engine: Initial skeleton structure by walterchris · Pull Request #353 · Azure/azihsm-sdk

walterchris · 2026-04-30T14:42:17Z

No description provided.

Copilot

Pull request overview

Introduces an initial skeleton for an OpenSSL 1.1.x ENGINE plugin in the plugins/ossl_engine/ area, including a raw FFI sys crate (bindgen-generated bindings), a planned safe wrapper crate, and a stub engine crate intended to integrate with azihsm_api.

Changes:

Added openssl-sys-engine crate with a bindgen-based build.rs and a minimal wrapper.h.
Added openssl-engine crate as a placeholder for safe abstractions over the ENGINE API.
Added azihsm_engine crate stub intended to become the dynamic ENGINE implementation.
Registered the new crates in the workspace and added bindgen/pkg-config to workspace dependencies.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
plugins/ossl_engine/openssl-sys-engine/wrapper.h	Bindgen wrapper header + exported constants for binding generation.
plugins/ossl_engine/openssl-sys-engine/src/lib.rs	Sys crate entrypoint that includes generated bindings.
plugins/ossl_engine/openssl-sys-engine/build.rs	pkg-config discovery + bindgen generation for OpenSSL ENGINE-related APIs.
plugins/ossl_engine/openssl-sys-engine/Cargo.toml	New sys crate manifest (build-deps: bindgen, pkg-config).
plugins/ossl_engine/openssl-engine/src/lib.rs	Stub safe-wrapper crate re-exporting the sys crate.
plugins/ossl_engine/openssl-engine/Cargo.toml	New wrapper crate manifest.
plugins/ossl_engine/engine/src/lib.rs	Stub AZIHSM ENGINE crate documentation.
plugins/ossl_engine/engine/Cargo.toml	New ENGINE crate manifest (cdylib + lib).
Cargo.toml	Adds new workspace members and workspace deps for bindgen/pkg-config.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Enable the provider to be built and tested against both OpenSSL 3.0.3 and 3.5.0 in parallel. No new provider features — this lays the structural groundwork for upcoming 3.5-only functionality. The provider's existing version guards (#if OPENSSL_VERSION_MINOR == 0) already handle the polyfill exclusion correctly on 3.5. All 69 integration tests (27 CLI + 42 CAPI) pass on both versions. Key changes: - CI matrix on provider_integration job (3.0.3 + 3.5.0) - xtask --openssl-version flag for local multi-version testing - Fix: CAPI harness now sets LD_LIBRARY_PATH on openssl subprocesses (was relying on system libs being ABI-compatible — breaks on 3.5) - Version gating helpers for future 3.5-only tests (C++ preprocessor guards, shell skip_below_ossl_3_5 helper) Signed-off-by: Jens Topp <jens.topp@9elements.com>

Make OpenSSL version mismatches structurally impossible: each ABI version's build artifacts and OpenSSL install live in a separate target subtree, so versions can coexist and switching needs no `cargo clean`. Three coordinated layers: 1. `.cargo/config.toml` defaults `target-dir = "target/ossl-abi-3-0"`, so plain `cargo build` and IDE/rust-analyzer work out of the box for the default OpenSSL 3.0 ABI. 2. Provider `build.rs` extracts the ABI from `CARGO_TARGET_DIR`, validates it against the supported list (3-0, 3-5), and derives `OPENSSL_DIR` from the path. Raw `cargo build` outside the convention fails with a clear, actionable panic message — silent version mismatches become impossible. 3. xtask sets `CARGO_TARGET_DIR=target/ossl-abi-{major}-{minor}` from the `--openssl-version` flag (default 3.0.3). Added the flag to `setup`, `build`, and `integration-tests` so the same value drives install, build, and tests. Other changes: - Resolve Corrosion deadlock: build.rs now redirects CMake's nested cargo probe (`cargo rustc --print=native-static-libs`) to a separate target dir under <OUT_DIR>/corrosion-target/, so it doesn't contend on the outer cargo's target-dir lock. - xtask integration-tests now sets OPENSSL_LIB to a `:`-separated list (openssl/lib + cargo debug dir) so libazihsm_api_native.so is resolved from Cargo's build, not Corrosion's stale parallel build. The CAPI harness accepts this list form. - env.sh and the CAPI harness honour CARGO_TARGET_DIR when deriving the provider .so path. - CI workflow uses matrix entries `{ openssl-version, openssl-abi }` to drive both the install path and the target dir, with continue-on-error for the 3.5.0 entry while support stabilises. - Documentation: top-level README, xtask README, and provider README all reflect the new flow, leading with `cargo xtask build --openssl-version <ver>` as the recommended path. Signed-off-by: Jens Topp <jens.topp@9elements.com>

…dirs The NGINX test harness defaulted to `target/debug/azihsm_provider.so` — breaks in CI where artifacts live in `target/ossl-abi-3-0/debug/`. Honour CARGO_TARGET_DIR (already set at job level), same fix we applied to the CAPI harness in the previous commit. Also update the stale "build the provider first" hint in both harnesses to point at `cargo xtask build --openssl-version <ver>`. Signed-off-by: Jens Topp <jens.topp@9elements.com>

