Skip to content

Support pregenerated Rust bindings from AWS-LC installations#2578

Merged
alex merged 3 commits intorust-openssl:masterfrom
justsmth:aws-lc-bindings
Mar 5, 2026
Merged

Support pregenerated Rust bindings from AWS-LC installations#2578
alex merged 3 commits intorust-openssl:masterfrom
justsmth:aws-lc-bindings

Conversation

@justsmth
Copy link
Copy Markdown
Contributor

@justsmth justsmth commented Mar 3, 2026

Description:

AWS-LC can now optionally generate and install Rust bindings at $PREFIX/share/rust/aws_lc_bindings.rs. This PR teaches openssl-sys to discover and use those bindings, removing the need for bindgen (or bindgen-cli) at build time when they're present.

The detection logic lives in try_pregenerated_awslc_bindings, which looks for the file relative to the include directory. When found, it copies the bindings into OUT_DIR/bindgen.rs and short-circuits both bindgen and the static wrapper C compilation step. If the file isn't present, the existing bindgen / bindgen-cli path runs exactly as before. Both the bindgen feature and non-bindgen code paths are covered.

Because the pregenerated bindings don't include static inline functions or C preprocessor macros, pure-Rust implementations of ERR_GET_LIB, ERR_GET_REASON, ERR_GET_FUNC, and BIO_get_mem_data are provided in the aws_lc module. The existing BIO_get_mem_data shim was already there; the error helpers are new and match the logic in aws-lc-sys. These shims are gated with #[cfg(any(feature = "aws-lc", feature = "aws-lc-fips", awslc_pregenerated))] to avoid conflicting with the extern "C" declarations that bindgen's wrap_static_fns produces on the normal (non-pregenerated) path.

A few things worth noting for review:

  • The pregenerated bindings use ::std::os::raw::* types rather than ::libc::* (since they weren't generated with ctypes_prefix). These are the same underlying types, so there's no compatibility issue.
  • #[allow(unpredictable_function_pointer_comparisons)] is added to the aws_lc module because the pregenerated bindings derive PartialEq on structs containing function pointer fields. When using aws-lc-sys as a crate dependency this lint is scoped to that crate; with include!-d bindings it surfaces here instead.
  • All three code paths have been tested: pregenerated bindings via OPENSSL_DIR, normal bindgen via OPENSSL_DIR (without pregenerated bindings), and the aws-lc crate feature.

Copy link
Copy Markdown
Collaborator

@alex alex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the backwards compatibility/versioning/linking strategy for these?

Comment thread openssl-errors/src/lib.rs Outdated
@justsmth
Copy link
Copy Markdown
Contributor Author

justsmth commented Mar 4, 2026

What's the backwards compatibility/versioning/linking strategy for these?

We definitely want to maintain backward compatibility with all existing AWS-LC installations. Even with the latest versions, the pregeneration of Rust bindings during AWS-LC's build is optional, and will likely always be.

The linking strategy is unchanged — build.rs still discovers and links the library the same way it does today. The only thing the pregenerated file replaces is the bindgen step (and the associated static-wrapper C compilation). If the bindings file isn't present, the existing bindgen / bindgen-cli path runs exactly as before.

In fact, testing against an installation without pregenerated bindings caught a bug in my original patch (sorry! 😬): the pure-Rust ERR_GET_* shims conflicted with the extern "C" declarations that bindgen's wrap_static_fns produces. I've fixed this by gating the shims with #[cfg(any(feature = "aws-lc", feature = "aws-lc-fips", awslc_pregenerated))] so they're only defined when they won't already be in the bindgen output. I've tested all three code paths: pregenerated bindings via OPENSSL_DIR, normal bindgen via OPENSSL_DIR (without pregenerated bindings), and the aws-lc crate feature.

Copy link
Copy Markdown
Collaborator

@alex alex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(I'm looking at the failing CI job separately)

Comment thread openssl-sys/src/lib.rs Outdated
@alex alex merged commit efc55bf into rust-openssl:master Mar 5, 2026
81 checks passed
@justsmth justsmth deleted the aws-lc-bindings branch March 5, 2026 19:45
@weihanglo
Copy link
Copy Markdown
Contributor

Thanks for getting this done @justsmth! And thanks @alex for the review!

Would it be possible to cut a patch release sometime soon? We've accumulated quite a few nice features and fixes since openssl-sys@0.9.111 :)

@alex
Copy link
Copy Markdown
Collaborator

alex commented Mar 11, 2026

If someone sends a PR with the changelogs + version bumps, I'm happy to cut a release. If not, I can try to get to it this weekend.

@weihanglo
Copy link
Copy Markdown
Contributor

Thanks, @alex! I've created one (with the help from Claude). And most things look correct to me #2582

Let me know how you want to proceed for that PR there :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants