Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package aws-c-cal for openSUSE:Factory checked in at 2026-10-18 20:09:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/aws-c-cal (Old) and /work/SRC/openSUSE:Factory/.aws-c-cal.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "aws-c-cal" Sun Oct 18 20:09:02 2026 rev:28 rq:1385010 version:1.0.0 Changes: -------- --- /work/SRC/openSUSE:Factory/aws-c-cal/aws-c-cal.changes 2026-08-06 16:25:53.392166014 +0200 +++ /work/SRC/openSUSE:Factory/.aws-c-cal.new.3698736/aws-c-cal.changes 2026-10-18 20:09:03.406566368 +0200 @@ -1,0 +2,15 @@ +Tue Oct 13 11:53:20 UTC 2026 - John Paul Adrian Glaubitz <[email protected]> + +- Update to version 1.0.0 + * Use latest as aws-crt-builder version by @sfod in (#252) + * ECC Validation Test by @sbSteveK in (#253) + * Expand ecc validation test by @sbSteveK in (#254) + * CI/CD improvements by @azkrishpy in (#256) + * Clean up docs by @azkrishpy in (#255) + * chore(release): add governance files by @azkrishpy in (#257) +- Add Provides and Obsoletes for previous shared library version +- Drop acc_add-so-version.patch, fixed upstream +- Pass installation path of aws-c-common cmake modules in CMAKE_PREFIX_PATH +- Prefer explicit path and filenames over wildcards in %files section + +------------------------------------------------------------------- Old: ---- acc_add-so-version.patch v0.9.15.tar.gz New: ---- v1.0.0.tar.gz ----------(Old B)---------- Old:- Add Provides and Obsoletes for previous shared library version - Drop acc_add-so-version.patch, fixed upstream - Pass installation path of aws-c-common cmake modules in CMAKE_PREFIX_PATH ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ aws-c-cal.spec ++++++ --- /var/tmp/diff_new_pack.HBWf3m/_old 2026-10-18 20:09:04.213600142 +0200 +++ /var/tmp/diff_new_pack.HBWf3m/_new 2026-10-18 20:09:04.215600225 +0200 @@ -17,16 +17,16 @@ %define library_version 1.0.0 -%define library_soversion 0unstable +%define library_pkg 1_0 +%define library_soversion 1.0 Name: aws-c-cal -Version: 0.9.15 +Version: 1.0.0 Release: 0 Summary: AWS C99 wrapper for cryptography primitives License: Apache-2.0 Group: Development/Libraries/C and C++ URL: https://github.com/awslabs/aws-c-cal Source0: https://github.com/awslabs/%{name}/archive/v%{version}.tar.gz -Patch0: acc_add-so-version.patch BuildRequires: cmake BuildRequires: fdupes BuildRequires: ninja @@ -39,11 +39,13 @@ %description AWS Crypto Abstraction Layer is a C99 wrapper for cryptography primitives. -%package -n lib%{name}%{library_soversion} +%package -n lib%{name}%{library_pkg} Summary: AWS C99 wrapper for cryptography primitives Group: System/Libraries +Provides: lib%{name}0unstable = %{version} +Obsoletes: lib%{name}0unstable < %{version} -%description -n lib%{name}%{library_soversion} +%description -n lib%{name}%{library_pkg} AWS Crypto Abstraction Layer is a C99 wrapper for cryptography primitives. This package contains the dynamically linked library. @@ -51,7 +53,7 @@ %package devel Summary: Development files for aws-c-cal library Group: Development/Libraries/C and C++ -Requires: lib%{name}%{library_soversion} = %{version} +Requires: lib%{name}%{library_pkg} = %{version} %description devel AWS Crypto Abstraction Layer, a C99 wrapper for cryptography primitives. @@ -64,7 +66,8 @@ %build %define __builder ninja %cmake \ - -DCMAKE_BUILD_TYPE=Release + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_PREFIX_PATH=%{_libdir}/cmake/aws-c-common/modules %make_jobs %check @@ -74,17 +77,19 @@ %install %cmake_install -%post -n lib%{name}%{library_soversion} -p /sbin/ldconfig -%postun -n lib%{name}%{library_soversion} -p /sbin/ldconfig +%post -n lib%{name}%{library_pkg} -p /sbin/ldconfig +%postun -n lib%{name}%{library_pkg} -p /sbin/ldconfig -%files -n lib%{name}%{library_soversion} +%files -n lib%{name}%{library_pkg} %doc README.md %license LICENSE -%{_libdir}/*.so.%{library_soversion} -%{_libdir}/*.so.%{library_version} +%{_libdir}/lib%{name}.so.%{library_soversion} +%{_libdir}/lib%{name}.so.%{library_version} +%{_libdir}/lib%{name}.so.1.0 %files devel -%{_libdir}/cmake/ -%{_libdir}/*.so -%{_includedir}/* +%{_libdir}/cmake/%{name}/ +%{_libdir}/lib%{name}.so +%dir %{_includedir}/aws/cal +%{_includedir}/aws/cal/* ++++++ v0.9.15.tar.gz -> v1.0.0.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.changes/README.md new/aws-c-cal-1.0.0/.changes/README.md --- old/aws-c-cal-0.9.15/.changes/README.md 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/.changes/README.md 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,52 @@ +# Changelog fragments + +Individual changes are recorded here as JSON fragments — one per PR. The +top-level [`CHANGELOG.md`](../CHANGELOG.md) is derived from these. + +## Directory layout + +``` +.changes/ +├── preview/ # in-flight fragments, one JSON per PR +├── latest/ # active minor line +│ └── <version>/ { *.json } # per-patch fragment dir (e.g. 0.30.0/, 0.30.1/) +├── <M>.