support aws-lc FIPS version - #5552
Open
Gleb Pomykalov (glebpom) wants to merge 1 commit into
Open
Conversation
|
🎉 All Contributor License Agreements have been signed. Ready to merge. |
Gleb Pomykalov (glebpom)
force-pushed
the
aws-lc-support-fips
branch
from
July 20, 2026 20:27
0ca1de2 to
174da54
Compare
Gleb Pomykalov (glebpom)
marked this pull request as ready for review
July 20, 2026 20:32
Gerd Zellweger (gz)
added a commit
to feldera/feldera
that referenced
this pull request
Aug 9, 2026
rdkafka-sys otherwise compiles a vendored librdkafka against whatever OpenSSL pkg-config finds, which leaves Kafka TLS on a second cryptographic implementation no matter how the rest of the binary is built. scripts/install-librdkafka.sh builds AWS-LC with BUILD_LIBSSL, then librdkafka against it. Both container images run the script, and so must developers, since the next commit links librdkafka dynamically. Distribution packages are built against OpenSSL and are older than the version rdkafka-sys requires, so they are not a substitute. librdkafka 2.12.1 calls HMAC() without including <openssl/hmac.h>. OpenSSL supplies the declaration transitively through x509.h and AWS-LC does not, so the call would compile as an implicit declaration returning int, truncating the returned pointer. The script patches it; confluentinc/librdkafka#5552 fixes it upstream but is unmerged. The librdkafka version comes from Cargo.lock, where rdkafka-sys names it in its own version as 4.10.0+2.12.1, so the library cannot drift from the crate expecting it. The configure flags mirror the cargo features rdkafka-sys used, and the script asserts each one: losing one is otherwise silent, and a codec or authentication mechanism simply stops being offered. Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
6 tasks
Gerd Zellweger (gz)
added a commit
to feldera/feldera
that referenced
this pull request
Aug 9, 2026
rdkafka-sys otherwise compiles a vendored librdkafka against whatever OpenSSL pkg-config finds, which leaves Kafka TLS on a second cryptographic implementation no matter how the rest of the binary is built. scripts/install-librdkafka.sh builds AWS-LC with BUILD_LIBSSL, then librdkafka against it. Both container images run the script, and so must developers, since the next commit links librdkafka dynamically. Distribution packages are built against OpenSSL and are older than the version rdkafka-sys requires, so they are not a substitute. librdkafka 2.12.1 calls HMAC() without including <openssl/hmac.h>. OpenSSL supplies the declaration transitively through x509.h and AWS-LC does not, so the call would compile as an implicit declaration returning int, truncating the returned pointer. The script patches it; confluentinc/librdkafka#5552 fixes it upstream but is unmerged. The librdkafka version comes from Cargo.lock, where rdkafka-sys names it in its own version as 4.10.0+2.12.1, so the library cannot drift from the crate expecting it. The configure flags mirror the cargo features rdkafka-sys used, and the script asserts each one: losing one is otherwise silent, and a codec or authentication mechanism simply stops being offered. Signed-off-by: Gerd Zellweger <mail@gerdzellweger.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.