Release v1.12.0

What's Changed

• Update CI README to include Valgrind on AArch64 by @nebeid in #1066
• Additional tests for failure modes for KEM API by @dkostic in #1048
• Fix potential NULL pointer dereference by @dkostic in #1067
• add integration build CI dimension for mySQL by @samuel40791765 in #1051
• add integration test CI dimension for MariaDB by @samuel40791765 in #1046
• Add SSL_get0_verified_chain by @andrewhop in #1055
• Add OSSL_HANDSHAKE_STATE enum for OpenSSL compatability by @andrewhop in #1070
• Upstream merge 2023-06-26 by @dkostic in #1072
• Fix DISABLE_PERL=on builds for non-assembly optimized platforms by @skmcgrail in #1068
• Fix BORINGSSL_PREFIX build for ppc64le by @skmcgrail in #1069
• align X509_VERIFY_PARAM host and email behavior with OpenSSL by @samuel40791765 in #1062
• Use build-in string-copy function by @torben-hansen in #1078
• Light tidy up of required dependency versions by @torben-hansen in #1076
• Remove unused variable declaration in ssl_test.cc by @dkostic in #1073
• Upstream merge 2023-06-27 by @torben-hansen in #1075
• Reapply "Remove support for "old-style" X509V3_EXT_METHODs" by @samuel40791765 in #1065
• Make PRNG model slightly more readable by @torben-hansen in #1079
• Add back custom extension support for libssl by @andrewhop in #1071
• Save leaf certificate in SSL early to avoid losing external data by @samuel40791765 in #1074
• Mark include as PUBLIC not SYSTEM PUBLIC by @skmcgrail in #1081
• Release v1.12.0 by @skmcgrail in #1085

Full Changelog: v1.11.0...v1.12.0

Release v1.11.0

What's Changed

• Merge pull request #1064 from samuel40791765/upstream-merge-2023-06-15
• Allow cleanup of thread-local data before dlclose (#1057)
• add -Wmissing-braces to build (#1061)
• Change the Jitter entropy recovery mechanism (#1058)
• Merge OCSP request feature branch to main (#1054)
• Fix aesni-xts-avx512 to support Perl v5.8.8 (#1053)
• Merge pull request #1041 from skmcgrail/upstream-merge-2023-05-30
• Simplify speed.cc if/defs for different libcryptos (#1047)
• AES-XTS optimization using vAES and vPCLMULQDQ (#1004)
• Split up integration test ci dimension (#1036)
• Ensure CodeBuild always has GOPROXY set via buildspec. (#1043)
• Add Support for RSA SigGen w/ SHA2-512/256 & PKCS1v1.5 to the ACVP Tool (#1022)
• set rsa pkcs1v1.5 and ecdsa sig/ver with SHA512/256 to not approved (#1038)
• Document X509_NAME_oneline function behavior. (#1040)
• Add additional DH groups from RFC 7919 (#1039)
• Add function for KEM key check (#1030)
• Zeroize unused Dilithium key buffers (#1031)
• Add ASN1_TIME_to_tm (#1035)
• Expose TLS prf (#1033)
• Add few compatability functions needed for HAProxy (#1032)
• quiet unused arguments on Android to silence --noexecstack related warnings (#1028)
• Add support for multiple filters for bssl speed application (#1023)
• Add LDTs to ACVP Tool (#1029)
• Fix RSA and ECDSA SigGen w/ SHA2-512/256 (#1020)
• Add support for EVP_aes_256_wrap (#1007)
• add support for SSL_get_key_update_type and SSL_KEY_UPDATE_NONE (#1011)
• Add AES CTR benchmark (#1024)
• Delete leftover comments about KEMs/Kyber (#1013)
• Add support for SSL_(read/peek/write)_ex (#1010)
• Reduce the ARM fuzz time to get the CI to pass in under an hour (#1021)
• Update speed.cc to support older versions of AWS-LC that have missing APIs. (#1018)
• Add additional no-op symbols for support mySQL (#1002)
• Revert "Temporarily remove dilithium KATs and fuzz corpus" (#1016)