<N>.x/ # frozen prior minor line +│ ├── <M>.<N>.0/ { *.json } +│ ├── <M>.<N>.1/ { *.json } +│ └── CHANGELOG.md # frozen snapshot for this minor line +└── … +``` + +## Fragment schema + +Each fragment is `.changes/preview/<PR-number>.json` while in flight, then +moves into `latest/<version>/` at release time. + +```json +{ + "pr": 234, + "type": "feat", + "summary": "Add SHA512 HMAC and HKDF functions.", + "url": "https://github.com/awslabs/aws-c-cal/pull/234";, + "notes": "" +} +``` + +| Field | Values | +|---|---| +| `pr` | PR number; also the filename | +| `type` | `feat` \| `fix` \| `doc` \| `chore` \| `revert` | +| `summary` | customer-facing one sentence | +| `url` | link to the PR | +| `notes` | optional extended notes | + +## Finding a change + +| You want | Look here | +|---|---| +| currently in-flight | `preview/*.json` on `main`, or the rendered view on the `docs` branch | +| in the current minor line (`X.Y.*`) | root [`CHANGELOG.md`](../CHANGELOG.md) | +| in a prior minor line (`A.B.*`) | `.changes/A.B.x/CHANGELOG.md` | +| exact set for a tag | GitHub Release page for that tag | + +> Note: filesystem lex sort places `0.10.x/` before `0.2.x/`. The rendered `CHANGELOG.md` files are semver-sorted, so only raw `ls .changes/` looks out of order. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.github/workflows/block-needs-review.yml new/aws-c-cal-1.0.0/.github/workflows/block-needs-review.yml --- old/aws-c-cal-0.9.15/.github/workflows/block-needs-review.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/.github/workflows/block-needs-review.yml 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,12 @@ +name: Block needs-review merges + +on: + pull_request: + types: [opened, synchronize, reopened, labeled, unlabeled] + +permissions: + pull-requests: read + +jobs: + gate: + uses: awslabs/aws-crt-builder/.github/workflows/block-needs-review-label.yml@main diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.github/workflows/check-abi.yml new/aws-c-cal-1.0.0/.github/workflows/check-abi.yml --- old/aws-c-cal-0.9.15/.github/workflows/check-abi.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/.github/workflows/check-abi.yml 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,43 @@ +name: Check ABI compliance + +# Trigger on any push to non-main branches. +on: + push: + branches-ignore: + - 'main' + +concurrency: + group: check-abi-${{ github.ref }} + cancel-in-progress: true + +env: + PACKAGE_NAME: aws-c-cal + CRT_CI_ROLE: ${{ secrets.CRT_CI_ROLE_ARN }} + AWS_DEFAULT_REGION: us-east-1 + +permissions: + id-token: write + contents: read + pull-requests: write + +jobs: + check-abi: + name: check-abi + runs-on: ubuntu-24.04 + steps: + - uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Check ABI + uses: awslabs/aws-crt-builder/.github/actions/check-abi@main + with: + lib-name: ${{ env.PACKAGE_NAME }} + builder-version: latest + builder-source: releases diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.github/workflows/ci.yml new/aws-c-cal-1.0.0/.github/workflows/ci.yml --- old/aws-c-cal-0.9.15/.github/workflows/ci.yml 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/.github/workflows/ci.yml 2026-08-26 03:29:30.000000000 +0200 @@ -6,7 +6,7 @@ - 'main' env: - BUILDER_VERSION: v0.9.96 + BUILDER_VERSION: latest BUILDER_SOURCE: releases BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net PACKAGE_NAME: aws-c-cal diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.github/workflows/codecov.yml new/aws-c-cal-1.0.0/.github/workflows/codecov.yml --- old/aws-c-cal-0.9.15/.github/workflows/codecov.yml 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/.github/workflows/codecov.yml 2026-08-26 03:29:30.000000000 +0200 @@ -4,7 +4,7 @@ push: env: - BUILDER_VERSION: v0.9.74 + BUILDER_VERSION: latest BUILDER_SOURCE: releases BUILDER_HOST: https://d19elf31gohf1l.cloudfront.net PACKAGE_NAME: aws-c-cal diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/.github/workflows/release.yml new/aws-c-cal-1.0.0/.github/workflows/release.yml --- old/aws-c-cal-0.9.15/.github/workflows/release.yml 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/.github/workflows/release.yml 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,44 @@ +name: Release + +on: + workflow_dispatch: + inputs: + dry-run: + description: 'Compute and summarize the bump/version but do not commit, tag, or publish anything.' + required: false + default: 'false' + +concurrency: + group: ${{ github.workflow }} + cancel-in-progress: false + +env: + PACKAGE_NAME: aws-c-cal + CRT_CI_ROLE: ${{ secrets.CRT_CI_ROLE_ARN }} + AWS_DEFAULT_REGION: us-east-1 + +permissions: + id-token: write + contents: write + pull-requests: read + +jobs: + release: + name: release + runs-on: ubuntu-24.04 + steps: + - uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ env.CRT_CI_ROLE }} + aws-region: ${{ env.AWS_DEFAULT_REGION }} + + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Release + uses: awslabs/aws-crt-builder/.github/actions/auto-release@main + with: + lib-name: ${{ env.PACKAGE_NAME }} + dry-run: ${{ inputs.dry-run }} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/CHANGELOG.md new/aws-c-cal-1.0.0/CHANGELOG.md --- old/aws-c-cal-0.9.15/CHANGELOG.md 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/CHANGELOG.md 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,5 @@ +# Changelog + +## [1.0.0] + +Official release of 1.0.0. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/CMakeLists.txt new/aws-c-cal-1.0.0/CMakeLists.txt --- old/aws-c-cal-0.9.15/CMakeLists.txt 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/CMakeLists.txt 2026-08-26 03:29:30.000000000 +0200 @@ -3,7 +3,23 @@ cmake_minimum_required(VERSION 3.9...3.31) -project(aws-c-cal LANGUAGES C VERSION 0.1.0) +# In-source builds inherit aws-c-common's module path from the parent. Standalone +# builds must locate the installed modules here: find_package needs an enabled +# language, so it cannot run until after project(). +if (NOT IN_SOURCE_BUILD) + find_file(AWS_GET_VERSION_MODULE AwsGetVersion.cmake + PATH_SUFFIXES lib/cmake/aws-c-common/modules lib64/cmake/aws-c-common/modules) + if (NOT AWS_GET_VERSION_MODULE) + message(FATAL_ERROR "Could not find AwsGetVersion.cmake from an installed aws-c-common. Set CMAKE_PREFIX_PATH to the aws-c-common install prefix.") + endif() + get_filename_component(AWS_COMMON_MODULE_DIR "${AWS_GET_VERSION_MODULE}" DIRECTORY) + list(APPEND CMAKE_MODULE_PATH "${AWS_COMMON_MODULE_DIR}") +endif() + +include(AwsGetVersion) +aws_get_version(AWS_C_CAL_VERSION AWS_C_CAL_SOVERSION) + +project(aws-c-cal LANGUAGES C VERSION ${AWS_C_CAL_VERSION}) set(CMAKE_FIND_PACKAGE_PREFER_CONFIG TRUE) @@ -181,8 +197,8 @@ target_compile_definitions(${PROJECT_NAME} PRIVATE -DAWS_USE_LIBCRYPTO_TO_SUPPORT_ED25519_EVERYWHERE) endif() -# Our ABI is not yet stable -set_target_properties(${PROJECT_NAME} PROPERTIES VERSION 1.0.0) +set_target_properties(${PROJECT_NAME} PROPERTIES VERSION ${AWS_C_CAL_VERSION}) +set_target_properties(${PROJECT_NAME} PROPERTIES SOVERSION ${AWS_C_CAL_SOVERSION}) target_include_directories(${PROJECT_NAME} PUBLIC $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/CODEOWNERS new/aws-c-cal-1.0.0/CODEOWNERS --- old/aws-c-cal-0.9.15/CODEOWNERS 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/CODEOWNERS 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,5 @@ +# Code owners for aws-c-cal. +# See https://docs.github.com/articles/about-code-owners +# +# Owned by the AWS Common Runtime (CRT) team. +* @awslabs/aws-sdk-common-runtime-team diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/CONTRIBUTING.md new/aws-c-cal-1.0.0/CONTRIBUTING.md --- old/aws-c-cal-0.9.15/CONTRIBUTING.md 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/CONTRIBUTING.md 2026-08-26 03:29:30.000000000 +0200 @@ -54,6 +54,13 @@ If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. +## Versioning + +This project follows a three-part `Major.Minor.Patch` version scheme. Before +contributing, please review [VERSIONING.md](VERSIONING.md) to understand how +changes map to version bumps and our API/ABI stability policy. + + ## Licensing See the [LICENSE](https://github.com/awslabs/aws-c-cal/blob/main/LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/README.md new/aws-c-cal-1.0.0/README.md --- old/aws-c-cal-0.9.15/README.md 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/README.md 2026-08-26 03:29:30.000000000 +0200 @@ -2,6 +2,12 @@ AWS Crypto Abstraction Layer: Cross-Platform, C99 wrapper for cryptography primitives. +## Versioning + +This library uses a three-part `Major.Minor.Patch` version scheme. See +[VERSIONING.md](VERSIONING.md) for what each part means and our API/ABI +stability policy. + ## License This library is licensed under the Apache 2.0 License. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/VERSION new/aws-c-cal-1.0.0/VERSION --- old/aws-c-cal-0.9.15/VERSION 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/VERSION 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1 @@ +1.0.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/VERSIONING.md new/aws-c-cal-1.0.0/VERSIONING.md --- old/aws-c-cal-0.9.15/VERSIONING.md 1970-01-01 01:00:00.000000000 +0100 +++ new/aws-c-cal-1.0.0/VERSIONING.md 2026-08-26 03:29:30.000000000 +0200 @@ -0,0 +1,31 @@ +# Versioning + +This library follows a three-part version scheme, `X.Y.Z` +(`Major.Minor.Patch`). + +## What each part means + +- **X — Major.** A significant change that is expected to break backwards + compatibility. Adopting a new major version may require effort on your part. +- **Y — Minor.