Restore CI for riscv64gc-unknown-linux-gnu

.github/workflows/cross.yml

@@ -21,12 +21,11 @@ env:
 jobs:
   aws-lc-rs-cross-test:
     if: github.repository_owner == 'aws'
-    name: aws-lc-rs cross tests
-    runs-on: ${{ matrix.os }}
+    name: cross tests ${{ matrix.target }}
+    runs-on: ubuntu-22.04
     strategy:
       fail-fast: false
       matrix:
-        os: [ ubuntu-22.04 ]
         target:
           - aarch64-linux-android
           - aarch64-unknown-linux-gnu
@@ -51,18 +50,21 @@ jobs:
         with:
           toolchain: 'stable'
       - name: Install cross
-        run: cargo install cross ${{ (matrix.target == 'riscv64gc-unknown-linux-gnu'  && '--locked') || '' }} --git https://github.com/cross-rs/cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
       - uses: dtolnay/rust-toolchain@master
         id: toolchain
         with:
-          toolchain: ${{ (matrix.target == 'riscv64gc-unknown-linux-gnu'  && '1.72.1') || 'stable' }}
+          toolchain: 'stable'
           target: ${{ matrix.target }}
       - name: Set Rust toolchain override
         run: rustup override set ${{ steps.toolchain.outputs.name }}
+      # The flag below is set to avoid the following error with GCC 11.4.0 on the riscv64 platform:
+      #   /home/runner/work/aws-lc-rs/aws-lc-rs/aws-lc-sys/aws-lc/crypto/pem/pem_lib.c:707:11: error: 'strncmp' of strings of length 1 and 9 and bound of 9 evaluates to nonzero [-Werror=string-compare]
+      #    707 |       if (strncmp(buf, "-----END ", 9) == 0) {
+      #        |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
       - if: ${{ matrix.target == 'riscv64gc-unknown-linux-gnu' }}
         run: |
-          cargo update
-          cargo update -p clap --precise 4.4.18
+          echo 'AWS_LC_SYS_CFLAGS="-Wno-string-compare"' >> "$GITHUB_ENV"
       - name: Cross-compilation (build debug)
         run: cross build -p aws-lc-rs --features unstable --target ${{ matrix.target }}
       - name: Cross-compilation (test release)

Cross.toml

@@ -27,5 +27,5 @@ passthrough = [
     "AWS_LC_SYS_EXTERNAL_BINDGEN", "AWS_LC_FIPS_SYS_EXTERNAL_BINDGEN",
     "AWS_LC_SYS_STATIC", "AWS_LC_FIPS_SYS_STATIC",
     "AWS_LC_SYS_CMAKE_BUILDER", "AWS_LC_SYS_CC_SRC_COLLECTOR",
-    "GOPROXY",
+    "GOPROXY", "AWS_LC_SYS_CFLAGS"
 ]

aws-lc-rs/src/aead/nonce_sequence/counter32.rs

@@ -6,6 +6,7 @@ use crate::error::Unspecified;
 use crate::iv::FixedLength;
 
 /// `Counter32` is an implementation of the `NonceSequence` trait.
+///
 /// The internal state of a `Counter32` is a 32-bit unsigned counter that
 /// increments on each call to `advance` and an optional 8-byte identifier. Counter and identifier
 /// values are used to construct each nonce.

aws-lc-rs/src/aead/nonce_sequence/counter64.rs

@@ -6,6 +6,7 @@ use crate::error::Unspecified;
 use crate::iv::FixedLength;
 
 /// `Counter64` is an implementation of the `NonceSequence` trait.
+///
 /// The internal state of a `Counter64` is a 64-bit unsigned counter that
 /// increments on each call to `advance` and an optional 4-byte identifier. Counter and identifier
 /// values are used to construct each nonce.

aws-lc-rs/src/constant_time.rs

@@ -9,6 +9,7 @@ use crate::error;
 use aws_lc::CRYPTO_memcmp;
 
 /// Returns `Ok(())` if `a == b` and `Err(error::Unspecified)` otherwise.
+///
 /// The comparison of `a` and `b` is done in constant time with respect to the
 /// contents of each, but NOT in constant time with respect to the lengths of
 /// `a` and `b`.

aws-lc-rs/src/unstable/kdf/kbkdf.rs

@@ -57,6 +57,7 @@ const KBKDF_CTR_HMAC_SHA512: KbkdfCtrHmacAlgorithm = KbkdfCtrHmacAlgorithm {
 };
 
 /// Retrieve an unstable [`KbkdfCtrHmacAlgorithm`] using the [`KbkdfCtrHmacAlgorithmId`] specified by `id`.
+///
 /// May return [`None`] if the algorithm is not usable with the configured crate feature set (i.e. `fips`).
 #[must_use]
 pub const fn get_kbkdf_ctr_hmac_algorithm(

aws-lc-rs/src/unstable/kdf/sskdf.rs

@@ -96,6 +96,7 @@ const SSKDF_DIGEST_SHA512: SskdfDigestAlgorithm = SskdfDigestAlgorithm {
 };
 
 /// Retrieve an unstable [`SskdfHmacAlgorithm`] using the [`SskdfHmacAlgorithmId`] specified by `id`.
+///
 /// May return [`None`] if the algorithm is not usable with the configured crate feature set (i.e. `fips`).
 #[must_use]
 pub const fn get_sskdf_hmac_algorithm(
@@ -118,6 +119,7 @@ pub const fn get_sskdf_hmac_algorithm(
 }
 
