gh-135401: Test AWS-LC as a cryptography library in CI

[WillChilds-Klein]

Notes

Currently in draft status to test the new workflow. Building AWS-LC, linking the interpreter to it dynamically, and running the ssl tests all appear to work fine. I'm still working on remaining issues in test_hmac.

TODO

• The proposal to remove NID_blake2b512 from ./configure's hashlib feature probe may be controversial, so we need to make sure this is adequately discussed. I believe that this is safe to do because CPython now guards BLAKE2 usages based on whether or not the underlying cryptography library supports it.
• Engage with @picnixz to discuss 8f4a0eb, which modifies a test he recently wrote.
• @WillChilds-Klein to fix test_hmac failures

---

• Issue: Add ssl module test for AWS-LC #135401

[AA-Turner]

Suggested change

	"""Run Python tests against multiple installations of crypto libraries
	"""Run Python tests against multiple installations of cryptographic libraries.
	Currently tested are:
	* OpenSSL
	* LibreSSL
	* AWS-LC

[WillChilds-Klein]

I agree that "crypto" is unfortunate shorthand. Not to get too deep in the semantic weeds, but I wonder if "cryptography" might be more appropriate than "cryptographic". The former noun-based nomenclature is more idiomatic when referring to libraries ("compression library", "serialization library", etc.) while the latter's adjective seems a bit off.

I don't have a strong preference, what do you think @AA-Turner?

by the way, thank you for the quick review :)

[picnixz]

libcrypto is the OpenSSL cryptographic library, and the other libs (BoringSSL, LibreSSL) are forks. So I'd prefer keeping crypto here or use libcrypto

[AA-Turner]

Suggested change

	"Run CPython tests with multiple crypto libraries"
	"Run CPython tests with multiple cryptographic libraries"

[AA-Turner]

I'd suggest for the initial version, keep as similar to the OpenSSL job/workflow, and then perhaps update both at once afterwards?

[WillChilds-Klein]

Fair enough. I'll remove the TODOs. Perhaps we can leave this comment unresolved as a reminder for me to clean up both (if tenable) if/after this PR has been merged.

[picnixz]

Maybe rewrite the three loops as:

for build_class, versions in [
    (BuildOpenSSL, args.openssl),
    (BuildLibreSSL, args.libressl),
    (BuildAWSLC, args.awslc),
]:
    for version in versions:
        build = build_class(version, args)
        build.install()
        builds.append(build)

[picnixz]

Can you update this check to actually check for sha2 as well? I doubt someone won't have SHA2 but has SHA3 but it will be consistent with our expectations. Also, for posterity, we don't use OpenSSL BLAKE-2 because it has limited support, so it doesn't make sense to enable it here (but we can use it in HMAC)

[picnixz]

Can you cherry-pick 8f4a0eb and make a separate PR please? TiA.