_hostname); + m_certificate_path_string = aws_string_c_str(m_certificate_path); + m_private_key_path_string = aws_string_c_str(m_private_key_path); + } + break; + } + case MQTT5CONNECT_WS_IOT_CORE: { m_error |= aws_get_environment_value(allocator, s_mqtt5_test_envName_iot_hostname, &m_hostname); @@ -510,6 +539,7 @@ } case MQTT5CONNECT_DIRECT_IOT_CORE: + case MQTT5CONNECT_DIRECT_IOT_CORE_TLS13: { mqtt5Options.WithPort(8883); @@ -749,6 +779,51 @@ AWS_TEST_CASE(Mqtt5DirectConnectionWithTLS, s_TestMqtt5DirectConnectionWithTLS) /* + * Direct connection to a TLS 1.3-only host. + * Verifies that the connection succeeds on platforms supporting TLS 1.3 (Linux, or macOS with s2n). + * On macOS with Secure Transport (TLS 1.2 max), the connection is expected to fail. + */ +static int s_TestMqtt5DirectConnectionWithTLS13(Aws::Crt::Allocator *allocator, void *) +{ + ApiHandle apiHandle(allocator); + Mqtt5TestContext testContext = createTestContext(allocator, MQTT5CONNECT_DIRECT_IOT_CORE_TLS13); + if (testContext.testDirective == AWS_OP_SKIP) + { + return AWS_OP_SKIP; + } + + std::shared_ptr<Mqtt5Client> mqtt5Client = testContext.client; + ASSERT_TRUE(mqtt5Client); + ASSERT_TRUE(mqtt5Client->Start()); + + bool connectionSucceeded = testContext.connectionPromise.get_future().get(); + + (void)s_mqtt5_test_envName_non_fips_tls13; +# if defined(__APPLE__) + struct aws_string *non_fips_tls13 = NULL; + aws_get_environment_value(allocator, s_mqtt5_test_envName_non_fips_tls13, &non_fips_tls13); + if (non_fips_tls13) + { + // s2n is active on macOS, TLS 1.3 should work. + aws_string_destroy(non_fips_tls13); + ASSERT_TRUE(connectionSucceeded); + } + else + { + // Secure Transport doesn't support TLS 1.3, expect connection failure. + ASSERT_FALSE(connectionSucceeded); + } +# else + ASSERT_TRUE(connectionSucceeded); +# endif + + ASSERT_TRUE(mqtt5Client->Stop()); + testContext.stoppedPromise.get_future().get(); + return AWS_OP_SUCCESS; +} +AWS_TEST_CASE(Mqtt5DirectConnectionWithTLS13, s_TestMqtt5DirectConnectionWithTLS13) + +/* * [ConnDC-UC4] Direct connection with mutual TLS */ static int s_TestMqtt5DirectConnectionWithMutualTLS(Aws::Crt::Allocator *allocator, void *) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-crt-cpp-0.39.1/tests/MqttClientCredentialsTest.cpp new/aws-crt-cpp-0.40.1/tests/MqttClientCredentialsTest.cpp --- old/aws-crt-cpp-0.39.1/tests/MqttClientCredentialsTest.cpp 2026-05-22 21:07:32.000000000 +0200 +++ new/aws-crt-cpp-0.40.1/tests/MqttClientCredentialsTest.cpp 2026-06-11 22:18:31.000000000 +0200 @@ -94,6 +94,9 @@ // Needed to return "success" instead of skip in Codebuild so it doesn't count as a failure AWS_STATIC_STRING_FROM_LITERAL(s_mqtt311_test_envName_codebuild, "CODEBUILD_BUILD_ID"); +// When set, TLS backend on macOS switches from Secure Transport to s2n-tls, which doesn't support PKCS#12. +AWS_STATIC_STRING_FROM_LITERAL(s_test_envName_non_fips_tls13, "AWS_CRT_USE_NON_FIPS_TLS_13"); + static int s_GetEnvVariable(Aws::Crt::Allocator *allocator, const aws_string *variableName, aws_string **output) { int error = aws_get_environment_value(allocator, variableName, output); @@ -672,6 +675,15 @@ */ static int s_TestIoTMqtt311ConnectWithPKCS12(Aws::Crt::Allocator *allocator, void *) { + struct aws_string *non_fips_tls13 = NULL; + s_GetEnvVariable(allocator, s_test_envName_non_fips_tls13, &non_fips_tls13); + if (non_fips_tls13) + { + printf("Skipping PKCS12 test: AWS_CRT_USE_NON_FIPS_TLS_13 is set\n"); + aws_string_destroy(non_fips_tls13); + return AWS_OP_SKIP; + } + struct aws_string *endpoint = NULL; struct aws_string *pkcs12_key = NULL; struct aws_string *pkcs12_password = NULL;
