From 118de759ff9eb66b814d76a9df7ebde353a1938c Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Mon, 11 May 2026 10:08:42 -0700 Subject: [PATCH 01/10] bump aws-c-io --- crt/aws-c-io | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crt/aws-c-io b/crt/aws-c-io index 1ec8081f2..c05903179 160000 --- a/crt/aws-c-io +++ b/crt/aws-c-io @@ -1 +1 @@ -Subproject commit 1ec8081f208ef8d51381889eda3bda9756fd5bb5 +Subproject commit c0590317988a5297c7d03c1d0cec90b2c33af646 From 681ac5a3129b7f431b94cc43db4418cddebe0ebb Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Mon, 11 May 2026 10:09:56 -0700 Subject: [PATCH 02/10] Add s2n CI job --- .github/workflows/ci.yml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 966a350a8..96c4b7a3e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -344,6 +344,42 @@ jobs: chmod a+x builder ./builder build -p ${{ env.PACKAGE_NAME }} + macos-s2n: + runs-on: macos-14 # latest + env: + AWS_CRT_USE_NON_FIPS_TLS_13: 1 + permissions: + id-token: write # This is required for requesting the JWT + steps: + - name: configure AWS credentials (containers) + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + - name: Build ${{ env.PACKAGE_NAME }} + consumers + run: | + python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')" + chmod a+x builder + ./builder build -p ${{ env.PACKAGE_NAME }} + + macos-x64-s2n: + runs-on: macos-14-large # latest + env: + AWS_CRT_USE_NON_FIPS_TLS_13: 1 + permissions: + id-token: write # This is required for requesting the JWT + steps: + - name: configure AWS credentials (containers) + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + - name: Build ${{ env.PACKAGE_NAME }} + consumers + run: | + python3 -c "from urllib.request import urlretrieve; urlretrieve('${{ env.BUILDER_HOST }}/${{ env.BUILDER_SOURCE }}/${{ env.BUILDER_VERSION }}/builder.pyz?run=${{ env.RUN }}', 'builder')" + chmod a+x builder + ./builder build -p ${{ env.PACKAGE_NAME }} + openbsd: runs-on: ubuntu-24.04 # latest strategy: From b7ca838e49dddf8054a6da96edc1bb5a17f1f452 Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Mon, 11 May 2026 10:27:17 -0700 Subject: [PATCH 03/10] Build s2n on apple --- crt/CMakeLists.txt | 12 +++++++----- setup.py | 13 +------------ 2 files changed, 8 insertions(+), 17 deletions(-) diff --git a/crt/CMakeLists.txt b/crt/CMakeLists.txt index 965f110e1..88f6d3b4c 100644 --- a/crt/CMakeLists.txt +++ b/crt/CMakeLists.txt @@ -32,9 +32,10 @@ option(AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE "Set this if you want to string(REPLACE "-g" "-g1" CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO}") string(REPLACE "-g" "-g1" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}") -# On Unix we use S2N for TLS and AWS-LC crypto. -# (On Windows and Apple we use the default OS libraries) -if ((UNIX AND NOT APPLE) OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) +# On Linux and BSD, we use S2N for TLS and AWS-LC crypto. +# On Windows, we use the default OS libraries. +# On Apple, we use the default OS libraries by default, but support S2N usage. +if (UNIX OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) option(USE_OPENSSL "Set this if you want to use your system's OpenSSL compatible libcrypto" OFF) include(AwsPrebuildDependency) @@ -48,7 +49,7 @@ if ((UNIX AND NOT APPLE) OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) -DCMAKE_BUILD_TYPE=RelWithDebInfo # Use the same build type as the rest of the project ) - if (APPLE OR WIN32) + if (WIN32) # Libcrypto implementations typically have several chunky pregenerated tables that add a lot # to artifact size. We dont really need them for ed25519 case on win/mac, so favor # smaller binary over perf here. @@ -72,7 +73,7 @@ if ((UNIX AND NOT APPLE) OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) endif() -if(UNIX