The provider's build.rs always invoked CMake, which in turn drives Corrosion to compile azihsm_api_native and its full dependency tree. This is wasted work for `cargo clippy` / `cargo check`: they only type-check Rust source, they don't link, so they don't need the provider's .so or the linked native lib. The wasted invocation predates the OpenSSL ABI work. On main, the cost was bounded because outer cargo (clippy) and inner cargo (Corrosion's build of azihsm_api_native) shared the same target directory — so deps compiled by clippy were reused by Corrosion. The earlier deadlock fix in build.rs (which redirects Corrosion's nested cargo to <OUT_DIR>/corrosion-target/) splits those into separate target dirs. Outer cargo writes to target/ossl-abi-<major>-<minor>/, inner cargo to corrosion-target/. No more sharing → every dep gets compiled twice during clippy. On the GitHub Actions runner this pushed the clippy job past 2 hours. Detect clippy via RUSTC_WORKSPACE_WRAPPER (cargo sets it to the path of clippy-driver) and early-return before invoking CMake. Strictly faster than the pre-existing behaviour as well, since the wasted CMake work was always there. Signed-off-by: Jens Topp <jens.topp@9elements.com>

Copilot

Pull request overview

Copilot reviewed 17 out of 17 changed files in this pull request and generated 4 comments.

The same two-part fix applied to plugins/ossl_prov/build.rs is needed here: api/tests/cpp/CMakeLists.txt also uses corrosion_import_crate, so api/tests/build.rs has the same flock() deadlock when CARGO_TARGET_DIR is set, and the same wasted CMake work under clippy/check. Fix: - Detect clippy via RUSTC_WORKSPACE_WRAPPER and early-return. - Redirect Corrosion's nested cargo to <OUT_DIR>/corrosion-target/ via the CMake child process's CARGO_TARGET_DIR env. Signed-off-by: Jens Topp <jens.topp@9elements.com>

Copilot

Pull request overview

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

xtask/src/precheck.rs:237

IntegrationTest::parse_from([]) relies on clap defaults (currently OpenSSL 3.0.3) and ignores any version selection the caller may have intended via env vars or prior setup. If precheck is meant to run provider integration tests for a specific ABI, pass an explicit openssl_version into IntegrationTest (or parse from OPENSSL_VERSION/CARGO_TARGET_DIR) rather than instantiating it with empty args.

                    // OSSL Provider integration tests (CLI + C API, Linux only)
                    #[cfg(target_os = "linux")]
                    integration_tests::IntegrationTest::parse_from::<[&str; 0], &str>([])
                        .run(ctx.clone())?;

cargo llvm-cov isolates coverage artifacts by appending `llvm-cov-target` to CARGO_TARGET_DIR. With CARGO_TARGET_DIR=target/ossl-abi-3-0, that becomes target/ossl-abi-3-0/llvm-cov-target — the ossl-abi-3-0 segment is now in the parent, not the leaf. The previous validation in plugins/ossl_prov/build.rs checked only the leaf, so cargo xtask precheck --coverage failed. Fix: Search the path ancestors for the ossl-abi-<major>-<minor> segment instead. Derive OPENSSL_DIR from that segment's directory rather than from the leaf so it still resolves to <abi_dir>/openssl whether the build sits in abi_dir or a sub-tree underneath. Signed-off-by: Jens Topp <jens.topp@9elements.com>

Copilot

Pull request overview

Copilot reviewed 58 out of 58 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

plugins/ossl_engine/openssl-sys-engine/build.rs:98

These link directives also use cargo:: instead of cargo:. When the build script selects the xtask-installed OpenSSL (skipping pkg-config), Cargo won’t receive the rustc-link-lib / rustc-link-search metadata and the crate is likely to fail to link. Use cargo:rustc-link-lib and cargo:rustc-link-search here.
xtask/src/setup.rs:55
Doc says openssl_version is ignored when OPENSSL_DIR is already set, but setup still uses it to set CARGO_TARGET_DIR (ABI leaf) and then proceeds with the OpenSSL install flow. Either align the behavior with the doc (skip using openssl_version when OPENSSL_DIR is set) or adjust the doc to clarify that the flag still affects target-dir routing even when using a custom OPENSSL_DIR.

