feat(bindings): add external psk apis by jmayclin · Pull Request #5061 · aws/s2n-tls

jmayclin · 2025-01-27T16:15:23Z

Release Summary:

Add bindings for the External PSK functionality.

Description of changes:

This feature adds External PSK functionality to the s2n-tls bindings.

Update 2024-02-05: The refactor was a bit large, so I removed that from this PR and will be added it as a separate follow on.

Call-outs:

I've always found the Resumption/PSK/SessionTicket stuff kinda confusing, so I named the main struct ExternalPSK instead of just PSK (Psk?).
I made the HMAC parameter mandatory, because it seems like defaults always end up causing us trouble.
OfferedPsk/OfferedPskList are both implemented in the callbacks module rather than the external_psk module which seems a little bit odd, but I think it's the option most consistent with the existing codebase.
This PR doesn't add early data functionality to keep the size of the PR more reasonable. However all of the APIs are expected to neatly fit into the builder pattern.

Testing

Unit tests are added covering the new functionality. Additionally, I wrote examples showing how to use this functionality, but it was a bit large to fit into one PR so you can see that here.

New APIs

Just listing the new public APIs methods here, from cargo +stable public-api diff latest -p s2n-tls | grep "("

+pub fn s2n_tls::connection::Connection::append_psk(&mut self, psk: &s2n_tls::external_psk::Psk) -> core::result::Result<(), s2n_tls::error::Error>
+pub fn s2n_tls::connection::Connection::negotiated_psk_identity(&self, destination: &mut [u8]) -> core::result::Result<(), s2n_tls::error::Error>
+pub fn s2n_tls::connection::Connection::negotiated_psk_identity_length(&self) -> core::result::Result<usize, s2n_tls::error::Error>
+pub fn s2n_tls_sys::api::s2n_psk_hmac::Type::from(input: s2n_tls::enums::PskHmac) -> Self
+pub fn s2n_tls::enums::PskHmac::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+pub fn s2n_tls::enums::PskHmac::into(self) -> U
+pub fn s2n_tls::enums::PskHmac::try_from(value: U) -> core::result::Result<T, <T as core::convert::TryFrom<U>>::Error>
+pub fn s2n_tls::enums::PskHmac::try_into(self) -> core::result::Result<U, <U as core::convert::TryFrom<T>>::Error>
+pub fn s2n_tls::enums::PskHmac::type_id(&self) -> core::any::TypeId
+pub fn s2n_tls::enums::PskHmac::borrow(&self) -> &T
+pub fn s2n_tls::enums::PskHmac::borrow_mut(&mut self) -> &mut T
+pub fn s2n_tls::enums::PskHmac::from(t: T) -> T
+pub fn s2n_tls_sys::api::s2n_psk_mode::Type::from(input: s2n_tls::enums::PskMode) -> Self
+pub fn s2n_tls::enums::PskMode::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+pub fn s2n_tls::enums::PskMode::into(self) -> U
+pub fn s2n_tls::enums::PskMode::try_from(value: U) -> core::result::Result<T, <T as core::convert::TryFrom<U>>::Error>
+pub fn s2n_tls::enums::PskMode::try_into(self) -> core::result::Result<U, <U as core::convert::TryFrom<T>>::Error>
+pub fn s2n_tls::enums::PskMode::type_id(&self) -> core::any::TypeId
+pub fn s2n_tls::enums::PskMode::borrow(&self) -> &T
+pub fn s2n_tls::enums::PskMode::borrow_mut(&mut self) -> &mut T
+pub fn s2n_tls::enums::PskMode::from(t: T) -> T
+pub fn s2n_tls::external_psk::Builder::build(self) -> core::result::Result<s2n_tls::external_psk::Psk, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Builder::new() -> core::result::Result<Self, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Builder::with_hmac(&mut self, hmac: s2n_tls::enums::PskHmac) -> core::result::Result<&mut Self, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Builder::with_identity(&mut self, identity: &[u8]) -> core::result::Result<&mut Self, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Builder::with_secret(&mut self, secret: &[u8]) -> core::result::Result<&mut Self, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Builder::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+pub fn s2n_tls::external_psk::Builder::into(self) -> U
+pub fn s2n_tls::external_psk::Builder::try_from(value: U) -> core::result::Result<T, <T as core::convert::TryFrom<U>>::Error>
+pub fn s2n_tls::external_psk::Builder::try_into(self) -> core::result::Result<U, <U as core::convert::TryFrom<T>>::Error>
+pub fn s2n_tls::external_psk::Builder::type_id(&self) -> core::any::TypeId
+pub fn s2n_tls::external_psk::Builder::borrow(&self) -> &T
+pub fn s2n_tls::external_psk::Builder::borrow_mut(&mut self) -> &mut T
+pub fn s2n_tls::external_psk::Builder::from(t: T) -> T
+pub fn s2n_tls::external_psk::Psk::builder() -> core::result::Result<s2n_tls::external_psk::Builder, s2n_tls::error::Error>
+pub fn s2n_tls::external_psk::Psk::fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result
+pub fn s2n_tls::external_psk::Psk::drop(&mut self)
+pub fn s2n_tls::external_psk::Psk::into(self) -> U
+pub fn s2n_tls::external_psk::Psk::try_from(value: U) -> core::result::Result<T, <T as core::convert::TryFrom<U>>::Error>
+pub fn s2n_tls::external_psk::Psk::try_into(self) -> core::result::Result<U, <U as core::convert::TryFrom<T>>::Error>
+pub fn s2n_tls::external_psk::Psk::type_id(&self) -> core::any::TypeId
+pub fn s2n_tls::external_psk::Psk::borrow(&self) -> &T
+pub fn s2n_tls::external_psk::Psk::borrow_mut(&mut self) -> &mut T
+pub fn s2n_tls::external_psk::Psk::from(t: T) -> T