AND NOT APPLE) +if(UNIX) # prebuild s2n-tls. aws_prebuild_dependency( DEPENDENCY_NAME S2N @@ -80,6 +81,7 @@ if(UNIX AND NOT APPLE) CMAKE_ARGUMENTS -DUNSAFE_TREAT_WARNINGS_AS_ERRORS=OFF -DBUILD_TESTING=OFF + -DCMAKE_NO_SYSTEM_FROM_IMPORTED=ON ) endif() diff --git a/setup.py b/setup.py index 380e5e948..90e50f1a8 100644 --- a/setup.py +++ b/setup.py @@ -301,7 +301,7 @@ def __init__(self, name, extra_cmake_args=[], libname=None): # aws-lc produces libcrypto.a AWS_LIBS.append(AwsLib('aws-lc', libname='crypto')) -if sys.platform != 'darwin' and sys.platform != 'win32': +if sys.platform != 'win32': AWS_LIBS.append(AwsLib('s2n')) AWS_LIBS.append(AwsLib('aws-c-common')) @@ -593,17 +593,6 @@ def awscrt_ext(): if not is_macos_universal2(): if sys.platform == 'darwin': extra_link_args += ['-Wl,-fatal_warnings'] - # xcode 15 introduced a new linker that generates a warning - # when it sees duplicate libs or rpath during bundling. - # pyenv installed from homebrew put duplicate rpath entries - # into sysconfig, and setuptools happily passes them along - # to xcode, resulting in a warning - # (which is fatal in this branch). - # ex. https://github.com/pyenv/pyenv/issues/2890 - # lets revert back to old linker on xcode >= 15 until one of - # the involved parties fixes the issue. - if get_xcode_major_version() >= 15: - extra_link_args += ['-Wl,-ld_classic'] elif 'bsd' in sys.platform: extra_link_args += ['-Wl,-fatal-warnings'] else: From 465c48761c40747db2147d063ad3e8e52b983778 Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Mon, 11 May 2026 11:57:14 -0700 Subject: [PATCH 04/10] Try to restore -Wl,-ld_classic --- setup.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/setup.py b/setup.py index 90e50f1a8..032bff830 100644 --- a/setup.py +++ b/setup.py @@ -593,6 +593,17 @@ def awscrt_ext(): if not is_macos_universal2(): if sys.platform == 'darwin': extra_link_args += ['-Wl,-fatal_warnings'] + # xcode 15 introduced a new linker that generates a warning + # when it sees duplicate libs or rpath during bundling. + # pyenv installed from homebrew put duplicate rpath entries + # into sysconfig, and setuptools happily passes them along + # to xcode, resulting in a warning + # (which is fatal in this branch). + # ex. https://github.com/pyenv/pyenv/issues/2890 + # lets revert back to old linker on xcode >= 15 until one of + # the involved parties fixes the issue. + if get_xcode_major_version() >= 15: + extra_link_args += ['-Wl,-ld_classic'] elif 'bsd' in sys.platform: extra_link_args += ['-Wl,-fatal-warnings'] else: From 8a1f0233c68682c20b1b34fdfed3e3209d2581a1 Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Fri, 22 May 2026 09:38:00 -0700 Subject: [PATCH 05/10] Disable pkcs12 tests --- test/test_mqtt5_credentials.py | 1 + test/test_mqtt_credentials.py | 1 + 2 files changed, 2 insertions(+) diff --git a/test/test_mqtt5_credentials.py b/test/test_mqtt5_credentials.py index 96057834e..2e5bf94d2 100644 --- a/test/test_mqtt5_credentials.py +++ b/test/test_mqtt5_credentials.py @@ -130,6 +130,7 @@ def _test_mqtt5_cred_pkcs12(self): client.stop() callbacks.future_stopped.result(TIMEOUT) + @unittest.skipIf(os.environ.get('AWS_CRT_USE_NON_FIPS_TLS_13'), "PKCS12 not supported with non-FIPS TLS 1.3") def test_mqtt5_cred_pkcs12(self): test_retry_wrapper(self._test_mqtt5_cred_pkcs12) diff --git a/test/test_mqtt_credentials.py b/test/test_mqtt_credentials.py index 58b99b4ce..4686ef657 100644 --- a/test/test_mqtt_credentials.py +++ b/test/test_mqtt_credentials.py @@ -46,6 +46,7 @@ def _test_mqtt311_cred_pkcs12(self): connection.connect().result(TIMEOUT) connection.disconnect().result(TIMEOUT) + @unittest.skipIf(os.environ.get('AWS_CRT_USE_NON_FIPS_TLS_13'), "PKCS12 not supported with non-FIPS TLS 1.3") def