This commit adds the skeleton code for the OpenSSL engine. It also adds the precheck target to download and install openSSL 1.1.1w which is necessary for the engine. This commit introduces three crates: - openssl-sys-engine: Auto-generated C bindings - openssl-engine: Safe wrappers - engine: The actual engine code Signed-off-by: Christian Walter <christian.walter@9elements.com>

Copilot AI review requested due to automatic review settings April 30, 2026 14:42

Copilot started reviewing on behalf of walterchris April 30, 2026 14:43 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

walterchris force-pushed the engine/initialSkeleton branch from 82f7db1 to 038303f Compare May 8, 2026 21:08

Copilot AI review requested due to automatic review settings May 8, 2026 21:40

Copilot started reviewing on behalf of walterchris May 8, 2026 21:41 View session

Copilot AI reviewed May 8, 2026

View reviewed changes

walterchris force-pushed the engine/initialSkeleton branch from 22b9563 to 1ef55ab Compare May 8, 2026 22:15

walterchris added the ossl label May 12, 2026

Copilot AI review requested due to automatic review settings May 12, 2026 07:15

Copilot started reviewing on behalf of walterchris May 12, 2026 07:16 View session

walterchris force-pushed the engine/initialSkeleton branch from 47d8cd7 to 46df0d2 Compare May 12, 2026 07:17

Copilot AI reviewed May 12, 2026

View reviewed changes

Comment thread plugins/ossl_engine/openssl-engine/src/engine.rs Outdated

Comment thread .github/workflows/rust.yml Outdated

Comment thread xtask/src/openssl_install.rs Outdated

walterchris force-pushed the engine/initialSkeleton branch from 46df0d2 to 8ae5e2d Compare May 12, 2026 13:13

walterchris marked this pull request as ready for review May 12, 2026 15:09

Copilot AI review requested due to automatic review settings May 12, 2026 15:09

Copilot started reviewing on behalf of walterchris May 12, 2026 15:10 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

Comment thread plugins/ossl_engine/openssl-engine/src/engine.rs Outdated

Comment thread plugins/ossl_engine/openssl-engine/src/engine.rs

Comment thread .github/workflows/rust.yml Outdated

Comment thread .github/workflows/codeql.yml Outdated

Copilot AI review requested due to automatic review settings May 13, 2026 07:19

walterchris force-pushed the engine/initialSkeleton branch from e36bdfb to a458ca4 Compare May 13, 2026 07:19

Copilot started reviewing on behalf of walterchris May 13, 2026 07:20 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

Comment thread xtask/src/openssl_install.rs Outdated

Comment thread plugins/ossl_engine/openssl-sys-engine/build.rs

Comment thread plugins/ossl_engine/openssl-sys-engine/build.rs

Copilot AI review requested due to automatic review settings May 13, 2026 21:45

walterchris force-pushed the engine/initialSkeleton branch from d871ece to 5a180df Compare May 13, 2026 21:45

Copilot started reviewing on behalf of walterchris May 13, 2026 21:46 View session

Copilot AI reviewed May 13, 2026

View reviewed changes

walterchris force-pushed the engine/initialSkeleton branch from 5a180df to 957764b Compare May 19, 2026 07:44

jenstopp added 3 commits May 19, 2026 22:42

Copilot AI review requested due to automatic review settings May 20, 2026 11:18

walterchris force-pushed the engine/initialSkeleton branch from 957764b to 5e3ef4b Compare May 20, 2026 11:18

Copilot started reviewing on behalf of walterchris May 20, 2026 11:21 View session

Copilot AI reviewed May 20, 2026

View reviewed changes

Comment thread plugins/ossl_engine/openssl-engine/src/engine.rs Outdated

Comment thread plugins/ossl_engine/openssl-engine/src/engine.rs

Comment thread xtask/src/openssl_install.rs Outdated

Comment thread xtask/src/openssl_install.rs

walterchris force-pushed the engine/initialSkeleton branch from 5e3ef4b to 9f84af4 Compare May 21, 2026 07:04

Copilot AI review requested due to automatic review settings May 21, 2026 07:29

walterchris force-pushed the engine/initialSkeleton branch from 9f84af4 to 46d013b Compare May 21, 2026 07:29

Copilot started reviewing on behalf of walterchris May 21, 2026 07:31 View session

Copilot AI reviewed May 21, 2026

View reviewed changes

Comment thread xtask/src/precheck.rs

Comment thread xtask/src/build.rs

Comment thread xtask/src/integration_tests.rs

walterchris force-pushed the engine/initialSkeleton branch from 46d013b to e0976b2 Compare May 21, 2026 09:49

Copilot AI review requested due to automatic review settings May 21, 2026 18:06

walterchris force-pushed the engine/initialSkeleton branch from e0976b2 to 067822f Compare May 21, 2026 18:06

Copilot started reviewing on behalf of walterchris May 21, 2026 18:09 View session

walterchris changed the base branch from main to azihsm-sdk-ossl-3-5 May 21, 2026 18:16

Copilot AI reviewed May 21, 2026

View reviewed changes

Comment thread api/lib/src/ddi/partition.rs Outdated

walterchris changed the base branch from azihsm-sdk-ossl-3-5 to main May 21, 2026 18:20

walterchris force-pushed the engine/initialSkeleton branch from 067822f to 1dba265 Compare May 21, 2026 18:21

walterchris changed the base branch from main to azihsm-sdk-ossl-3-5 May 21, 2026 18:21

walterchris force-pushed the engine/initialSkeleton branch from 1dba265 to 0c7df16 Compare May 21, 2026 18:22

jenstopp force-pushed the azihsm-sdk-ossl-3-5 branch 2 times, most recently from 24fc7ed to ecc22f2 Compare May 22, 2026 21:42

Conversation

walterchris commented Apr 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants