ci: pin openssh required job - #3387
Merged
Merged
Conversation
openssh-portable commit ddbcd8f added mlkem768brainpoolp256r1-sha256 to master. AWS-LC defines NID_brainpoolP256r1 but does not implement the Brainpool P-256 curve, so EC_KEY_new_by_curve_name returns NULL at runtime and the rekey regression test cascades into failures for all AEAD ciphers. Pin the blocking required jobs to V_10_4_P1 (last known-good release, July 6 2026) and track master with allow_failure: true, following the pattern established for grpc (PR aws#3331) and libssh2 (PR aws#3343). Also simplify run_openssh_integration.sh: accept the ref as $1 instead of via OPENSSH_BRANCH env var, use --depth 1 --branch on clone, and remove the checkout_openssh_branch helper that is no longer needed.
Contributor
|
🔒 Security Review — View Report Please review before merging. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3387 +/- ##
==========================================
- Coverage 78.20% 78.20% -0.01%
==========================================
Files 695 695
Lines 124220 124220
Branches 17261 17261
==========================================
- Hits 97148 97141 -7
- Misses 26149 26155 +6
- Partials 923 924 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
dougch
changed the title
dougch
marked this pull request as ready for review
July 30, 2026 20:44
nebeid
approved these changes
Jul 31, 2026
social4hyq
pushed a commit
to social4hyq/homebrew-core
that referenced
this pull request
Sep 20, 2026
aws-lc 5.5.0 Created-by: HarmonybrewBot Commit-by: HarmonybrewBot Merged-by: HarmonybrewBot Description: Created by `brew bump` --- Created with `brew bump-formula-pr`.<details> <summary>release notes</summary> <pre>## What's Changed * Restore ADX/AVX2 code paths under OPENSSL_SMALL via new MY_ASSEMBLER_IS_TOO_OLD_FOR_ADX_AVX2 flag by @justsmth in aws/aws-lc#3368 * Include <openssl/cipher.h> from <openssl/hmac.h> for OpenSSL compat by @justsmth in aws/aws-lc#3371 * ci: harden security-review.yml against script injection by @nebeid in aws/aws-lc#3365 * Fix flaky s_client cipher tests by using better ciphers by @justsmth in aws/aws-lc#3373 * chore: simplify the api docs workflow by @dougch in aws/aws-lc#3186 * Add tests for RSASSA-PSS with SHA-3 digest and MGF1 by @WillChilds-Klein in aws/aws-lc#3377 * Link header documentation from README by @WillChilds-Klein in aws/aws-lc#3378 * Rename autofix reasoning role to AwsLcGitHubActionsBedrockRole by @tianyiy-tim in aws/aws-lc#3376 * ci: pin openssh required job by @dougch in aws/aws-lc#3387 * delocate: Drop redundant `-dI` flag by @hanno-becker in aws/aws-lc#3384 * Add Neoverse-V3 (Graviton5) detection and dispatch by @nebeid in aws/aws-lc#3374 * Bump ring from 0.17.8 to 0.17.14 in /tests/ci/lambda by @dependabot[bot] in aws/aws-lc#3375 * Fix docker image dependencies and update octocrab initialization by @prasden in aws/aws-lc#3388 * Update FIPS.md by @justsmth in aws/aws-lc#3382 * Bump urllib3 from 2.6.3 to 2.7.0 in /tests/ci by @dependabot[bot] in aws/aws-lc#3372 * Add MinGW shared-library Windows CI coverage by @justsmth in aws/aws-lc#3398 * Update concurrency in `security-review` by @nhatnghiho in aws/aws-lc#3403 * Enable linker garbage collection for non-FIPS static builds by @justsmth in aws/aws-lc#3397 * Prepare 5.5.0 by @justsmth in aws/aws-lc#3401 ## New Contributors * @tianyiy-tim made their first contribution in aws/aws-lc#3376 **Full Changelog**: https://github.com/aws/aws-lc/compare/v5.4.0...v5.5.0</pre> <p>View the full release notes at <a href="https://github.com/aws/aws-lc/releases/tag/v5.5.0">https://github.com/aws/aws-lc/releases/tag/v5.5.0</a>.</p> </details> <hr> See merge request: Harmonybrew/homebrew-core!15934
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
openssh-portable commit
ddbcd8faddedmlkem768brainpoolp256r1-sha256to master. AWS-LC definesNID_brainpoolP256r1innid.hbut does not implement the Brainpool P-256 curve in its EC backend, soEC_KEY_new_by_curve_name(NID_brainpoolP256r1)returns NULL at runtime. Therekey.shregression test builds its KEX list viassh -Q kex, which now includes the new algorithm, causing cascading failures across all AEAD ciphers.The
mlkem768nistp256-sha256algorithm added in the same upstream batch786cb6aworks correctly since P-256 is fully implemented in AWS-LC.Follows the pattern established for grpc (#3331) and libssh2 (#3343):
V_10_4_P1(last known-good release)openssh-masterjobs back withallow_failure: trueto keep tracking upstream without blocking PRsAlso simplifies
run_openssh_integration.sh:$1(defaulting tomaster)checkout_openssh_branchhelper andOPENSSH_BRANCHenv wiring that are no longer neededRelated #3286
Branch protection changes
The required checks for
openssh-master-x86_64andopenssh-master-aarch64were dropped, andopenssh-10.4p1-x86_64andopenssh-10.4p1-aarch64were marked required.Testing
openssh-10.4p1x86_64 and aarch64 jobs passopenssh-v8.9x86_64 and aarch64 jobs passopenssh-masterx86_64 and aarch64 jobs are non-blocking (allowed to fail)By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.