test_mqtt311_cred_pkcs12(self): test_retry_wrapper(self._test_mqtt311_cred_pkcs12) From 277e78035fe30bdaf1d8ce47d95ea5d58e01843f Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Thu, 28 May 2026 11:12:25 -0700 Subject: [PATCH 06/10] Add explanations --- README.md | 33 +++++++++++++++++++++++++++++---- crt/CMakeLists.txt | 7 +++++++ test/test_mqtt5_credentials.py | 2 ++ test/test_mqtt_credentials.py | 2 ++ 4 files changed, 40 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 64307869d..c935f520d 100644 --- a/README.md +++ b/README.md @@ -49,9 +49,33 @@ If you **must** use fork with aws-crt-python, you may be able to avoid hangs and For an example, see `test.test_s3.py.S3RequestTest.test_fork_workaround` . -## Mac-Only TLS Behavior +## macOS TLS Configuration -Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v0.6.2, when a stored private key from the Keychain is used, the following will be logged at the "info" log level: +By default on macOS, aws-crt-cpp uses Apple Secure Transport for TLS. This provides FIPS-compliant cryptography +and integration with the macOS Keychain (e.g. PKCS#12 credentials), but is limited to TLS 1.2. + +To enable TLS 1.3 on macOS, set the environment variable: + +``` +export AWS_CRT_USE_NON_FIPS_TLS_13=1 +``` + +This switches the TLS backend from Apple Secure Transport to [s2n-tls](https://github.com/aws/s2n-tls) with +[aws-lc](https://github.com/aws/aws-lc) as the underlying libcrypto. The tradeoffs are: + +| | Secure Transport (default) | s2n-tls (`AWS_CRT_USE_NON_FIPS_TLS_13=1`) | +|---|---|---| +| TLS versions | Up to TLS 1.2 | Up to TLS 1.3 | +| FIPS compliance | Yes | No | +| macOS Keychain integration | Yes (PKCS#12, system certs) | No | + +This variable is checked at runtime and only affects macOS. It has no effect on Linux (which always uses s2n-tls) +or Windows (which always uses Schannel). Both TLS backends are compiled into the binary when building on macOS; +the environment variable selects which one is used. + +### Keychain Behavior + +Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v0.8.10, when a stored private key from the Keychain is used, the following will be logged at the "info" log level: ``` static: certificate has an existing certificate-key pair that was previously imported into the Keychain. Using key from Keychain instead of the one provided. @@ -110,8 +134,9 @@ You can enable the crash handler by setting the environment variable `AWS_CRT_CR ### OpenSSL and LibCrypto aws-crt-python does not use OpenSSL for TLS. -On Apple and Windows devices, the OS's default TLS library is used. -On Unix devices, [s2n-tls](https://github.com/aws/s2n-tls) is used. +On Windows, the OS's default TLS library (Schannel) is used. +On Apple (macOS), both Secure Transport and s2n-tls are compiled in; the backend is selected at runtime (see [macOS TLS Backend](#macos-tls-backend) below). +On other Unix devices, [s2n-tls](https://github.com/aws/s2n-tls) is used. But s2n-tls uses libcrypto, the cryptography math library bundled with OpenSSL. To simplify installation, aws-crt-python has its own copy of libcrypto. diff --git a/crt/CMakeLists.txt b/crt/CMakeLists.txt index 88f6d3b4c..9e32b5af2 100644 --- a/crt/CMakeLists.txt +++ b/crt/CMakeLists.txt @@ -73,6 +73,9 @@ if (UNIX OR AWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) endif() +# Build s2n-tls on all Unix platforms (Linux, BSD, macOS). +# On macOS (Darwin), both Secure Transport and s2n are built; the TLS backend +# is selected at runtime via the AWS_CRT_USE_NON_FIPS_TLS_13 environment variable. if(UNIX) # prebuild s2n-tls. aws_prebuild_dependency( @@ -81,6 +84,10 @@ if(UNIX) CMAKE_ARGUMENTS -DUNSAFE_TREAT_WARNINGS_AS_ERRORS=OFF -DBUILD_TESTING=OFF + # On Intel Macs, Homebrew installs to /usr/local, which is in the default + # system