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Mark-Simulacrum

Some initial comments, I want to do another review but ran out of time for today.

bindings/rust/extended/s2n-tls/src/foreign_types.rs

Mark-Simulacrum · 2025-01-27T21:58:54Z

bindings/rust/extended/s2n-tls/src/foreign_types.rs

+// This type acts as if it owns a *mutable pointer to a zero sized type, where
+// that type may implement un-synchronized interior mutability.
+#[derive(Debug)]
+pub(crate) struct Opaque(PhantomData<UnsafeCell<*mut ()>>);


This type definition is pretty weird. *mut () already has !Send/!Sync impls... I guess the UnsafeCell is adding !Freeze, but that shouldn't ever matter -- after all, this is a pointer to the opaque type, right?

I guess this gets used as &Opaque/&mut Opaque? I'd sort of expect either c_void here or just struct $struct_name { _priv: () }.

I actually don't think that the UnsafeCell adds !Freeze.

Some interesting discussion here: sfackler/foreign-types#24
And also here: rust-lang/unsafe-code-guidelines#236 (comment)

I figured it was useful for documentation purposes. But I like the c_void approach. Will take that in the next iteration.

bindings/rust/extended/s2n-tls/src/callbacks/external_psk.rs

Mark-Simulacrum · 2025-01-27T22:47:31Z

bindings/rust/extended/s2n-tls/src/callbacks/external_psk.rs

+    }
+
+    /// Advance the cursor, returning the currently selected PSK.
+    pub fn advance(&mut self) -> Result<Option<&OfferedPsk>, crate::error::Error> {


I might call this next() since it's basically the Iterator API, just a lending iterator which borrows from &self.

I did consider that, but I worry that next is a bit leading because it doesn't imply the side effect of updating the "currently selected" PSK.

bindings/rust/extended/s2n-tls/src/callbacks/external_psk.rs

bindings/rust/extended/s2n-tls/src/connection.rs

bindings/rust/extended/s2n-tls/src/enums.rs

* use &mut instead of addr_of * use null mut instead of cast * use Relaxed instead of SeqCst for single threaded atomics * min for safe cast to u16 * correct mut type * add non-exhaustive and debug to enum

* document not calling choose psk * accept mut reference

* add safety comment for slice from raw parts. * separate send + sync from macro

bindings/rust/extended/s2n-tls/src/callbacks.rs

bindings/rust/extended/s2n-tls/src/connection.rs

bindings/rust/extended/s2n-tls/src/external_psk.rs

* return iterator over identities * add offered psk selector to prevent future breakage

bindings/rust/extended/s2n-tls/src/callbacks/psk_selection.rs

Mark-Simulacrum · 2025-02-05T15:01:45Z

bindings/rust/extended/s2n-tls/src/callbacks/psk_selection.rs

+    /// Before calling [OfferedPskCursor::choose_current_psk], implementors must
+    /// first append the corresponding [crate::external_psk::ExternalPsk] to the
+    /// connection using [Connection::append_psk].
+    fn select_psk(&self, connection: &mut Connection, psk_list: &mut OfferedPskListRef);


Docs are stale (OfferedPskCursor vs OfferedPskListRef) -- but I'd avoid "Ref" in the type we expose to users, I'm not sure that's a good name.

Updated the docs.

I agree that it's a mouthful, but I expect that we will be using the pattern more going forward (like the OpenSSL crate does), and if we use this pattern for a pointer that has two ownership modes, then I think the Ref patten is the easiest way to distinguish them.

E.g. this pattern could be used for s2n_client_hello

// returns an owned struct with a drop impl that frees the `s2n_client_hello` ClientHello::parse_client_hello -> ClientHello // returns a "reference" created from the s2n_client_hello pointer. This can't be dropped, because the // memory is owned by the connection. The "Ref" pattern ensures that. connection.client_hello -> &ClientHelloRef

Although I can't imagine a scenario where we'd ever expose an owned OfferedPskList, so maybe the disambiguation isn't necessary? But the "Ref" approach seems to offer a bit more flexibility in the future, so I'm leaning towards that.

bindings/rust/extended/s2n-tls/src/callbacks/psk_selection.rs

Mark-Simulacrum · 2025-02-05T15:08:41Z

bindings/rust/extended/s2n-tls/src/callbacks/psk_selection.rs

+    /// Choose the currently selected PSK to negotiate with.
+    ///
+    /// If no offered PSK is acceptable, implementors can return from the callback
+    /// without calling this function to reject the connection.


If there were no offered PSKs, what is the behavior of calling choose_current_psk in the "-1" slot (i.e., immediately calling that on creation without calling next?).

This is covered in the choose_empty_psk test (renamed to choose_without_current_psk). A well-formed error is returned by s2n-tls, although it's unfortunately an "internal error": #5085.

bindings/rust/extended/s2n-tls/src/config.rs

* callback/selectors typo * more explicit choose documentation * rename rewind to reset * reference the identity selector in the select_psk docs * use &mut instead of addr_of * rename using test to "without_current" psk

* context associated with callback should be derived from immutable ref

bindings/rust/extended/s2n-tls/src/external_psk.rs

bindings/rust/extended/s2n-tls/src/foreign_types.rs

bindings/rust/extended/s2n-tls/src/external_psk.rs

bindings/rust/extended/s2n-tls/src/foreign_types.rs

* remove foreign types module * remove macro * rename ExternalPsk -> Psk

camshaft · 2025-02-06T02:32:14Z

bindings/rust/extended/s2n-tls/src/connection.rs

+    pub fn append_psk(&mut self, psk: &Psk) -> Result<(), Error> {
+        unsafe {
+            // SAFETY: *mut cast - s2n-tls does not treat the pointer as mutable.
+            s2n_connection_append_psk(self.as_ptr(), psk.as_s2n_ptr() as *mut _).into_result()?


