Repository navigation
Fix OPENSSL_memchr per C23 - #3008
Merged
Merged
Conversation
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
justsmth
temporarily deployed
to
auto-approve
February 18, 2026 19:24 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3008 +/- ##
=======================================
Coverage 78.31% 78.31%
=======================================
Files 689 689
Lines 120995 120995
Branches 16971 16973 +2
=======================================
+ Hits 94758 94762 +4
+ Misses 25341 25337 -4
Partials 896 896 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
WillChilds-Klein
approved these changes
Feb 19, 2026
nebeid
approved these changes
Feb 19, 2026
manastasova
approved these changes
Feb 19, 2026
Merged
justsmth
added a commit
that referenced
this pull request
Feb 20, 2026
### Description of changes: * Bump urllib3 from 2.6.0 to 2.6.3 in /tests/ci by @dependabot[bot] in #2932 * Add weekly automated check for outdated third-party test vectors by @sgmenda in #2933 * Enable Hybrid PQ KeyShares by default by @alexw91 in #2531 * Remove AVX conditional from cmake script by @torben-hansen in #2958 * openssl-ca command implementation for self-sign certificates by @skmcgrail in #2937 * Initial Framework for Using Doxygen to Document Public Header Files by @m271828 in #2908 * Move md4 out of FIPS module by @torben-hansen in #2956 * Fix image-build-windows workflow to only push on workflow_call and workflow_dispatch by @skmcgrail in #2961 * Remove FIPS counter framework and other tidying up by @torben-hansen in #2947 * Model Device Farm CI Resources in CDK by @skmcgrail in #2965 * Adds a new randomness generation API by @torben-hansen in #2963 * Migrate Android Testing to GitHub Actions by @skmcgrail in #2969 * Ensure pkcs7 checks ASN1_TYPE->type by @skmcgrail in #2968 * Fix checkout logic for android-omnibus by @skmcgrail in #2970 * Add missing env vars to check-vectors workflow step by @sgmenda in #2962 * Shorten Windows Build Directory Path by @skmcgrail in #2974 * Bump mysql cluster version by @WillChilds-Klein in #2967 * Integrate Wycheproof ML-DSA test vectors by @sgmenda in #2973 * Simplify FIPS conditional in top-level build script by @torben-hansen in #2976 * Fix aws-lc-rs CI job by @justsmth in #2966 * Add method to get type of ML-DSA instance configured under EVP PKEY by @torben-hansen in #2980 * Nmap build needs liblinear by @justsmth in #2985 * Disable SLP vectorizer for FIPS shared library builds on GCC 14+ by @geedo0 in #2977 * Update Wycheproof ECDSA test vectors and fix workflow typo by @sgmenda in #2972 * Address some CMake findings by @skmcgrail in #2979 * Bump bytes from 1.7.1 to 1.11.1 in /tests/ci/lambda by @dependabot[bot] in #2983 * Support GCC 4.8 for aarch64 by @justsmth in #2964 * Free potential memory before assigning new pointer by @torben-hansen in #2989 * Add PyOpenSSL integration test by @WillChilds-Klein in #2992 * Ensure index argument is not negative in ASN1_BIT_STRING_set_bit by @torben-hansen in #2987 * Ensure no overflow in signed output length in do_buf by @torben-hansen in #2988 * Remove redundant CPython 3.9 integration test by @WillChilds-Klein in #2996 * Ensure public key is set before verifying through ML-DSA verify by @torben-hansen in #2990 * Correct CCM nids in object definition by @torben-hansen in #2991 * Address Reported Bug Findings by @skmcgrail in #3000 * Fix CI: gcc-4.8 by @justsmth in #3011 * Fix Windows CI: use `cd /d` in run_windows_tests.bat to handle cross-drive paths by @justsmth in #3012 * Fix OPENSSL_memchr per C23 by @justsmth in #3008 * Fix argument order in `hmac_copy` by @justsmth in #3014 * Miscellaneous CI improvements by @skmcgrail in #2978 * Fix CI: mariadb by @justsmth in #3015 * Update Ubuntu 24:04 image compiler verification by @skmcgrail in #3017 * Support WASM/Emscripten by @justsmth in #2959 * Generate Rust Bindings by @justsmth in #2999 By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.