header search path. Without this flag, s2n picks up Homebrew's OpenSSL + # headers instead of the bundled aws-lc headers. Not needed on ARM where Homebrew + # uses /opt/homebrew (not in default search paths), but harmless to set everywhere. -DCMAKE_NO_SYSTEM_FROM_IMPORTED=ON ) endif() diff --git a/test/test_mqtt5_credentials.py b/test/test_mqtt5_credentials.py index 2e5bf94d2..2354c944b 100644 --- a/test/test_mqtt5_credentials.py +++ b/test/test_mqtt5_credentials.py @@ -130,6 +130,8 @@ def _test_mqtt5_cred_pkcs12(self): client.stop() callbacks.future_stopped.result(TIMEOUT) + # When AWS_CRT_USE_NON_FIPS_TLS_13 is set, the TLS backend on macOS switches from + # Secure Transport to s2n-tls, which doesn't support PKCS#12. @unittest.skipIf(os.environ.get('AWS_CRT_USE_NON_FIPS_TLS_13'), "PKCS12 not supported with non-FIPS TLS 1.3") def test_mqtt5_cred_pkcs12(self): test_retry_wrapper(self._test_mqtt5_cred_pkcs12) diff --git a/test/test_mqtt_credentials.py b/test/test_mqtt_credentials.py index 4686ef657..832c639d8 100644 --- a/test/test_mqtt_credentials.py +++ b/test/test_mqtt_credentials.py @@ -46,6 +46,8 @@ def _test_mqtt311_cred_pkcs12(self): connection.connect().result(TIMEOUT) connection.disconnect().result(TIMEOUT) + # When AWS_CRT_USE_NON_FIPS_TLS_13 is set, the TLS backend on macOS switches from + # Secure Transport to s2n-tls, which doesn't support PKCS#12. @unittest.skipIf(os.environ.get('AWS_CRT_USE_NON_FIPS_TLS_13'), "PKCS12 not supported with non-FIPS TLS 1.3") def test_mqtt311_cred_pkcs12(self): test_retry_wrapper(self._test_mqtt311_cred_pkcs12) From 9baedd453d012d322a827d8b185c5b74a52e096f Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Thu, 28 May 2026 11:50:07 -0700 Subject: [PATCH 07/10] Bump aws-c-io --- crt/aws-c-io | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crt/aws-c-io b/crt/aws-c-io index c05903179..f69553980 160000 --- a/crt/aws-c-io +++ b/crt/aws-c-io @@ -1 +1 @@ -Subproject commit c0590317988a5297c7d03c1d0cec90b2c33af646 +Subproject commit f69553980db9dab088603a505b2dca26d355dcd7 From d52625817c00654c968e4af1a1d36d66a5381b29 Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Fri, 29 May 2026 14:32:13 -0700 Subject: [PATCH 08/10] Add tls 1.3 test --- .github/workflows/ci.yml | 6 +----- test/test_mqtt5.py | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 96c4b7a3e..d0b4c3f91 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -7,7 +7,7 @@ on: - 'docs' env: - BUILDER_VERSION: v0.9.92 + BUILDER_VERSION: v0.9.93 BUILDER_SOURCE: releases BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net PACKAGE_NAME: aws-crt-python @@ -50,13 +50,11 @@ jobs: - x64 - x86 python: - - cp38-cp38 - cp39-cp39 - cp310-cp310 - cp311-cp311 - cp312-cp312 - cp313-cp313 - - cp313-cp313t - cp314-cp314 - cp314-cp314t permissions: @@ -78,13 +76,11 @@ jobs: fail-fast: false matrix: python: - - cp38-cp38 - cp39-cp39 - cp310-cp310 - cp311-cp311 - cp312-cp312 - cp313-cp313 - - cp313-cp313t - cp314-cp314 - cp314-cp314t permissions: diff --git a/test/test_mqtt5.py b/test/test_mqtt5.py index 15e1e7d0a..1e6dbd080 100644 --- a/test/test_mqtt5.py +++ b/test/test_mqtt5.py @@ -5,6 +5,7 @@ from awscrt import mqtt5, io, http, exceptions from test import test_retry_wrapper, NativeResourceTest import os +import sys import unittest import uuid import time @@ -303,6 +304,38 @@ def _test_direct_connect_mutual_tls(self): def test_direct_connect_mutual_tls(self): test_retry_wrapper(self._test_direct_connect_mutual_tls) + def _test_direct_connect_mutual_tls13(self): + input_host_name = _get_env_variable("AWS_TEST_MQTT5_IOT_CORE_TLS13_HOST") + input_cert = _get_env_variable("AWS_TEST_MQTT5_IOT_CORE_RSA_CERT") + input_key = _get_env_variable("AWS_TEST_MQTT5_IOT_CORE_RSA_KEY") + + client_options = mqtt5.ClientOptions( + host_name=input_host_name, + port=8883 + ) + tls_ctx_options = io.TlsContextOptions.create_client_with_mtls_from_path( + input_cert, + input_key + ) + client_options.tls_ctx = io.ClientTlsContext(tls_ctx_options) + + callbacks = Mqtt5TestCallbacks() + client = self._create_client(client_options=client_options, callbacks=callbacks) + client.start() + + # On macOS with Secure Transport (the default), TLS 1.3 is not supported, + # so the connection to a TLS-1.3-only host must fail. + if sys.platform == 'darwin' and not os.environ.get('AWS_CRT_USE_NON_FIPS_TLS_13'): + callbacks.future_connection_failure.result(TIMEOUT) + else: + callbacks.future_connection_success.result(TIMEOUT) + + client.stop() + callbacks.future_stopped.result(TIMEOUT) + + def test_direct_connect_mutual_tls13(self): + test_retry_wrapper(self._test_direct_connect_mutual_tls13) + def _test_direct_connect_http_proxy_tls(self): input_host_name = _get_env_variable("AWS_TEST_MQTT5_DIRECT_MQTT_TLS_HOST") input_port = int(_get_env_variable("AWS_TEST_MQTT5_DIRECT_MQTT_TLS_PORT")) From dfeb9d8783c14afba424373bdbf2c4a545a5737b Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Tue, 2 Jun 2026 16:56:24 -0700 Subject: [PATCH 09/10] Fix readme --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c935f520d..e3c5d7972 100644 --- a/README.md +++ b/README.md @@ -51,7 +51,7 @@ For an example, see `test.test_s3.py.S3RequestTest.test_fork_workaround` . ## macOS TLS Configuration -By default on macOS, aws-crt-cpp uses Apple Secure Transport for TLS. This provides FIPS-compliant cryptography +By default on macOS, aws-crt-python uses Apple Secure Transport for TLS. This provides FIPS-compliant cryptography and integration with the macOS Keychain (e.g. PKCS#12 credentials), but is limited to TLS 1.2. To enable TLS 1.3 on macOS, set the environment variable: @@ -75,7 +75,7 @@ the environment variable selects which one is used. ### Keychain Behavior -Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v0.8.10, when a stored private key from the Keychain is used, the following will be logged at the "info" log level: +Please note that on Mac, once a private key is used with a certificate, that certificate-key pair is imported into the Mac Keychain. All subsequent uses of that certificate will use the stored private key and ignore anything passed in programmatically. Beginning in v0.6.2, when a stored private key from the Keychain is used, the following will be logged at the "info" log level: ``` static: certificate has an existing certificate-key pair that was previously imported into the Keychain. Using key from Keychain instead of the one provided. @@ -135,7 +135,7 @@ You can enable the crash handler by setting the environment variable `AWS_CRT_CR aws-crt-python does not use OpenSSL for TLS. On Windows, the OS's default TLS library (Schannel) is used. -On Apple (macOS), both Secure Transport and s2n-tls are compiled in; the backend is selected at runtime (see [macOS TLS Backend](#macos-tls-backend) below). +On Apple (macOS), both Secure Transport and s2n-tls are compiled in; the backend is selected at runtime (see [macOS TLS Configuration](#macos-tls-configuration) below). On other Unix devices, [s2n-tls](https://github.com/aws/s2n-tls) is used. But s2n-tls uses libcrypto, the cryptography math library bundled with OpenSSL. From 406ecba1fff63b0639181361e1759db6401b1baf Mon Sep 17 00:00:00 2001 From: Igor Abdrakhimov Date: Wed, 3 Jun 2026 11:15:20 -0700 Subject: [PATCH 10/10] Bump aws-c-io --- crt/aws-c-io | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crt/aws-c-io b/crt/aws-c-io index f69553980..bdfd85e29 160000 --- a/crt/aws-c-io +++ b/crt/aws-c-io @@ -1 +1 @@ -Subproject commit f69553980db9dab088603a505b2dca26d355dcd7 +Subproject commit bdfd85e293965439146bc30a70379e7889c27bb7