I think it would be better to get the mutable pointer directly rather than casting *const -> *mut.

Assumption: There is an intention that s2n-tls C API's be const correct, but we just aren't there yet.

Given that this takes a &Psk, I wanted a visible red flag that we are casting away the "logical constness" of the underlying data.

Let me know if you think the the friction is causing more noise than safety, and I'll go ahead and make as_s2n_ptr_mut take in &self and just add a comment about the safety.

Yeah I worry about allowing *const -> *mut casts in general... I think it's better to just return the *mut directly from NonNull and have some safety comments around it all.

* rename external_psk module to psk

bindings/rust/extended/s2n-tls/src/psk.rs

codebuild/bin/grep_simple_mistakes.sh

* remove monospaced api references

bindings/rust/extended/s2n-tls/src/psk.rs

* rename builder methods to set_* * directly retrieve mutable pointer from `ptr` * add comment about safety/reason for doing so

- Enables `-Wa,-mbranches-within-32B-boundaries` only on x86 with GCC ≥8 - Skips it for Clang or unsupported compilers - Uses feature probing to detect support ci: remove S2N_TEST_IN_FIPS_MODE (aws#4994) Migrate PQ Rust code to TLS 1.3 (aws#4998) chore: add new team member (aws#5006) chore(s2n-tls-hyper): Publish s2n-tls-hyper (aws#5000) ci: add script to help launch stuck codebuild jobs (aws#5004) ci: config logging for integration tests (aws#4751) Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> Migrate PQ Python code to TLS 1.3 (aws#4999) fix: don't prefix empty string when interning (aws#5015) chore: remove unused imports (aws#5017) fix(bindings/bench): Prevent IO from going out of scope (aws#5007) ci: commit integrationv2 small batch spec (aws#5020) ci: keep start_codebuild.sh up-to-date (aws#5023) chore: remove unused test utils (aws#5005) ci: improve output of validate_start_codebuild_script (aws#5031) refactor(bin): remove references to FIPS_mode_set (aws#5026) chore: improve the dashboard comment query (aws#5016) tests: make integV2 locally runnable (aws#5029) feature: remove openssl-1.0.2-fips fips mode support (aws#5030) chore: run more checks on pushes to main (aws#4963) fix: add build specs to copyright check (aws#5025) fix(bindings): Specify correct minimum versions (aws#5028) ci: add timeout for cbmc proof (aws#5038) Co-authored-by: Boquan Fang <bqfang@amazon.com> test: add sslv2 client hello test w/ jvm (aws#5019) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> docs: add C / s2n-tls-sys doc references to s2n-tls docs (aws#5012) Add Security Policy Deprecation API (aws#5034) Co-authored-by: James Mayclin <maycj@amazon.com> Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> ci: add openssl-3.0-fips builds (aws#5037) fix: initial config should not influence sslv2 (aws#4987) Co-authored-by: maddeleine <59030281+maddeleine@users.noreply.github.com> chore: bindings release for 0.3.10 (aws#5046) Co-authored-by: Boquan Fang <bqfang@amazon.com> chore: bump osx Openssl to latest (aws#5041) Signed-off-by: Rui Chen <rui@chenrui.dev> Co-authored-by: Rui Chen <rui@chenrui.dev> chore: fix typos (aws#5052) build(deps): bump cross-platform-actions/action from 0.26.0 to 0.27.0 in /.github/workflows in the all-gha-updates group (aws#5053) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> ci: pin duvet version (aws#5057) refactor: remove openssl-1.0.2-fips 'allow md5' logic (aws#5048) ci: Adding integ tests back to integv2 (aws#5054) refactor: cleanup CBMC proofs after aws#5048 (aws#5058) feat(bench): impl into for base config type (aws#5056) Revert "ci: remove openssl-1.0.2-fips builds (aws#4995)" (aws#5060) ci: change rust-toolchain format to toml (aws#5070) ci: Emit benchmark metrics from scheduled runs (aws#5064) fix(bindings): prevent temp connection free after panic (aws#5067) docs(integv2): add architecture diagram (aws#5072) docs(s2n-tls-hyper): Add hyper client/server example (aws#5069) ci: fix dependabot, commit & check Cargo.toml (aws#5065) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> fix(integration): Update PQ integration test expectations (aws#5082) fix: add support for `S2N_INTERN_LIBCRYPTO` with FetchContent (aws#5076) fix: calculation of session ticket age (aws#5001) Co-authored-by: Boquan Fang <bqfang@amazon.com> fix: error for uninit psk, check for all-zero psk (aws#5084) fix: don't use DEPENDS with add_custom_command(TARGET) (aws#5074) fix(ci): Allow validate_start_codebuild to run on pushes to main (aws#5080) test: add minimal openssl-3.0-fips test (aws#5081) feat(bindings): add external psk apis (aws#5061) Fixed formatting for debugging statements (aws#5094) chore: ktls buildspec (aws#5083) chore: bindings release 0.3.11 (aws#5098) fix(integrationv2): Skip unsupported client auth tests (aws#5096) Co-authored-by: James Mayclin <maycj@amazon.com> build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 4.1.0 in /.github/workflows in the all-gha-updates group across 1 directory (aws#5107) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> refactor: remove s2n_hmac_is_available (aws#5104) refactor: remove unused evp support for md5+sha1 (aws#5106) fix: allow b64 decoding using libcrypto for sidechannel resistance (aws#5103) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> fix: don't enable custom random for openssl fips (aws#5093) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> ci: add default provider to openssl-3.0-fips (aws#5114) Revert "refactor: remove unused evp support for md5+sha1 (aws#5106)" (aws#5118) Add new security policy (20250211) (aws#5111) refactor: move "s2n_libcrypto_is" methods into s2n_libcrypto.h (aws#5117) bindings: unpin openssl crate from a specific patch version (aws#5120) Co-authored-by: Boquan Fang <bqfang@amazon.com> chore: fix a typo in API comments (aws#5123) Co-authored-by: Boquan Fang <bqfang@amazon.com> build(deps): update rand requirement (aws#5125) Co-authored-by: Boquan Fang <bqfang@amazon.com> fix(bindings): make Context borrow immutable (aws#5071) feat: Option to disable RAND engine override (aws#5108) refactor: use EVP_MD_fetch() if available (aws#5116) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> chore: binding release 0.3.12 (aws#5128) Co-authored-by: Boquan Fang <bqfang@amazon.com> fix(bindings): remove mutation behind Arc (aws#5124) chore: remove unused well-known-endpoints.py (aws#5127) feat: add async cert validation support (aws#5110) ci: add check for third-party-src in disable rand override buildspec (aws#5137) Co-authored-by: Boquan Fang <bqfang@amazon.com> refactor: always use EVP hashing (aws#5121) fix: update callback return value (aws#5136) ci: always set values for command line defines (aws#5126) tests: use sig schemes as source of truth for valid hash+sig algs (aws#5129) build(deps): update rtshark requirement from 2.9.0 to 3.1.0 in /tests/pcap in the all-cargo-updates group across 1 directory (aws#5087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> test(integv2): fixes to allow test_record_padding to partially run (aws#5099) Co-authored-by: James Mayclin <maycj@amazon.com> chore(nix): Add aws-lc-fips 2022/4 (aws#5109) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> Ruff Formatting and add to CI (aws#5138) Co-authored-by: James Mayclin <maycj@amazon.com> feat(bindings): expose context on cert chain (aws#5132) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> refactor: cleanup prf header (aws#5144) refactor: add alternative EVP signing method (aws#5141) fix: memory leak during STEK rotation (aws#5146) chore(ci): make the awslc fips install script version aware (aws#5100) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> refactor: remove unused prf hmac impls (aws#5148) chore(bindings): change in rustup behavior (aws#5160) chore: git-blame-ignore ruff formatting (aws#5151) tests: try to make s2n_mem_usage_test more useful (aws#5139) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> chore(ci): pin symbolic-common (aws#5166) chore: binding release 0.3.13 (aws#5167) refactor: add libcrypto PRF impl for openssl-3.0-fips (aws#5158) build(deps): bump nixbuild/nix-quick-install-action from 29 to 30 in /.github/workflows in the all-gha-updates group (aws#5153) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> style: fix redundant return (aws#5150) chore: update git blame ignore commit ID (aws#5164) tests: fix flaky ja4 test (aws#5169) fix: mark chachapoly as unavailable with openssl-3.0-fips (aws#5168) fix(ruff): resolve linting errors detected by Ruff (aws#5140) chore: pin once_cell version to unblock the CI (aws#5174) Co-authored-by: Boquan Fang <bqfang@amazon.com> ci: use ruff --diff instead of --check (aws#5177) (docs): Improve PQ docs (aws#5173) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> test(integv2): add partial support for OpenSSL 3.0 provider (aws#5131) Co-authored-by: James Mayclin <maycj@amazon.com> ci: make start_codebuild.sh work for forks (aws#5178) chore: add inline noqa suppression (aws#5159) test: reduce parameter selection (aws#5161) test: fix self-talk pkey offload test for openssl-3.0-fips (aws#5175) build(deps): update aws-lc-rs version to remove paste deps (aws#5192) Co-authored-by: Boquan Fang <bqfang@amazon.com> chore: bump linting action Ubuntu version (aws#5186) Co-authored-by: Boquan Fang <bqfang@amazon.com> ci: cleanup awslc-fips versioning (aws#5156) chore: include Need By Date section in github issue template (aws#5187) Co-authored-by: Boquan Fang <bqfang@amazon.com> ci: move openssl3fips build to existing asan build (aws#5181) fix: openssl-3.0-fips should use separate private rand (aws#5184) fix: remove unnecessary RC4 restriction (aws#5170) fix: openssl-3.0-fips should use libcrypto HKDF (aws#5183) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> ci: defend against unset version number in awslc installer (aws#5195) feature: openssl-3.0-fips support (aws#5191) ci: add libcrypto openssl-3.0-fips to integ tests (aws#5202) ci: add openssl-3.0-fips to asan build properly (aws#5204) fix: handshake message length integer overflow in s2n_handshake_finish_header (aws#5206) Co-authored-by: Boquan Fang <bqfang@amazon.com> chore: deprecate s2n_set (aws#5155) chore: binding release 0.3.14 (aws#5210) Remove PQ TLS 1.2 from all Security Policies (aws#5194) ci: exclude new setuptools (aws#5215) fix: Update README.md to include Rust bindings docs (aws#5212) feat: add s2n_connection_get_key_exchange_group (aws#5209) chore: bindings release 0.3.15 (aws#5221) ci: add openssl-3.0-fips to valgrind (aws#5211) docs: fix openssl-3.0-fips provider requirements documentation (aws#5214) refactor(bindings): use implicit linking for aws-lc (aws#5218) fix: tighten session ticket lifetime (aws#5217) ci: Fix cppcheck build (aws#5238) refactor: implement match the same for all pkeys (aws#5224) ci: add openssl-3.0-fips to general batch (aws#5207) refactor: add evp pkey size/encrypt/decrypt methods (aws#5225) feat(bindings): expose certificate match api (aws#5220) Co-authored-by: James Mayclin <maycj@amazon.com> ci: add ruff linting (aws#5182) ci: pin nix installer to older version (aws#5245) chore: Fix new clippy warning (aws#5243) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> ci: rebalance integV2 testcases (aws#5232) fix: tainted handshake.io and add large client hello test (aws#5208) Co-authored-by: Boquan Fang <bqfang@amazon.com> chore: bindings release 0.3.16 (aws#5242) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> refactor: remove legacy pkey impls (aws#5241) Revert "ci: exclude new setuptools (aws#5215)" (aws#5226) fix: make -fPIC flag private (aws#5227) Co-authored-by: Souvik Banerjee <souvik1997@gmail.com> doc: tainted stuffer reset operation (aws#5231) Co-authored-by: Boquan Fang <bqfang@amazon.com> feat: Expose `as_ptr()` for external build (aws#5229) ci: pytest generate junit reports (aws#5235) add compiler flag added c check x86 and correct compiler cmake fix testing removed clang Print statements compiler check print find clang branch probing removed individual probing removed old unneeded changes added back original line fixed .c file ci: use correct openssl version for updated AL2023 version (aws#5255) chore(ci): revert nix installer pin (aws#5251) ci: add awslcfips to nix jobs (aws#5205) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> moved adding options to the bottom copmiler debug prints clang printout remove setting compiler to clang set clang as default remove clang move fuzz cmake into it's own directory fixed path to fuzz back to original only branch if we're not fuzz tests add clang back now removed debugging prints removed checking for compiler testing move back original block removed feature probe messaging because we already have them

