[justsmth]

Issues:

Addresses: aws/aws-lc-rs#745, P353434599
Related: #3319, #3320

Description of changes:

Follow-up to the OPENSSL_SMALL size work in #3319/#3320. Two independent changes, one per commit:

1. Drop P-256 nistz assembly under OPENSSL_SMALL. p256-nistz.c is compiled out entirely in this configuration (ec.c dispatches P-256 to the fiat-crypto implementation), so the nistz assembly -- p256-{x86_64,armv8}-asm and p256_beeu-{x86_64,armv8}-asm -- is fully unreferenced on both architectures. This removes it from the build using the same if(OPENSSL_SMALL) list-removal pattern established for s2n-bignum in Gate s2n-bignum _alt variants under OPENSSL_SMALL #3320. Like the EC removal there, this is pure dead-code elimination: it shrinks shared-library artifacts, but static consumers were already dropping these unreferenced objects at link time. The non-OPENSSL_SMALL build is unchanged.

2. Extend the binary-size CI harness (from Gate s2n-bignum _alt variants under OPENSSL_SMALL #3320) to measure GC-enabled consumers and the key-parsing anchor. The most important chunk a static consumer inherits from libcrypto is the ML-KEM/ML-DSA code retained by asn1_evp_pkey_methods[]: any consumer that parses an EVP key pulls it in, and no linker or OPENSSL_SMALL-style change can drop it -- only a future API-reduction build option can. This adds a second, section-GC library build (matching how aws-lc-rs/CcBuilder compiles the library) and a variant of the consumer that calls EVP_parse_public_key, so CI reports the anchor cost on every run. This makes the motivation for that future work concrete and quantifiable, and gives subsequent size PRs a realistic consumer-impact number rather than just an archive-size delta.

Call-outs:

• The two commits are unrelated and could be reviewed independently; they are bundled because commit 1 is ~20 lines.
• The default-compiled size harness is behaviorally unchanged, so the size-reduction thresholds calibrated in Gate s2n-bignum _alt variants under OPENSSL_SMALL #3320 remain valid. The new anchor measurement is advisory (not thresholded).
• The section-GC library build in the harness is deliberate: without -ffunction-sections -fdata-sections, any reference into bcm.c.o retains the whole object and masks the anchor.

Testing:

• Covered by the existing openssl-small.yml matrix (full test suite, x86_64 + aarch64, gcc + clang) and the shared-library link (which proves no removed object is still referenced).
• Locally (arm64 macOS): OPENSSL_SMALL shared-lib links cleanly, nm confirms the previously-dead ecp_nistz256_*/beeu_* symbols are gone, and the full crypto_test suite passes.
• The harness self-checks run in CI (both consumer variants execute before their sizes are compared). On Linux/GNU ld, a base consumer retains zero ML-KEM/ML-DSA code, while adding a single EVP_parse_public_key call pulls in ~574 KB (x86_64) / ~634 KB (aarch64), per the CI runs of this PR -- confirming the anchor the harness is meant to track.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.19%. Comparing base (aba09cb) to head (d905ec1).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3350      +/-   ##
==========================================
- Coverage   78.20%   78.19%   -0.02%     
==========================================
  Files         695      695              
  Lines      124086   124086              
  Branches    17232    17231       -1     
==========================================
- Hits        97044    97025      -19     
- Misses      26121    26141      +20     
+ Partials      921      920       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nebeid]

The commit message and the PR description are reporting delta sizes smaller than what the summary is showing.