 /// Retrieve an unstable [`SskdfDigestAlgorithm`] using the [`SskdfDigestAlgorithmId`] specified by `id`.
+///
 /// May return [`None`] if the algorithm is not usable with the configured crate feature set (i.e. `fips`).
 #[must_use]
 pub const fn get_sskdf_digest_algorithm(

aws-lc-sys/builder/cc_builder.rs

@@ -14,8 +14,8 @@ mod x86_64_unknown_linux_gnu;
 mod x86_64_unknown_linux_musl;
 
 use crate::{
-    cargo_env, env_var_to_bool, execute_command, out_dir, requested_c_std, target, target_arch,
-    target_os, target_vendor, CStdRequested, OutputLibType,
+    cargo_env, emit_warning, env_var_to_bool, execute_command, get_cflags, out_dir,
+    requested_c_std, target, target_arch, target_os, target_vendor, CStdRequested, OutputLibType,
 };
 use std::path::PathBuf;
 
@@ -26,7 +26,7 @@ pub(crate) struct CcBuilder {
     output_lib_type: OutputLibType,
 }
 
-use std::fs;
+use std::{env, fs};
 
 pub(crate) struct Library {
     name: &'static str,
@@ -132,6 +132,14 @@ impl CcBuilder {
             }
         }
 
+        if !get_cflags().is_empty() {
+            let cflags = get_cflags();
+            emit_warning(&format!(
+                "AWS_LC_SYS_CFLAGS found. Setting CFLAGS: '{cflags}'"
+            ));
+            env::set_var("CFLAGS", cflags);
+        }
+
         self.add_includes(&mut cc_build);
         cc_build
     }

aws-lc-sys/builder/cmake_builder.rs

@@ -3,9 +3,9 @@
 
 use crate::OutputLib::{Crypto, RustWrapper, Ssl};
 use crate::{
-    allow_prebuilt_nasm, cargo_env, emit_warning, execute_command, is_crt_static, is_no_asm,
-    option_env, requested_c_std, target, target_arch, target_env, target_family, target_os,
-    target_underscored, target_vendor, test_nasm_command, CStdRequested, OutputLibType,
+    allow_prebuilt_nasm, cargo_env, emit_warning, execute_command, get_cflags, is_crt_static,
+    is_no_asm, option_env, requested_c_std, target, target_arch, target_env, target_family,
+    target_os, target_underscored, target_vendor, test_nasm_command, CStdRequested, OutputLibType,
 };
 use std::env;
 use std::ffi::OsString;
@@ -145,6 +145,14 @@ impl CmakeBuilder {
             CStdRequested::None => {}
         }
 
+        if !get_cflags().is_empty() {
+            let cflags = get_cflags();
+            emit_warning(&format!(
+                "AWS_LC_SYS_CFLAGS found. Setting CFLAGS: '{cflags}'"
+            ));
+            env::set_var("CFLAGS", cflags);
+        }
+
         // Allow environment to specify CMake toolchain.
         if let Some(toolchain) = option_env("CMAKE_TOOLCHAIN_FILE").or(option_env(format!(
             "CMAKE_TOOLCHAIN_FILE_{}",

aws-lc-sys/builder/main.rs

@@ -343,6 +343,7 @@ static mut AWS_LC_SYS_NO_PREFIX: bool = false;
 static mut AWS_LC_SYS_INTERNAL_BINDGEN: bool = false;
 static mut AWS_LC_SYS_EXTERNAL_BINDGEN: bool = false;
 static mut AWS_LC_SYS_NO_ASM: bool = false;
+static mut AWS_LC_SYS_CFLAGS: String = String::new();
 static mut AWS_LC_SYS_PREBUILT_NASM: Option<bool> = None;
 
 static mut AWS_LC_SYS_C_STD: CStdRequested = CStdRequested::None;
@@ -355,6 +356,7 @@ fn initialize() {
         AWS_LC_SYS_EXTERNAL_BINDGEN =
             env_var_to_bool("AWS_LC_SYS_EXTERNAL_BINDGEN").unwrap_or(false);
         AWS_LC_SYS_NO_ASM = env_var_to_bool("AWS_LC_SYS_NO_ASM").unwrap_or(false);
+        AWS_LC_SYS_CFLAGS = option_env("AWS_LC_SYS_CFLAGS").unwrap_or_default();
         AWS_LC_SYS_PREBUILT_NASM = env_var_to_bool("AWS_LC_SYS_PREBUILT_NASM");
         AWS_LC_SYS_C_STD = CStdRequested::from_env();
     }
@@ -415,6 +417,10 @@ fn is_no_asm() -> bool {
     unsafe { AWS_LC_SYS_NO_ASM }
 }
 
+fn get_cflags() -> &'static str {
+    unsafe { AWS_LC_SYS_CFLAGS.as_str() }
+}
+
 fn allow_prebuilt_nasm() -> Option<bool> {
     unsafe { AWS_LC_SYS_PREBUILT_NASM }
 }

docker/linux-cross/Dockerfile

@@ -4,7 +4,7 @@ FROM $CROSS_BASE_IMAGE
 ARG DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && \
-    apt-get install --assume-yes --no-install-recommends  software-properties-common && \
+    apt-get install --assume-yes --no-install-recommends gpg-agent software-properties-common && \
     add-apt-repository --yes ppa:longsleep/golang-backports && \
     apt-get update && \
     apt-get install --assume-yes --no-install-recommends build-essential cmake golang-go clang && \