** A moderate change, such as a significant non-breaking feature + addition. A minor bump may also include a backwards-incompatible ABI change; + when it does, this is noted and explained in the release notes. Minor updates + are low effort to adopt: consumers need to rebuild against the new headers, + but source code changes are typically not required. +- **Z — Patch.** A small change that does not break backwards compatibility. A + patch release may warn of an upcoming breaking change. Patch updates can be + picked up automatically. + +## Branch stability + +Untagged branches (for example, `main`) are **not** subject to any API or ABI +stability policy. Stability guarantees apply only to tagged releases. + +## What this means for you + +We recommend running the latest release. Use the version parts as a guide to how +much effort an upgrade requires: + +- **Major (X):** expect adoption effort; review the release notes. +- **Minor (Y):** low effort; rebuild against the new headers when the ABI changes. +- **Patch (Z):** pick up automatically. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/ecc.h new/aws-c-cal-1.0.0/include/aws/cal/ecc.h --- old/aws-c-cal-0.9.15/include/aws/cal/ecc.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/ecc.h 2026-08-26 03:29:30.000000000 +0200 @@ -98,7 +98,7 @@ /** * Creates an Elliptic Curve public/private key pair from a DER encoded key pair. * Returns a new instance of aws_ecc_key_pair if the key was successfully built. - * Otherwise returns NULL. Whether or not signing or verification can be perform depends + * Otherwise returns NULL. Whether or not signing or verification can be performed depends * on if encoded_keys is a public/private pair or a public key. */ AWS_CAL_API struct aws_ecc_key_pair *aws_ecc_key_pair_new_from_asn1( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/hkdf.h new/aws-c-cal-1.0.0/include/aws/cal/hkdf.h --- old/aws-c-cal-0.9.15/include/aws/cal/hkdf.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/hkdf.h 2026-08-26 03:29:30.000000000 +0200 @@ -1,5 +1,5 @@ -#ifndef AWS_CAL_ECC_H -#define AWS_CAL_ECC_H +#ifndef AWS_CAL_HKDF_H +#define AWS_CAL_HKDF_H /** * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. * SPDX-License-Identifier: Apache-2.0. @@ -14,7 +14,7 @@ /** * Only supports SHA512 hmac for now. - * No reason other than thats the only one we need for now. + * No reason other than that's the only one we need for now. */ enum aws_hkdf_hmac_type { HKDF_HMAC_SHA512, @@ -52,4 +52,4 @@ AWS_EXTERN_C_END AWS_POP_SANE_WARNING_LEVEL -#endif /* AWS_CAL_ECC_H */ +#endif /* AWS_CAL_HKDF_H */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/hmac.h new/aws-c-cal-1.0.0/include/aws/cal/hmac.h --- old/aws-c-cal-0.9.15/include/aws/cal/hmac.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/hmac.h 2026-08-26 03:29:30.000000000 +0200 @@ -107,7 +107,7 @@ AWS_CAL_API void aws_set_sha256_hmac_new_fn(aws_hmac_new_fn *fn); /** - * Set the implementation of sha256 hmac to use. If you compiled without + * Set the implementation of sha512 hmac to use. If you compiled without * BYO_CRYPTO, you do not need to call this. However, if use this, we will * honor it, regardless of compile options. This may be useful for testing * purposes. If you did set BYO_CRYPTO, and you do not call this function @@ -118,4 +118,4 @@ AWS_EXTERN_C_END AWS_POP_SANE_WARNING_LEVEL -#endif /* AWS_CAL_HASH_H_ */ +#endif /* AWS_CAL_HMAC_H_ */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/private/der.h new/aws-c-cal-1.0.0/include/aws/cal/private/der.h --- old/aws-c-cal-0.9.15/include/aws/cal/private/der.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/private/der.h 2026-08-26 03:29:30.000000000 +0200 @@ -23,7 +23,7 @@ * During encoding aws_der_encoder_write_unsigned_integer assumes that cursor * points to a positive number and will prepend 0 if needed by DER spec to * indicate its positive number. Encoder does not support writing negative numbers. - * Decoder aws_der_encoder_write_unsigned_integer will strip any leading 0 as + * Decoder aws_der_decoder_tlv_unsigned_integer will strip any leading 0 as * needed and will error out if der contains negative number. * Take special care when integrating with 3p libraries cause they might expect * different format. Ex. this format matches what openssl calls bin format diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/rsa.h new/aws-c-cal-1.0.0/include/aws/cal/rsa.h --- old/aws-c-cal-0.9.15/include/aws/cal/rsa.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/rsa.h 2026-08-26 03:29:30.000000000 +0200 @@ -83,8 +83,8 @@ enum aws_rsa_encryption_algorithm algorithm); /* - * Uses the key_pair's private key to encrypt the plaintext. The output will be - * in out. out must be large enough to to hold the ciphertext. Check + * Uses the key_pair's public key to encrypt the plaintext. The output will be + * in out. out must be large enough to hold the ciphertext. Check * aws_rsa_key_pair_block_length() for output upper bound. */ AWS_CAL_API int aws_rsa_key_pair_encrypt( @@ -95,7 +95,7 @@ /* * Uses the key_pair's private key to decrypt the ciphertext. The output will be - * in out. out must be large enough to to hold the ciphertext. Check + * in out. out must be large enough to hold the plaintext. Check * aws_rsa_key_pair_block_length() for output upper bound. */ AWS_CAL_API int aws_rsa_key_pair_decrypt( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/include/aws/cal/symmetric_cipher.h new/aws-c-cal-1.0.0/include/aws/cal/symmetric_cipher.h --- old/aws-c-cal-0.9.15/include/aws/cal/symmetric_cipher.h 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/include/aws/cal/symmetric_cipher.h 2026-08-26 03:29:30.000000000 +0200 @@ -158,8 +158,8 @@ /** * Encrypts any remaining data that was reserved for final padding, loads GMACs etc... and if there is any * writes any remaining encrypted data to out. If out is dynamic it will be expanded. If it is not, and - * out is not large enough to handle the decrypted output, the call will fail. If you're trying to optimize - * to use a stack based array or something, make sure it's at least as large as the size of 2 BLOCKs to account for + * out is not large enough to handle the encrypted output, the call will fail. If you're trying to optimize + * to use a stack based array or something, make sure it's at least as large as the size of 2 BLOCKs to account for * padding etc... * * After invoking this function, you MUST call aws_symmetric_cipher_reset() before invoking any encrypt/decrypt @@ -190,10 +190,10 @@ * same cipher without a call to reset in between them. However, this leaves the key, iv etc... materials setup for * immediate reuse. * Note: GCM tag is not preserved between operations. If you intend to do encrypt followed directly by decrypt, make - * sure to make a copy of tag before reseting the cipher and pass that copy for decryption. + * sure to make a copy of tag before resetting the cipher and pass that copy for decryption. * * Warning: In most cases it's a really bad idea to reset a cipher and perform another operation using that cipher. - * Key and IV should not be reused for different operations. Instead of reseting the cipher, destroy the cipher + * Key and IV should not be reused for different operations. Instead of resetting the cipher, destroy the cipher * and create new one with a new key/iv pair. Use reset at your own risk, and only after careful consideration. * * returns AWS_OP_SUCCESS on success. Call aws_last_error() to determine the failure cause if it returns @@ -223,7 +223,7 @@ * This was done because the use case doesn't require fetching these during an * encryption or decryption operation and it dramatically simplifies the API. * - * Unlike some other fields, this value does not change after the inital construction of the cipher. + * Unlike some other fields, this value does not change after the initial construction of the cipher. * * For some algorithms, such as AES Keywrap, this will return an empty cursor. */ @@ -237,7 +237,7 @@ * This was done because the use case doesn't require fetching these during an * encryption or decryption operation and it dramatically simplifies the API. * - * Unlike some other fields, this value does not change after the inital construction of the cipher. + * Unlike some other fields, this value does not change after the initial construction of the cipher. */ AWS_CAL_API struct aws_byte_cursor aws_symmetric_cipher_get_key(const struct aws_symmetric_cipher *cipher); @@ -249,8 +249,8 @@ AWS_CAL_API bool aws_symmetric_cipher_is_good(const struct aws_symmetric_cipher *cipher); /** - * Retuns the current state of the cipher. Ther state of the cipher can be ready for use, finalized, or has encountered - * an error. if the cipher is in a finished or error state, it must be reset before further use. + * Returns the current state of the cipher. The state of the cipher can be ready for use, finalized, or has encountered + * an error. If the cipher is in a finished or error state, it must be reset before further use. */ AWS_CAL_API enum aws_symmetric_cipher_state aws_symmetric_cipher_get_state(const struct aws_symmetric_cipher *cipher); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/cal.c new/aws-c-cal-1.0.0/source/cal.c --- old/aws-c-cal-0.9.15/source/cal.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/cal.c 2026-08-26 03:29:30.000000000 +0200 @@ -13,8 +13,8 @@ AWS_DEFINE_ERROR_INFO_CAL( AWS_ERROR_CAL_MISSING_REQUIRED_KEY_COMPONENT, "An attempt was made to perform an " - "Asymmetric cryptographic operation with the" - "wrong key component. For example, attempt to" + "Asymmetric cryptographic operation with the " + "wrong key component. For example, attempt to " "verify a signature with a private key or " "sign a message with a public key."), AWS_DEFINE_ERROR_INFO_CAL( @@ -42,7 +42,7 @@ "A cipher material such as an initialization vector or tag was an incorrect size for the selected algorithm."), AWS_DEFINE_ERROR_INFO_CAL( AWS_ERROR_CAL_DER_UNSUPPORTED_NEGATIVE_INT, - "DER decoder does support negative integers."), + "DER decoder does not support negative integers."), AWS_DEFINE_ERROR_INFO_CAL(AWS_ERROR_CAL_UNSUPPORTED_KEY_FORMAT, "Key format is not supported."), AWS_DEFINE_ERROR_INFO_CAL( AWS_ERROR_CAL_CRYPTO_OPERATION_FAILED, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/darwin/securityframework_ecc.c new/aws-c-cal-1.0.0/source/darwin/securityframework_ecc.c --- old/aws-c-cal-0.9.15/source/darwin/securityframework_ecc.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/darwin/securityframework_ecc.c 2026-08-26 03:29:30.000000000 +0200 @@ -22,7 +22,7 @@ static size_t s_der_overhead = 8; -/* The hard-coded "valid" public keys. Copy/pated from one of our unit test. */ +/* The hard-coded "valid" public keys. Copy/pasted from one of our unit tests. */ const static uint8_t s_fake_x_ecdsa_p256[] = { 0xd0, 0x72, 0x0d, 0xc6, 0x91, 0xaa, 0x80, 0x09, 0x6b, 0xa3, 0x2f, 0xed, 0x1c, 0xb9, 0x7c, 0x2b, 0x62, 0x06, 0x90, 0xd0, 0x6d, 0xe0, 0x31, 0x7b, 0x86, 0x18, 0xd5, 0xce, 0x65, 0xeb, 0x72, 0x8f, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/darwin/securityframework_rsa.c new/aws-c-cal-1.0.0/source/darwin/securityframework_rsa.c --- old/aws-c-cal-0.9.15/source/darwin/securityframework_rsa.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/darwin/securityframework_rsa.c 2026-08-26 03:29:30.000000000 +0200 @@ -71,7 +71,7 @@ int crt_error = AWS_ERROR_CAL_CRYPTO_OPERATION_FAILED; /* - * Mac seems throws errSecVerifyFailed for any signature verification + * Mac seems to throw errSecVerifyFailed for any signature verification * failures (based on testing and not review of their code). * Which makes it impossible to distinguish between signature validation * failure and api call failure. @@ -219,7 +219,7 @@ struct sec_rsa_key_pair *key_pair_impl = key_pair->impl; if (key_pair_impl->priv_key_ref == NULL) { - AWS_LOGF_ERROR(AWS_LS_CAL_RSA, "RSA Key Pair is missing Private Key required for encrypt operation."); + AWS_LOGF_ERROR(AWS_LS_CAL_RSA, "RSA Key Pair is missing Private Key required for decrypt operation."); return aws_raise_error(AWS_ERROR_CAL_MISSING_REQUIRED_KEY_COMPONENT); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/der.c new/aws-c-cal-1.0.0/source/der.c --- old/aws-c-cal-0.9.15/source/der.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/der.c 2026-08-26 03:29:30.000000000 +0200 @@ -423,7 +423,7 @@ /* * DECODER */ -int s_decoder_parse(struct aws_der_decoder *decoder); +static int s_decoder_parse(struct aws_der_decoder *decoder); struct aws_der_decoder *aws_der_decoder_new(struct aws_allocator *allocator, struct aws_byte_cursor input) { struct aws_der_decoder *decoder = aws_mem_calloc(allocator, 1, sizeof(struct aws_der_decoder)); @@ -467,7 +467,7 @@ aws_mem_release(decoder->allocator, decoder); } -int s_parse_cursor(struct aws_der_decoder *decoder, struct aws_byte_cursor cur) { +static int s_parse_cursor(struct aws_der_decoder *decoder, struct aws_byte_cursor cur) { if (++decoder->depth > 16) { /* stream contains too many nested containers, probably malformed/attack */ return aws_raise_error(AWS_ERROR_CAL_MALFORMED_ASN1_ENCOUNTERED); @@ -518,7 +518,7 @@ return AWS_OP_SUCCESS; } -int s_decoder_parse(struct aws_der_decoder *decoder) { +static int s_decoder_parse(struct aws_der_decoder *decoder) { return s_parse_cursor(decoder, decoder->input); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/ecc.c new/aws-c-cal-1.0.0/source/ecc.c --- old/aws-c-cal-0.9.15/source/ecc.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/ecc.c 2026-08-26 03:29:30.000000000 +0200 @@ -148,7 +148,7 @@ static aws_ecc_key_pair_new_from_asn1_fn *s_ecc_key_pair_new_from_asn1_fn = aws_ecc_key_pair_new_from_asn1_impl; -static aws_ecc_key_pair_new_generate_random_fn *s_ecc_key_pair_new_generate_random1_fn = +static aws_ecc_key_pair_new_generate_random_fn *s_ecc_key_pair_new_generate_random_fn_impl = aws_ecc_key_pair_new_generate_random_impl; struct aws_ecc_key_pair *aws_ecc_key_pair_new_from_public_key( @@ -175,7 +175,7 @@ struct aws_ecc_key_pair *aws_ecc_key_pair_new_generate_random( struct aws_allocator *allocator, enum aws_ecc_curve_name curve_name) { - return s_ecc_key_pair_new_generate_random1_fn(allocator, curve_name); + return s_ecc_key_pair_new_generate_random_fn_impl(allocator, curve_name); } static void s_aws_ecc_key_pair_destroy(struct aws_ecc_key_pair *key_pair) { @@ -630,7 +630,7 @@ AWS_ERROR_PRECONDITION(out_curve_name); /** - * Since this is a generic api to parse from ans1, we can encounter several key structures. + * Since this is a generic api to parse from asn1, we can encounter several key structures. * Just go through them one by one and see if any match the expected type. * Note: We should at least get some id in the structure or unique enough layout so ordering does not matter. */ @@ -876,7 +876,7 @@ * * Note: skip params is used for pkcs8 case, where params structure is written out top level instead. */ -int s_export_sec1(const struct aws_ecc_key_pair *key_pair, bool should_skip_params, struct aws_byte_buf *out) { +static int s_export_sec1(const struct aws_ecc_key_pair *key_pair, bool should_skip_params, struct aws_byte_buf *out) { if (key_pair->priv_d.buffer == NULL) { return aws_raise_error(AWS_ERROR_CAL_MISSING_REQUIRED_KEY_COMPONENT); @@ -995,7 +995,7 @@ * publicKey [1] BIT STRING OPTIONAL * } */ -int s_export_pkcs8(const struct aws_ecc_key_pair *key_pair, struct aws_byte_buf *out) { +static int s_export_pkcs8(const struct aws_ecc_key_pair *key_pair, struct aws_byte_buf *out) { if (key_pair->priv_d.buffer == NULL) { return aws_raise_error(AWS_ERROR_CAL_MISSING_REQUIRED_KEY_COMPONENT); } @@ -1087,7 +1087,7 @@ * parameters ANY DEFINED BY algorithm OPTIONAL * } */ -int s_export_spki(const struct aws_ecc_key_pair *key_pair, struct aws_byte_buf *out) { +static int s_export_spki(const struct aws_ecc_key_pair *key_pair, struct aws_byte_buf *out) { struct aws_der_encoder *encoder = aws_der_encoder_new(key_pair->allocator, 256); if (aws_der_encoder_begin_sequence(encoder)) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/rsa.c new/aws-c-cal-1.0.0/source/rsa.c --- old/aws-c-cal-0.9.15/source/rsa.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/rsa.c 2026-08-26 03:29:30.000000000 +0200 @@ -135,7 +135,7 @@ AWS_PRECONDITION(aws_byte_cursor_is_valid(&plaintext)); if (AWS_UNLIKELY(aws_rsa_key_pair_max_encrypt_plaintext_size(key_pair, algorithm) < plaintext.len)) { - AWS_LOGF_ERROR(AWS_LS_CAL_RSA, "Unexpected buffer size. For RSA, ciphertext must not exceed block size"); + AWS_LOGF_ERROR(AWS_LS_CAL_RSA, "Unexpected buffer size. For RSA, plaintext must not exceed block size"); return aws_raise_error(AWS_ERROR_CAL_BUFFER_TOO_LARGE_FOR_ALGORITHM); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/shared/ref_hkdf.c new/aws-c-cal-1.0.0/source/shared/ref_hkdf.c --- old/aws-c-cal-0.9.15/source/shared/ref_hkdf.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/shared/ref_hkdf.c 2026-08-26 03:29:30.000000000 +0200 @@ -10,7 +10,7 @@ /* * Note: mac only provides hkdf starting in cryptokit (swift only) * and windows added convoluted api to generate hkdf starting with win 10+. - * in rfc5869. + * So we provide our own implementation as defined in rfc5869. */ enum { MAX_HMAC_SIZE = 64 }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/unix/openssl_platform_init.c new/aws-c-cal-1.0.0/source/unix/openssl_platform_init.c --- old/aws-c-cal-0.9.15/source/unix/openssl_platform_init.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/unix/openssl_platform_init.c 2026-08-26 03:29:30.000000000 +0200 @@ -16,7 +16,7 @@ /* * OpenSSL 3 has a large amount of interface changes and many of the functions used * throughout aws-c-cal have become deprecated. - * Lets disable deprecation warnings, so that we can atleast run CI, until we + * Lets disable deprecation warnings, so that we can at least run CI, until we * can move over to new functions. */ #define OPENSSL_SUPPRESS_DEPRECATED @@ -39,7 +39,7 @@ */ #if defined(OPENSSL_IS_AWSLC) || defined(OPENSSL_IS_BORINGSSL) /* TODO:the weak refs is not GUARANTEED to avoid linker to strip the symbol. - Build on musl with openssl 1.1.1w, those those was referenced, but still stripped from libcrypto during linking. + Build on musl with openssl 1.1.1w, those were referenced, but still stripped from libcrypto during linking. Logs was: ``` / # gcc -static -Wl,--trace-symbol=HMAC_CTX_new,-v -o test test.c -I $HOME/opt/aws/include -L $HOME/opt/aws/lib @@ -753,10 +753,10 @@ * AWSLC_thread_local_shutdown was added by aws-lc to let teams remove thread * local data manually before lib is unloaded. * We can't call AWSLC_thread_local_shutdown in cal cleanup because it renders - * aws-lc unusable and there is no way to reinitilize aws-lc to a working state, + * aws-lc unusable and there is no way to reinitialize aws-lc to a working state, * i.e. everything that depends on aws-lc stops working after shutdown (ex. curl). * So instead rely on GCC/Clang destructor extension to shutdown right before - * crt gets unloaded. Does not work on msvc, but thats a bridge we can cross at + * crt gets unloaded. Does not work on msvc, but that's a bridge we can cross at * a later date (since we dont support aws-lc on win right now) * TODO: do already init'ed check on lc similar to what we do for s2n, so we * only shutdown when we initialized aws-lc. currently not possible because diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/unix/opensslcrypto_ecc.c new/aws-c-cal-1.0.0/source/unix/opensslcrypto_ecc.c --- old/aws-c-cal-0.9.15/source/unix/opensslcrypto_ecc.