Merge branch '2.8'

Author: aasmith

Dockerfile.multiarch

@@ -3,10 +3,9 @@ ARG OS=
 ARG ARCH=
 ARG TOOLCHAIN=
 ARG TOOLCHAIN_PREFIX=
-ARG OPENSSL_TARGET=
 
-ARG OPENSSL_VERSION=
-ARG OPENSSL_SHA256=
+ARG AWS_LC_VERSION=
+ARG AWS_LC_SHA256=
 
 ARG PCRE2_VERSION=
 ARG PCRE2_SHA256=
@@ -29,31 +28,37 @@ ARG ARCH_FLAGS
 RUN dpkg --add-architecture "${ARCH}" && \
     apt-get update && \
     apt-get install --no-install-recommends -y \
-            gcc-10-${TOOLCHAIN} libc6-dev-${ARCH}-cross make file libc6-dev perl libtext-template-perl \
-            libreadline-dev curl ca-certificates libcrypt-dev:${ARCH} gcc-10 binutils-${TOOLCHAIN} binutils
+            gcc-12-${TOOLCHAIN} g++-12-${TOOLCHAIN} libc6-dev-${ARCH}-cross make file libc6-dev perl libtext-template-perl \
+            libreadline-dev curl ca-certificates libcrypt-dev:${ARCH} gcc-12 g++-12 binutils-${TOOLCHAIN} binutils \
+            cmake ninja-build golang
 
-### OpenSSL
+### AWS-LC
 
-FROM builder as ssl
+FROM builder as awslc
 
 ARG ARCH
 ARG TOOLCHAIN
 ARG TOOLCHAIN_PREFIX
 ARG ARCH_FLAGS
 
-ARG OPENSSL_VERSION
-ARG OPENSSL_SHA256
-ARG OPENSSL_TARGET
-
-RUN curl -OJL https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz && \
-    echo ${OPENSSL_SHA256} openssl-${OPENSSL_VERSION}.tar.gz | sha256sum -c && \
-    tar zxvf openssl-${OPENSSL_VERSION}.tar.gz && \
-    cd openssl-${OPENSSL_VERSION} && \
-    ./Configure ${OPENSSL_TARGET} --cross-compile-prefix=/usr/bin/${TOOLCHAIN_PREFIX}- CC=gcc-10 \
-             -march=${ARCH_FLAGS} enable-ec_nistp_64_gcc_128 \
-             no-shared --prefix=/tmp/openssl --openssldir=/tmp/openssl --libdir=lib && \
-    make && \
-    make install_sw
+ARG AWS_LC_VERSION
+ARG AWS_LC_SHA256
+
+RUN curl -OJL https://github.com/aws/aws-lc/archive/refs/tags/${AWS_LC_VERSION}.tar.gz && \
+    echo ${AWS_LC_SHA256} aws-lc-${AWS_LC_VERSION#v}.tar.gz | sha256sum -c && \
+    tar zxvf aws-lc-${AWS_LC_VERSION#v}.tar.gz && \
+    cd aws-lc-${AWS_LC_VERSION#v} && \
+    if [ "${ARCH}" = "amd64" ]; then CMAKE_ARCH="x86_64"; elif [ "${ARCH}" = "arm64" ]; then CMAKE_ARCH="aarch64"; else CMAKE_ARCH="${ARCH}"; fi && \
+    cmake -GNinja \
+          -DCMAKE_SYSTEM_NAME=Linux \
+          -DCMAKE_SYSTEM_PROCESSOR=${CMAKE_ARCH} \
+          -DCMAKE_C_COMPILER=/usr/bin/${TOOLCHAIN_PREFIX}-gcc-12 \
+          -DCMAKE_CXX_COMPILER=/usr/bin/${TOOLCHAIN_PREFIX}-g++-12 \
+          -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF \
+          -DCMAKE_INSTALL_PREFIX=/tmp/awslc \
+           . && \
+    ninja && \
+    ninja install
 
 ### PCRE2
 
@@ -71,7 +76,7 @@ RUN curl -OJL "https://github.com/PhilipHazel/pcre2/releases/download/pcre2-${PC
     echo ${PCRE2_SHA256} pcre2-${PCRE2_VERSION}.tar.gz | sha256sum -c && \
     tar zxvf pcre2-${PCRE2_VERSION}.tar.gz && \
     cd pcre2-${PCRE2_VERSION} && \
-    CC=/usr/bin/${TOOLCHAIN_PREFIX}-gcc-10 CFLAGS="-O3 -march=${ARCH_FLAGS} -g" \
+    CC=/usr/bin/${TOOLCHAIN_PREFIX}-gcc-12 CFLAGS="-O3 -march=${ARCH_FLAGS} -g" \
     ./configure --prefix=/tmp/pcre2 --disable-shared --enable-jit --host=${TOOLCHAIN} && \
     make install
 