Release v1.10.0

What's Changed

• Upstream merge 2023 04 14 by @skmcgrail in #958
• Remove cruft from generate build script by @torben-hansen in #976
• Retire Armv7 x25519 implementation by @torben-hansen in #973
• P-384/521 runtime check for s2n-bignum on aarch64 by @dkostic in #983
• Update EVP AES GCM and XTS benchmarks to reuse the key and cipher during the benchmark by @andrewhop in #965
• test case when xts mode key and tweak init is done separately by @torben-hansen in #974
• Add GitHub Action for testing commits with aws-lc-rs by @skmcgrail in #971
• Add DH_check support to perf tool by @torben-hansen in #982
• Add missing symbols for postgres by @samuel40791765 in #979
• Upstream merge 2023-05-01 by @torben-hansen in #987
• Add benchmarks for EC_KEY_generate_key(_fips) by @samuel40791765 in #969
• Fix device farm CI build with boto3 by @samuel40791765 in #990
• Fix memory various minor memory leaks in speed.cc by @andrewhop in #988
• Enable valgrind tests on AArch64 by setting ARMCAP via static defines to avoid reading from MIDR_EL1. by @nebeid in #978
• Fix two trailing new-lines in PR template by @torben-hansen in #998
• Support OpenBSD on arm64 by @knightjoel in #962
• Add Postgres integration test CI by @samuel40791765 in #986
• P-384/521 fallback to small implementation when OPENSSL_SMALL is set by @dkostic in #984
• Upstream merge 2023 05 05 by @samuel40791765 in #997
• AWS CodeBuild GitHub Job Pruner by @skmcgrail in #980
• Minor fixes pointed out by static analysis by @samuel40791765 in #995
• Add Openssh integration tests to CI by @justsmth in #942
• Add support for X509_get0_pubkey by @samuel40791765 in #1000
• Fix incorrect lambda CodeBuild policy permission by @skmcgrail in #1001
• Check HWCAP_CPUID before reading MIDR_EL1 on aarch64 by @lilybarrowman in #1006
• Only build acvp/modulewrapper with BUILD_TESTING by @justsmth in #1012
• Run FIPS break tests as a part of the CI by @andrewhop in #1005
• Fix for building on aarch64 with 32-bit OS by @dkostic in #1015
• Merge integrate-pq into main by @WillChilds-Klein in #897
• Upstream merge 2023-05-12 by @dkostic in #1008
• Fix typo's and clarify some language by @torben-hansen in #993
• Bump AWSLC_VERSION_NUMBER_STRING to 1.10.0 by @andrewhop in #1019

New Contributors

• @lilybarrowman made their first contribution in #1006

Full Changelog: v1.9.0...v1.10.0

Release v1.9.0

• Provide a compile option to disable AVX512-specific optimizations (#945)
• aesv8-armx.pl: Avoid buffer overread in AES-XTS decryption (#970)

Release v1.8.0

• Improves support for OpenSSH (#894)
• Bug fix: Added back ASN1_STRING_clear_free which was incorrectly removed in v1.7.0. (#936)
• Bug fix: BORINGSSL_function_hit array size did not match updated header definition (#934)

Release v1.7.0

• TLS 1.3 Transfer Support (#891)
• SHA3 is always enabled now, and opt-in is no longer required. Deprecated opt-in functions. (#898)

Release v1.6.0

• Disable 3DES by default

Release v1.1.0 FIPS

• Disable 3DES by default
• Upper bound number of x509 certificate policy tree nodes

Release v1.5.1

• Merge various upstream changes from BoringSSL
• Remove old Rust bindings that have been relocated (#850)
• KEM: fix key retrieval when public/secret key is missing (#855)
• Rename bssl to awslc, add version cmd (#865)
• Avoid potential for buffer overflow in SHA3 ARMv8 assembly (#863)

Release v1.5.0

• Allow RSA keys with d > n to be imported (#844)
• Support for PKCS#8 v2 encoding & decoding of Ed25519 and X25519 keys. (#828)
• Go tooling has been updated to use Go 1.20 release.
• Support for RSA keys without e component. (#814)