# This is the 1st commit message: ci: remove S2N_TEST_IN_FIPS_MODE (aws#4994) # This is the commit message aws#2: Migrate PQ Rust code to TLS 1.3 (aws#4998) # This is the commit message aws#3: chore: add new team member (aws#5006) # This is the commit message aws#4: chore(s2n-tls-hyper): Publish s2n-tls-hyper (aws#5000) # This is the commit message aws#5: ci: add script to help launch stuck codebuild jobs (aws#5004) # This is the commit message aws#6: ci: config logging for integration tests (aws#4751) Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> # This is the commit message aws#7: Migrate PQ Python code to TLS 1.3 (aws#4999) # This is the commit message aws#8: fix: don't prefix empty string when interning (aws#5015) # This is the commit message aws#9: chore: remove unused imports (aws#5017) # This is the commit message aws#10: fix(bindings/bench): Prevent IO from going out of scope (aws#5007) # This is the commit message aws#11: ci: commit integrationv2 small batch spec (aws#5020) # This is the commit message aws#12: ci: keep start_codebuild.sh up-to-date (aws#5023) # This is the commit message aws#13: chore: remove unused test utils (aws#5005) # This is the commit message aws#14: ci: improve output of validate_start_codebuild_script (aws#5031) # This is the commit message aws#15: refactor(bin): remove references to FIPS_mode_set (aws#5026) # This is the commit message aws#16: chore: improve the dashboard comment query (aws#5016) # This is the commit message aws#17: tests: make integV2 locally runnable (aws#5029) # This is the commit message aws#18: feature: remove openssl-1.0.2-fips fips mode support (aws#5030) # This is the commit message aws#19: chore: run more checks on pushes to main (aws#4963) # This is the commit message aws#20: fix: add build specs to copyright check (aws#5025) # This is the commit message aws#21: fix(bindings): Specify correct minimum versions (aws#5028) # This is the commit message aws#22: ci: add timeout for cbmc proof (aws#5038) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#23: test: add sslv2 client hello test w/ jvm (aws#5019) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#24: docs: add C / s2n-tls-sys doc references to s2n-tls docs (aws#5012) # This is the commit message aws#25: Add Security Policy Deprecation API (aws#5034) Co-authored-by: James Mayclin <maycj@amazon.com> Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#26: ci: add openssl-3.0-fips builds (aws#5037) # This is the commit message aws#27: fix: initial config should not influence sslv2 (aws#4987) Co-authored-by: maddeleine <59030281+maddeleine@users.noreply.github.com> # This is the commit message aws#28: chore: bindings release for 0.3.10 (aws#5046) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#29: chore: bump osx Openssl to latest (aws#5041) Signed-off-by: Rui Chen <rui@chenrui.dev> Co-authored-by: Rui Chen <rui@chenrui.dev> # This is the commit message aws#30: chore: fix typos (aws#5052) # This is the commit message aws#31: build(deps): bump cross-platform-actions/action from 0.26.0 to 0.27.0 in /.github/workflows in the all-gha-updates group (aws#5053) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#32: ci: pin duvet version (aws#5057) # This is the commit message aws#33: refactor: remove openssl-1.0.2-fips 'allow md5' logic (aws#5048) # This is the commit message aws#34: ci: Adding integ tests back to integv2 (aws#5054) # This is the commit message aws#35: refactor: cleanup CBMC proofs after aws#5048 (aws#5058) # This is the commit message aws#36: feat(bench): impl into for base config type (aws#5056) # This is the commit message aws#37: Revert "ci: remove openssl-1.0.2-fips builds (aws#4995)" (aws#5060) # This is the commit message aws#38: ci: change rust-toolchain format to toml (aws#5070) # This is the commit message aws#39: ci: Emit benchmark metrics from scheduled runs (aws#5064) # This is the commit message aws#40: fix(bindings): prevent temp connection free after panic (aws#5067) # This is the commit message aws#41: docs(integv2): add architecture diagram (aws#5072) # This is the commit message aws#42: docs(s2n-tls-hyper): Add hyper client/server example (aws#5069) # This is the commit message aws#43: ci: fix dependabot, commit & check Cargo.toml (aws#5065) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#44: fix(integration): Update PQ integration test expectations (aws#5082) # This is the commit message aws#45: fix: add support for `S2N_INTERN_LIBCRYPTO` with FetchContent (aws#5076) # This is the commit message aws#46: fix: calculation of session ticket age (aws#5001) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#47: fix: error for uninit psk, check for all-zero psk (aws#5084) # This is the commit message aws#48: fix: don't use DEPENDS with add_custom_command(TARGET) (aws#5074) # This is the commit message aws#49: fix(ci): Allow validate_start_codebuild to run on pushes to main (aws#5080) # This is the commit message aws#50: test: add minimal openssl-3.0-fips test (aws#5081) # This is the commit message aws#51: feat(bindings): add external psk apis (aws#5061) # This is the commit message aws#52: Fixed formatting for debugging statements (aws#5094) # This is the commit message aws#53: chore: ktls buildspec (aws#5083) # This is the commit message aws#54: chore: bindings release 0.3.11 (aws#5098) # This is the commit message aws#55: fix(integrationv2): Skip unsupported client auth tests (aws#5096) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#56: build(deps): bump aws-actions/configure-aws-credentials from 4.0.2 to 4.1.0 in /.github/workflows in the all-gha-updates group across 1 directory (aws#5107) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#57: refactor: remove s2n_hmac_is_available (aws#5104) # This is the commit message aws#58: refactor: remove unused evp