gasmith
added a commit
to foxglove/foxglove-sdk
that referenced
this pull request
Mar 4, 2026
gasmith
added a commit
to foxglove/foxglove-sdk
that referenced
this pull request
Mar 4, 2026
### Changelog None ### Docs None ### Description Pull in this upstream fix: aws/aws-lc#3008
gasmith
added a commit
to foxglove/foxglove-sdk
that referenced
this pull request
Mar 4, 2026
kou
added a commit
to kou/arrow
that referenced
this pull request
Mar 27, 2026
aws-lc can't be built with C23: aws/aws-lc#2995 It's fixed in upstream: aws/aws-lc#3008
kou
added a commit
to kou/arrow
that referenced
this pull request
Mar 27, 2026
aws-lc can't be built with C23: aws/aws-lc#2995 It's fixed in upstream: aws/aws-lc#3008
kou
added a commit
to apache/arrow
that referenced
this pull request
Mar 28, 2026
### Rationale for this change aws-lc can't be built with C23: aws/aws-lc#2995 It's fixed in upstream: aws/aws-lc#3008 ### What changes are included in this PR? Update bundled AWS SDK C++ related products to the latest version. ### Are these changes tested? Yes. ### Are there any user-facing changes? Yes. * GitHub Issue: #49601 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>
thisisnic
pushed a commit
to thisisnic/arrow
that referenced
this pull request
Apr 6, 2026
### Rationale for this change aws-lc can't be built with C23: aws/aws-lc#2995 It's fixed in upstream: aws/aws-lc#3008 ### What changes are included in this PR? Update bundled AWS SDK C++ related products to the latest version. ### Are these changes tested? Yes. ### Are there any user-facing changes? Yes. * GitHub Issue: apache#49601 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>
Mottl
pushed a commit
to Mottl/arrow
that referenced
this pull request
May 26, 2026
### Rationale for this change aws-lc can't be built with C23: aws/aws-lc#2995 It's fixed in upstream: aws/aws-lc#3008 ### What changes are included in this PR? Update bundled AWS SDK C++ related products to the latest version. ### Are these changes tested? Yes. ### Are there any user-facing changes? Yes. * GitHub Issue: apache#49601 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>
justsmth
added a commit
that referenced
this pull request
Jun 10, 2026
Cherrypick of #3008 onto `fips-2025-09-12-lts`. ----- Resolves #2995 C23 makes `memchr` const-correct, returning `const void *` when the input is `const void *`. Some C libraries (e.g. glibc 2.41+) apply this change even in C11 mode. This causes a `-Wdiscarded-qualifiers` error in the C code path of `OPENSSL_memchr`, which returns `void *`. Combined with `-Werror`, this breaks the build on distributions like Arch Linux that ship these newer toolchains. Also guard the `-Wno-c11-extensions` flag behind a Clang check, as it is Clang-specific and produces a diagnostic note on GCC. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license. ### Issues: Resolves #ISSUE-NUMBER1 Addresses #ISSUE-NUMBER2 ### Description of changes: Describe AWS-LC’s current behavior and how your code changes that behavior. If there are no issues this pr is resolving, explain why this change is necessary. ### Call-outs: Point out areas that need special attention or support during the review process. Discuss architecture or design changes. ### Testing: How is this change tested (unit tests, fuzz tests, etc.)? Are there any testing steps to be verified by the reviewer? By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license. Co-authored-by: Justin W Smith <103147162+justsmth@users.noreply.github.com>
haproxy-mirror
pushed a commit
to haproxy/haproxy
that referenced
this pull request
Nov 10, 2026
AWS-LC 3.x fails to build with recent GCC/glibc due to a -Wdiscarded-qualifiers error in OPENSSL_memchr (C23 made memchr const-correct, and glibc 2.41+ applies this even in C11 mode). The fix exists upstream (aws/aws-lc#3008) but has not been cherry-picked to the fips-2024-09-27 branch yet. See aws/aws-lc#3759
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues:
Resolves #2995
Description of changes:
C23 makes
memchrconst-correct, returningconst void *when the input isconst void *. Some C libraries (e.g. glibc 2.41+) apply this change even in C11 mode. This causes a-Wdiscarded-qualifierserror in the C code path ofOPENSSL_memchr, which returnsvoid *. Combined with-Werror, this breaks the build on distributions like Arch Linux that ship these newer toolchains.Also guard the
-Wno-c11-extensionsflag behind a Clang check, as it is Clang-specific and produces a diagnostic note on GCC.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.