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/unix/opensslcrypto_ecc.c 2026-08-26 03:29:30.000000000 +0200 @@ -273,7 +273,7 @@ BN_free(pub_x_num); } - if (pub_x_num) { + if (pub_y_num) { BN_free(pub_y_num); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/source/windows/bcrypt_aes.c new/aws-c-cal-1.0.0/source/windows/bcrypt_aes.c --- old/aws-c-cal-0.9.15/source/windows/bcrypt_aes.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/source/windows/bcrypt_aes.c 2026-08-26 03:29:30.000000000 +0200 @@ -609,7 +609,7 @@ cipher_impl->auth_info_ptr->pbTag = cipher->tag.buffer; cipher_impl->auth_info_ptr->cbTag = (ULONG)cipher->tag.capacity; /* bcrypt will either end up filling full tag buffer or in an error state, - /* in which tag will not be correct */ + in which tag will not be correct */ cipher->tag.len = AWS_AES_256_CIPHER_BLOCK_SIZE; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/tests/CMakeLists.txt new/aws-c-cal-1.0.0/tests/CMakeLists.txt --- old/aws-c-cal-0.9.15/tests/CMakeLists.txt 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/tests/CMakeLists.txt 2026-08-26 03:29:30.000000000 +0200 @@ -188,6 +188,7 @@ add_test_case(ecc_key_pair_asn1_ref_count_test) add_test_case(ecc_key_pair_private_ref_count_test) add_test_case(ecc_key_gen_from_private_fuzz_test) +add_test_case(ecdsa_p256_test_oversized_coordinate_rejected) add_test_case(ed25519_key_pair_generate_test) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/aws-c-cal-0.9.15/tests/ecc_test.c new/aws-c-cal-1.0.0/tests/ecc_test.c --- old/aws-c-cal-0.9.15/tests/ecc_test.c 2026-07-17 01:04:33.000000000 +0200 +++ new/aws-c-cal-1.0.0/tests/ecc_test.c 2026-08-26 03:29:30.000000000 +0200 @@ -1251,3 +1251,69 @@ AWS_TEST_CASE(ecc_key_gen_from_private_fuzz_test, s_ecc_key_gen_from_private_fuzz_test) #endif + +/* + * Verify that aws_ecc_key_pair_verify_signature gracefully rejects a + * DER-encoded signature containing a coordinate larger than the curve's + * field size. + * + * For P-256, each coordinate should be at most 33 bytes (32 + 1 leading zero + * for DER integer sign padding). We test: + * 1. r = 34 bytes (just 1 byte over the 33-byte max) -- boundary rejection + * 2. r = 33 bytes (valid size), s = 34 bytes (just 1 byte over) -- validates + * both coordinates are checked independently + */ +static int s_ecdsa_p256_test_oversized_coordinate_rejected(struct aws_allocator *allocator, void *ctx) { + (void)ctx; + + aws_cal_library_test_init(allocator); + + struct aws_ecc_key_pair *key_pair = aws_ecc_key_pair_new_generate_random(allocator, AWS_CAL_ECDSA_P256); + ASSERT_NOT_NULL(key_pair); + + uint8_t digest[32] = {0}; + struct aws_byte_cursor digest_cur = aws_byte_cursor_from_array(digest, sizeof(digest)); + + /* Case 1: r = 34 bytes (one byte over the 33-byte max), s = 32 bytes. + * This is the boundary case: 33 is valid, 34 must be rejected. */ + static const uint8_t sig_r_34[] = { + 0x30, 0x46, /* SEQUENCE, 70 bytes */ + 0x02, 0x22, /* INTEGER, 34 bytes (r) -- one byte over max */ + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, /* r value: 34 bytes */ + 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, + 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, 0x02, 0x20, /* INTEGER, 32 bytes (s) -- valid size + */ + 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, /* s value: 32 bytes */ + 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, + 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, + }; + + struct aws_byte_cursor sig_cur = aws_byte_cursor_from_array(sig_r_34, sizeof(sig_r_34)); + int result = aws_ecc_key_pair_verify_signature(key_pair, &digest_cur, &sig_cur); + ASSERT_TRUE(result != AWS_OP_SUCCESS, "r=34 bytes should be rejected (max is 33)"); + + /* Case 2: r = 33 bytes (valid), s = 34 bytes (one byte over max). + * Proves the validation checks the s coordinate independently. */ + static const uint8_t sig_s_34[] = { + 0x30, 0x47, /* SEQUENCE, 71 bytes */ + 0x02, 0x21, /* INTEGER, 33 bytes (r) -- valid (32 + leading zero) */ + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, /* r value: 33 bytes */ + 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, + 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x02, 0x22, /* INTEGER, 34 bytes (s) -- one byte + over max */ + 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, /* s value: 34 bytes */ + 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, + 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20, 0x21, + }; + + sig_cur = aws_byte_cursor_from_array(sig_s_34, sizeof(sig_s_34)); + result = aws_ecc_key_pair_verify_signature(key_pair, &digest_cur, &sig_cur); + ASSERT_TRUE(result != AWS_OP_SUCCESS, "r=33 s=34 bytes should be rejected (s exceeds max)"); + + aws_ecc_key_pair_release(key_pair); + aws_cal_library_clean_up(); + + return AWS_OP_SUCCESS; +} + +AWS_TEST_CASE(ecdsa_p256_test_oversized_coordinate_rejected, s_ecdsa_p256_test_oversized_coordinate_rejected)