support for md5+sha1 (aws#5106) # This is the commit message aws#59: fix: allow b64 decoding using libcrypto for sidechannel resistance (aws#5103) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> Co-authored-by: Doug Chapman <54039637+dougch@users.noreply.github.com> # This is the commit message aws#60: fix: don't enable custom random for openssl fips (aws#5093) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#61: ci: add default provider to openssl-3.0-fips (aws#5114) # This is the commit message aws#62: Revert "refactor: remove unused evp support for md5+sha1 (aws#5106)" (aws#5118) # This is the commit message aws#63: Add new security policy (20250211) (aws#5111) # This is the commit message aws#64: refactor: move "s2n_libcrypto_is" methods into s2n_libcrypto.h (aws#5117) # This is the commit message aws#65: bindings: unpin openssl crate from a specific patch version (aws#5120) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#66: chore: fix a typo in API comments (aws#5123) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#67: build(deps): update rand requirement (aws#5125) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#68: fix(bindings): make Context borrow immutable (aws#5071) # This is the commit message aws#69: feat: Option to disable RAND engine override (aws#5108) # This is the commit message aws#70: refactor: use EVP_MD_fetch() if available (aws#5116) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#71: chore: binding release 0.3.12 (aws#5128) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#72: fix(bindings): remove mutation behind Arc (aws#5124) # This is the commit message aws#73: chore: remove unused well-known-endpoints.py (aws#5127) # This is the commit message aws#74: feat: add async cert validation support (aws#5110) # This is the commit message aws#75: ci: add check for third-party-src in disable rand override buildspec (aws#5137) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#76: refactor: always use EVP hashing (aws#5121) # This is the commit message aws#77: fix: update callback return value (aws#5136) # This is the commit message aws#78: ci: always set values for command line defines (aws#5126) # This is the commit message aws#79: tests: use sig schemes as source of truth for valid hash+sig algs (aws#5129) # This is the commit message aws#80: build(deps): update rtshark requirement from 2.9.0 to 3.1.0 in /tests/pcap in the all-cargo-updates group across 1 directory (aws#5087) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#81: test(integv2): fixes to allow test_record_padding to partially run (aws#5099) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#82: chore(nix): Add aws-lc-fips 2022/4 (aws#5109) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> # This is the commit message aws#83: Ruff Formatting and add to CI (aws#5138) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#84: feat(bindings): expose context on cert chain (aws#5132) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#85: refactor: cleanup prf header (aws#5144) # This is the commit message aws#86: refactor: add alternative EVP signing method (aws#5141) # This is the commit message aws#87: fix: memory leak during STEK rotation (aws#5146) # This is the commit message aws#88: chore(ci): make the awslc fips install script version aware (aws#5100) Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com> Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#89: refactor: remove unused prf hmac impls (aws#5148) # This is the commit message aws#90: chore(bindings): change in rustup behavior (aws#5160) # This is the commit message aws#91: chore: git-blame-ignore ruff formatting (aws#5151) # This is the commit message aws#92: tests: try to make s2n_mem_usage_test more useful (aws#5139) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#93: chore(ci): pin symbolic-common (aws#5166) # This is the commit message aws#94: chore: binding release 0.3.13 (aws#5167) # This is the commit message aws#95: refactor: add libcrypto PRF impl for openssl-3.0-fips (aws#5158) # This is the commit message aws#96: build(deps): bump nixbuild/nix-quick-install-action from 29 to 30 in /.github/workflows in the all-gha-updates group (aws#5153) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> # This is the commit message aws#97: style: fix redundant return (aws#5150) # This is the commit message aws#98: chore: update git blame ignore commit ID (aws#5164) # This is the commit message aws#99: tests: fix flaky ja4 test (aws#5169) # This is the commit message aws#100: fix: mark chachapoly as unavailable with openssl-3.0-fips (aws#5168) # This is the commit message aws#101: fix(ruff): resolve linting errors detected by Ruff (aws#5140) # This is the commit message aws#102: chore: pin once_cell version to unblock the CI (aws#5174) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#103: ci: use ruff --diff instead of --check (aws#5177) # This is the commit message aws#104: (docs): Improve PQ docs (aws#5173) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#105: test(integv2): add partial support for OpenSSL 3.0 provider (aws#5131) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#106: ci: make start_codebuild.sh work for forks (aws#5178) # This is the commit message aws#107: chore: add inline noqa suppression (aws#5159) # This is the commit message aws#108: test: reduce parameter selection (aws#5161) # This is the commit message aws#109: test: fix self-talk pkey offload test for openssl-3.0-fips (aws#5175) # This is the commit message aws#110: build(deps): update aws-lc-rs version to remove paste deps (aws#5192) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#111: chore: bump linting action Ubuntu version (aws#5186) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#112: ci: cleanup awslc-fips versioning (aws#5156) # This is the commit message aws#113: chore: include Need By Date section in github issue template (aws#5187) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#114: ci: move openssl3fips build to existing asan build (aws#5181) # This is the commit message aws#115: fix: openssl-3.0-fips should use separate private rand (aws#5184) # This is the commit message aws#116: fix: remove unnecessary RC4 restriction (aws#5170) # This is the commit message aws#117: fix: openssl-3.0-fips should use libcrypto HKDF (aws#5183) Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com> # This is the commit message aws#118: ci: defend against unset version number in awslc installer (aws#5195) # This is the commit message aws#119: feature: openssl-3.0-fips support (aws#5191) # This is the commit message aws#120: ci: add libcrypto openssl-3.0-fips to integ tests (aws#5202) # This is the commit message aws#121: ci: add openssl-3.0-fips to asan build properly (aws#5204) # This is the commit message aws#122: fix: handshake message length integer overflow in s2n_handshake_finish_header (aws#5206) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#123: chore: deprecate s2n_set (aws#5155) # This is the commit message aws#124: chore: binding release 0.3.14 (aws#5210) # This is the commit message aws#125: Remove PQ TLS 1.2 from all Security Policies (aws#5194) # This is the commit message aws#126: ci: exclude new setuptools (aws#5215) # This is the commit message aws#127: fix: Update README.md to include Rust bindings docs (aws#5212) # This is the commit message aws#128: feat: add s2n_connection_get_key_exchange_group (aws#5209) # This is the commit message aws#129: chore: bindings release 0.3.15 (aws#5221) # This is the commit message aws#130: ci: add openssl-3.0-fips to valgrind (aws#5211) # This is the commit message aws#131: docs: fix openssl-3.0-fips provider requirements documentation (aws#5214) # This is the commit message aws#132: refactor(bindings): use implicit linking for aws-lc (aws#5218) # This is the commit message aws#133: fix: tighten session ticket lifetime (aws#5217) # This is the commit message aws#134: ci: Fix cppcheck build (aws#5238) # This is the commit message aws#135: refactor: implement match the same for all pkeys (aws#5224) # This is the commit message aws#136: ci: add openssl-3.0-fips to general batch (aws#5207) # This is the commit message aws#137: refactor: add evp pkey size/encrypt/decrypt methods (aws#5225) # This is the commit message aws#138: feat(bindings): expose certificate match api (aws#5220) Co-authored-by: James Mayclin <maycj@amazon.com> # This is the commit message aws#139: ci: add ruff linting (aws#5182) # This is the commit message aws#140: ci: pin nix installer to older version (aws#5245) # This is the commit message aws#141: chore: Fix new clippy warning (aws#5243) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> # This is the commit message aws#142: ci: rebalance integV2 testcases (aws#5232) # This is the commit message aws#143: fix: tainted handshake.io and add large client hello test (aws#5208) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#144: chore: bindings release 0.3.16 (aws#5242) Co-authored-by: Boquan Fang <boquanfang3@gmail.com> # This is the commit message aws#145: refactor: remove legacy pkey impls (aws#5241) # This is the commit message aws#146: Revert "ci: exclude new setuptools (aws#5215)" (aws#5226) # This is the commit message aws#147: fix: make -fPIC flag private (aws#5227) Co-authored-by: Souvik Banerjee <souvik1997@gmail.com> # This is the commit message aws#148: doc: tainted stuffer reset operation (aws#5231) Co-authored-by: Boquan Fang <bqfang@amazon.com> # This is the commit message aws#149: feat: Expose `as_ptr()` for external build (aws#5229) # This is the commit message aws#150: ci: pytest generate junit reports (aws#5235) # This is the commit message aws#151: add compiler flag # This is the commit message aws#152: added c check x86 and correct compiler # This is the commit message aws#153: cmake fix # This is the commit message aws#154: testing # This is the commit message aws#155: removed clang # This is the commit message aws#156: Print statements # This is the commit message aws#157: compiler check # This is the commit message aws#158: print # This is the commit message aws#159: find clang # This is the commit message aws#160: branch probing # This is the commit message aws#161: removed individual probing # This is the commit message aws#162: removed old unneeded changes # This is the commit message aws#163: added back original line # This is the commit message aws#164: fixed .c file # This is the commit message aws#165: ci: use correct openssl version for updated AL2023 version (aws#5255) # This is the commit message aws#166: chore(ci): revert nix installer pin (aws#5251) # This is the commit message aws#167: ci: add awslcfips to nix jobs (aws#5205) Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> # This is the commit message aws#168: moved adding options to the bottom # This is the commit message aws#169: copmiler debug prints # This is the commit message aws#170: clang printout # This is the commit message aws#171: remove setting compiler to clang # This is the commit message aws#172: set clang as default # This is the commit message aws#173: remove clang # This is the commit message aws#174: move fuzz cmake into it's own directory # This is the commit message aws#175: fixed path to fuzz # This is the commit message aws#176: back to original # This is the commit message aws#177: only branch if we're not fuzz tests # This is the commit message aws#178: add clang back now # This is the commit message aws#179: removed debugging prints # This is the commit message aws#180: removed checking for compiler # This is the commit message aws#181: testing move back original block

feat(bindings): add external psk apis

b95df96

github-actions bot added the s2n-core team label Jan 27, 2025

jmayclin mentioned this pull request Jan 27, 2025

docs(bindings): add external psk example #5062

Closed

jmayclin requested review from camshaft and lrstewart January 27, 2025 16:16

Mark-Simulacrum reviewed Jan 27, 2025

View reviewed changes

jmayclin added 3 commits January 28, 2025 05:34

address pr feedback

4f3f7d5

* use &mut instead of addr_of * use null mut instead of cast * use Relaxed instead of SeqCst for single threaded atomics * min for safe cast to u16 * correct mut type * add non-exhaustive and debug to enum

address pr feedback

09623b0

* document not calling choose psk * accept mut reference

address pr feedback

69f7990

* add safety comment for slice from raw parts. * separate send + sync from macro

lrstewart reviewed Jan 28, 2025

View reviewed changes

address pr feedback

8a149cc

* return iterator over identities * add offered psk selector to prevent future breakage

jmayclin mentioned this pull request Feb 5, 2025

fix: error for uninit psk, check for all-zero psk #5084

Merged

specify lifetimes consistently

01ccadb

jmayclin requested review from Mark-Simulacrum and lrstewart February 5, 2025 04:35

Mark-Simulacrum reviewed Feb 5, 2025

View reviewed changes

jmayclin added 2 commits February 5, 2025 18:03

address pr feedback

14db20e

* callback/selectors typo * more explicit choose documentation * rename rewind to reset * reference the identity selector in the select_psk docs * use &mut instead of addr_of * rename using test to "without_current" psk

address pr feedback

f8094ec

* context associated with callback should be derived from immutable ref

jmayclin requested a review from Mark-Simulacrum February 5, 2025 18:22

jmayclin added 2 commits February 6, 2025 00:31

remove psk callback functionality

56d98d9

fix outdated docs

936e908

lrstewart reviewed Feb 6, 2025

View reviewed changes

jmayclin added 2 commits February 6, 2025 01:08

address pr feedback

5a5a5a2

* remove foreign types module * remove macro * rename ExternalPsk -> Psk

fix: grep simple mistake should allow backtick

0ef869f

jmayclin requested a review from dougch as a code owner February 6, 2025 01:34

jmayclin requested a review from lrstewart February 6, 2025 01:36

update stale docs with name change

5de03b6

camshaft reviewed Feb 6, 2025

View reviewed changes

jmayclin requested a review from camshaft February 6, 2025 17:06

address pr feedback

98da4ef

* rename external_psk module to psk

lrstewart reviewed Feb 6, 2025

View reviewed changes

bindings/rust/extended/s2n-tls/src/psk.rs Show resolved Hide resolved

codebuild/bin/grep_simple_mistakes.sh Outdated Show resolved Hide resolved

address pr feedback

6989f83

* remove monospaced api references

jmayclin requested a review from lrstewart February 6, 2025 18:53

jmayclin mentioned this pull request Feb 6, 2025

bindings: standardize link format #5095

Open

lrstewart approved these changes Feb 6, 2025

View reviewed changes

bindings/rust/extended/s2n-tls/src/psk.rs Outdated Show resolved Hide resolved

Mark-Simulacrum approved these changes Feb 6, 2025

View reviewed changes

bindings/rust/extended/s2n-tls/src/psk.rs Outdated Show resolved Hide resolved

address pr feedback

5e48088

* rename builder methods to set_* * directly retrieve mutable pointer from `ptr` * add comment about safety/reason for doing so

camshaft approved these changes Feb 6, 2025

View reviewed changes

jmayclin added this pull request to the merge queue Feb 7, 2025

Merged via the queue into aws:main with commit 1aa6d59 Feb 7, 2025

jmayclin deleted the psk-bindings-work branch February 7, 2025 02:15

johubertj pushed a commit to johubertj/s2n-tls that referenced this pull request Feb 13, 2025

feat(bindings): add external psk apis (aws#5061)

7708bd9

johubertj pushed a commit to johubertj/s2n-tls that referenced this pull request Feb 13, 2025

feat(bindings): add external psk apis (aws#5061)

09a9fb7

BrewTestBot mentioned this pull request Feb 22, 2025

s2n 1.5.13 Homebrew/homebrew-core#208566

Merged

Conversation

jmayclin commented Jan 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Summary:

Description of changes:

Call-outs:

Testing

New APIs

Uh oh!

Mark-Simulacrum left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jmayclin Feb 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jmayclin commented Jan 27, 2025 •

edited

Loading

jmayclin Feb 5, 2025 •

edited

Loading