@@ -91,7 +96,7 @@ RUN curl -OJL "http://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz" && \
     echo "${LUA_MD5} lua-${LUA_VERSION}.tar.gz" | md5sum -c && \
     tar zxf lua-${LUA_VERSION}.tar.gz && \
     cd lua-${LUA_VERSION} && \
-    make CC="/usr/bin/${TOOLCHAIN_PREFIX}-gcc-10" \
+    make CC="/usr/bin/${TOOLCHAIN_PREFIX}-gcc-12" \
          MYCFLAGS="-march=${ARCH_FLAGS} -g" \
          AR="/usr/bin/${TOOLCHAIN_PREFIX}-ar rcu" \
          RANLIB=/usr/bin/${TOOLCHAIN_PREFIX}-ranlib && \
@@ -101,7 +106,7 @@ RUN curl -OJL "http://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz" && \
 
 FROM builder as haproxy
 
-COPY --from=ssl   /tmp/openssl /tmp/openssl
+COPY --from=awslc /tmp/awslc /tmp/awslc
 COPY --from=pcre2 /tmp/pcre2   /tmp/pcre2
 COPY --from=lua   /tmp/lua     /tmp/lua
 
@@ -120,10 +125,10 @@ RUN curl -OJL "http://www.haproxy.org/download/${HAPROXY_MAJOR}/src/haproxy-${HA
     make -C haproxy-${HAPROXY_VERSION} \
       TARGET=linux-glibc \
       ARCH_FLAGS="-march=${ARCH_FLAGS}" \
-      CC=/usr/bin/${TOOLCHAIN_PREFIX}-gcc-10 \
+      CC=/usr/bin/${TOOLCHAIN_PREFIX}-gcc-12 \
       USE_SLZ=1 \
       USE_STATIC_PCRE2=1 USE_PCRE2_JIT=1 PCRE2DIR=/tmp/pcre2 \
-      USE_OPENSSL=1 SSL_INC=/tmp/openssl/include SSL_LIB=/tmp/openssl/lib \
+      USE_OPENSSL=1 SSL_INC=/tmp/awslc/include SSL_LIB=/tmp/awslc/lib \
       USE_LUA=1 LUA_LIB=/tmp/lua/lib LUA_INC=/tmp/lua/include \
       USE_PROMEX=1 \
       DESTDIR=/tmp/haproxy PREFIX= \
@@ -145,3 +150,4 @@ COPY --from=haproxy /tmp/haproxy /usr/local/
 RUN rm -rf /var/lib/apt/lists/*
 
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
+

Dockerfile.native

@@ -1,7 +1,7 @@
 ARG OS=
 
-ARG OPENSSL_VERSION=
-ARG OPENSSL_SHA256=
+ARG AWS_LC_VERSION=
+ARG AWS_LC_SHA256=
 
 ARG PCRE2_VERSION=
 ARG PCRE2_SHA256=
@@ -18,24 +18,27 @@ ARG LUA_MD5=
 FROM $OS as builder
 
 RUN apt-get update && \
-    apt-get install --no-install-recommends -y gcc make file libc6-dev perl libtext-template-perl libreadline-dev curl ca-certificates libcrypt-dev
+    apt-get install --no-install-recommends -y gcc g++ make file libc6-dev perl libtext-template-perl libreadline-dev curl ca-certificates libcrypt-dev \
+    cmake ninja-build golang
 
 
-### OpenSSL
+### AWS-LC
 
-FROM builder as ssl
+FROM builder as awslc
 
-ARG OPENSSL_VERSION
-ARG OPENSSL_SHA256
+ARG AWS_LC_VERSION
+ARG AWS_LC_SHA256
 
-RUN curl -OJL https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz && \
-    echo ${OPENSSL_SHA256} openssl-${OPENSSL_VERSION}.tar.gz | sha256sum -c && \
-    tar zxvf openssl-${OPENSSL_VERSION}.tar.gz && \
-    cd openssl-${OPENSSL_VERSION} && \
-    ./config no-shared --prefix=/tmp/openssl --openssldir=/tmp/openssl --libdir=lib && \
-    make && \
-    make test && \
-    make install_sw
+RUN curl -OJL https://github.com/aws/aws-lc/archive/refs/tags/${AWS_LC_VERSION}.tar.gz && \
+    echo ${AWS_LC_SHA256} aws-lc-${AWS_LC_VERSION#v}.tar.gz | sha256sum -c && \
+    tar zxvf aws-lc-${AWS_LC_VERSION#v}.tar.gz && \
+    cd aws-lc-${AWS_LC_VERSION#v} && \
+    cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTING=ON -DBUILD_SHARED_LIBS=OFF \
+          -DCMAKE_INSTALL_PREFIX=/tmp/awslc \
+           . && \
+    ninja && \
+    ninja run_tests && \
+    ninja install
 
 
 ### PCRE2
@@ -74,7 +77,7 @@ RUN curl -OJL "http://www.lua.org/ftp/lua-${LUA_VERSION}.tar.gz" && \
 
 FROM builder as haproxy
 
-COPY --from=ssl   /tmp/openssl /tmp/openssl
+COPY --from=awslc /tmp/awslc /tmp/awslc
 COPY --from=pcre2 /tmp/pcre2   /tmp/pcre2
 
 COPY --from=lua   /tmp/lua/bin     /usr/local/bin
@@ -92,7 +95,7 @@ RUN curl -OJL "http://www.haproxy.org/download/${HAPROXY_MAJOR}/src/haproxy-${HA
       TARGET=linux-glibc \
       USE_SLZ=1 \
       USE_STATIC_PCRE2=1 USE_PCRE2_JIT=1 PCRE2DIR=/tmp/pcre2 \
-      USE_OPENSSL=1 SSL_INC=/tmp/openssl/include SSL_LIB=/tmp/openssl/lib \
+      USE_OPENSSL=1 SSL_INC=/tmp/awslc/include SSL_LIB=/tmp/awslc/lib \
       USE_LUA=1 \
       USE_PROMEX=1 \
       DESTDIR=/tmp/haproxy PREFIX= \
@@ -114,3 +117,4 @@ COPY --from=haproxy /tmp/haproxy /usr/local/
 RUN rm -rf /var/lib/apt/lists/*
 
 CMD ["haproxy", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
+

build.sh

@@ -8,20 +8,20 @@ fi
 set -eu
 shopt -s extglob
 
-export OS=debian:bullseye-slim
-export OPENSSL_VERSION=3.0.8
-export OPENSSL_SHA256=6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e
+export OS=debian:bookworm-slim
+export AWS_LC_VERSION=v1.66.2
+export AWS_LC_SHA256=d64a46b4f75fa5362da412f1e96ff5b77eed76b3a95685651f81a558c5c9e126
 
-export PCRE2_VERSION=10.42
-export PCRE2_SHA256=c33b418e3b936ee3153de2c61cc638e7e4fe3156022a5c77d0711bcbb9d64f1f
+export PCRE2_VERSION=10.47
+export PCRE2_SHA256=c08ae2388ef333e8403e670ad70c0a11f1eed021fd88308d7e02f596fcd9dc16
 
 # See the 'current-version' file for values used for the current build and to reproduce.
 export HAPROXY_MAJOR=$1
 export HAPROXY_VERSION=$2
 export HAPROXY_SHA256=$3
 
-export LUA_VERSION=5.4.4
-export LUA_MD5=bd8ce7069ff99a400efd14cf339a727b
+export LUA_VERSION=5.4.7
+export LUA_MD5=fc3f3291353bbe6ee6dec85ee61331e8
 
 # If not running in CI, then this won't be a real build that gets pushed
 if [ -z "${CI-}" ]; then
@@ -75,8 +75,8 @@ for buildspec in $CROSS_SPECS; do
 
   docker buildx build -f Dockerfile.multiarch -t "$IMAGE_NAME" \
     --build-arg OS \
-    --build-arg OPENSSL_VERSION \
-    --build-arg OPENSSL_SHA256 \
+    --build-arg AWS_LC_VERSION \
+    --build-arg AWS_LC_SHA256 \
     --build-arg PCRE2_VERSION \
     --build-arg PCRE2_SHA256 \
     --build-arg LUA_VERSION \
@@ -88,7 +88,6 @@ for buildspec in $CROSS_SPECS; do
     --build-arg ARCH_FLAGS \
     --build-arg TOOLCHAIN \
     --build-arg TOOLCHAIN_PREFIX \
-    --build-arg OPENSSL_TARGET \
     --provenance=false \
     --$ACTION \
     .
@@ -109,8 +108,8 @@ echo "Building '$IMAGE_NAME'..."
 
 docker buildx build -f Dockerfile.native -t "$IMAGE_NAME" \
   --build-arg OS \
-  --build-arg OPENSSL_VERSION \
-  --build-arg OPENSSL_SHA256 \
+  --build-arg AWS_LC_VERSION \
+  --build-arg AWS_LC_SHA256 \
   --build-arg PCRE2_VERSION \
   --build-arg PCRE2_SHA256 \
   --build-arg LUA_VERSION \

current-version

@@ -1 +1 @@
-./build.sh 2.7 2.7.8 15f2276971bbba8c47d86cc82ebfc6ec33e3aef2e4565058b2e4950c07b8e75c
+./build.sh 2.8 2.8.18 5664a435f3e5f8c22bd97adc219de6a6e73aa6be68b8d17d7324286112cf88cf