Honoring Environment CFLAGS and LDFLAGS in the Makefile

Oct 13, 2025 by pinkandtrash.com 1 views

Introduction

Hello,

I'm an engineer at AWS working on AWS Libcrypto (AWS-LC), an open-source cryptographic library maintained for AWS and their customers. We are committed to backwards compatibility. For this purpose, we have CI jobs asserting every change's compatibility with many different open-source projects. We use these tests to catch compatibility regressions before they're merged. We have already added ibmswtpm2 to our CI, and we're now looking to upstream support for AWS-LC into the mainline branch of ibmswtpm2.

About AWS-LC

AWS-LC is an open-source cryptographic library maintained for AWS and their customers. We are committed to backwards compatibility, and we have CI jobs asserting every change's compatibility with many different open-source projects. We use these tests to catch compatibility regressions before they're merged. We have already added ibmswtpm2 to our CI, and we're now looking to upstream support for AWS-LC into the mainline branch of ibmswtpm2.

Features of AWS-LC

AWS-LC supports CPU-specific performance optimizations for AWS Graviton 2, AWS Graviton 3, and Intel x86-64 with AVX-512 instructions. We've formally verified a subset of AWS-LC's cryptographic primitives, and continue to invest in expanding this coverage. AWS-LC has been FIPS validated by NIST and we have 140-3 certificates for both dynamic and static builds.

Benefits of Upstreaming Support for AWS-LC

Upstreaming support for AWS-LC into the mainline branch of ibmswtpm2 would provide the best experience for users wishing to build ibmswtpm2 against AWS-LC. This would allow users to take advantage of the performance optimizations and security features of AWS-LC, while also ensuring backwards compatibility with existing code.

Caveats and Limitations

We support all features of ibmswtpm2 except the following caveats contained in this patch file:

Honoring Environment CFLAGS and LDFLAGS in the Makefile: We do not currently honor environment CFLAGS and LDFLAGS in the makefile. This would require adding support for these variables in the makefile.
Control Support for CAMELLIA via the Macro OPENSSL_NO_CAMELLIA: We do not currently control support for CAMELLIA via the macro OPENSSL_NO_CAMELLIA. This would require adding support for this macro in the code.
Account for a BN Field Being Named Differently (Top vs. Width): We do not currently account for a BN field being named differently (top vs. width). This would require updating the code to handle this difference.
A Work-around for the EC_POINTS_MUL Function: We do not currently have a work-around for the EC_POINTS_MUL function. This would require implementing a work-around for this function.

Conclusion

If you agree that this integration would be useful, I'd be happy to put together a PR. We believe that upstreaming support for AWS-LC into the mainline branch of ibmswtpm2 would provide the best experience for users wishing to build ibmswtpm2 against AWS-LC. We're committed to backwards compatibility and ensuring that our code is compatible with existing code.

Future Work

We plan to continue investing in expanding the coverage of our formally verified cryptographic primitives. We also plan to continue working on upstreaming support for AWS-LC into the mainline branch of ibmswtpm2.

Getting Involved

If you're interested in getting involved with AWS-LC or ibmswtpm2, we encourage you to reach out to us. We're always looking for contributors and would be happy to have you join our community.

Resources

AWS-LC GitHub Repository: https://github.com/aws/aws-lc
ibmswtpm2 GitHub Repository: https://github.com/openssl/openssl
AWS-LC CI Jobs: https://github.com/aws/aws-lc/blob/main/.github/workflows/integrations.yml
ibmswtpm2 CI Jobs: https://github.com/aws/aws-lc/blob/7bca7e96fab19e4857b70082fa4c759ff0119e12/tests/ci/cdk/cdk/codebuild/github_ci_integration_omnibus.yaml#L345

Introduction

In our previous article, we discussed the benefits of upstreaming support for AWS-LC into the mainline branch of ibmswtpm2. We also highlighted the caveats and limitations of our current implementation. In this article, we'll answer some frequently asked questions about supporting building ibmswtpm2 with AWS-LC.

Q: What is AWS-LC?

A: AWS-LC is an open-source cryptographic library maintained for AWS and their customers. We are committed to backwards compatibility and have CI jobs asserting every change's compatibility with many different open-source projects.

Q: What are the benefits of upstreaming support for AWS-LC into ibmswtpm2?

A: Upstreaming support for AWS-LC into the mainline branch of ibmswtpm2 would provide the best experience for users wishing to build ibmswtpm2 against AWS-LC. This would allow users to take advantage of the performance optimizations and security features of AWS-LC, while also ensuring backwards compatibility with existing code.

Q: What are the caveats and limitations of your current implementation?

A: We support all features of ibmswtpm2 except the following caveats contained in this patch file:

Honoring Environment CFLAGS and LDFLAGS in the Makefile: We do not currently honor environment CFLAGS and LDFLAGS in the makefile. This would require adding support for these variables in the makefile.
Control Support for CAMELLIA via the Macro OPENSSL_NO_CAMELLIA: We do not currently control support for CAMELLIA via the macro OPENSSL_NO_CAMELLIA. This would require adding support for this macro in the code.
Account for a BN Field Being Named Differently (Top vs. Width): We do not currently account for a BN field being named differently (top vs. width). This would require updating the code to handle this difference.
A Work-around for the EC_POINTS_MUL Function: We do not currently have a work-around for the EC_POINTS_MUL function. This would require implementing a work-around for this function.

Q: How can I get involved with AWS-LC or ibmswtpm2?

A: We encourage you to reach out to us if you're interested in getting involved with AWS-LC or ibmswtpm2. We're always looking for contributors and would be happy to have you join our community.

Q: What resources are available for learning more about AWS-LC and ibmswtpm2?

A: We have a GitHub repository for AWS-LC and ibmswtpm2, where you can find more information about our projects. We also have a CI jobs page for AWS-LC and ibmswtpm2, where you can see our test results.

Q: How can I contribute to the development of AWS-LC and ibmswtpm2?

A: We welcome contributions from the community. If you have a patch or a feature that you'd like to contribute, please submit a pull request to our GitHub repository. We'll review your contribution and work with you to get it merged into our codebase.

Q: What is the current status of the upstreaming effort for AWS-LC into ibmswtpm2?

A: We are currently working on upstreaming support for AWS-LC into the mainline branch of ibmswtpm2. We have a patch file that contains the necessary changes, and we're working on getting it reviewed and merged into the ibmswtpm2 codebase.

Q: How can I stay up-to-date with the latest developments on AWS-LC and ibmswtpm2?

A: We have a GitHub repository for AWS-LC and ibmswtpm2, where you can find the latest information about our projects. We also have a mailing list and a forum where you can ask questions and get answers from our community.

Q: What is the timeline for the upstreaming effort for AWS-LC into ibmswtpm2?

A: We're working on a timeline for the upstreaming effort, and we'll provide updates as we make progress. We're committed to getting this done as soon as possible, while also ensuring that we're doing it right.

Q: How can I get in touch with the AWS-LC and ibmswtpm2 teams?

A: You can reach out to us through our GitHub repository, our mailing list, or our forum. We're always happy to hear from you and answer any questions you may have.