awslabs · DmitriyMusatkin · Oct 24, 2025 · Oct 25, 2025 · Oct 27, 2025 · Oct 28, 2025
diff --git a/crt/aws-c-cal b/crt/aws-c-cal
diff --git a/setup.py b/setup.py
@@ -315,6 +315,7 @@ def _build_dependencies_impl(self, build_dir, install_path, osx_arch=None):
         run_cmd(build_cmd)
 
     def _build_dependencies(self):
+
         build_dir = os.path.join(self.build_temp, 'deps')
         install_path = os.path.join(self.build_temp, 'deps', 'install')
 
@@ -375,6 +376,33 @@ def _build_dependencies(self):
 
         self.library_dirs.insert(0, os.path.join(install_path, lib_dir))
 
+    def build_extension(self, ext):
+
+        # Warning: very hacky. feel free to replace with something cleaner
+        # Problem: if you install python through homebrew, python config ldflags
+        # will point to homebrew lib folder.
+        # setuptools puts python ldflags before any of our lib paths, so if there is openssl or
+        # another libcrypto in homebrew libs, it will get picked up before aws-lc we are building against.
+        # And then we have fun failures due to lib mismatch.
+        # I could not find a cleaner way, so lets just hook into linker command and make sure
+        # our libs appear before other libs.
+        if sys.platform == 'darwin' and using_libcrypto() and not using_system_libs() and not using_system_libcrypto():
+
+            orig_linker_so = self.compiler.linker_so[:]
+
+            for i, item in enumerate(self.compiler.linker_so):
+                if item.startswith('-L'):
+                    self.compiler.linker_so[i:i] = [
+                        f"-L{item}" for item in self.library_dirs] + ['-Wl,-search_paths_first']
+                    break
+
+            try:
+                super().build_extension(ext)
+            finally:
+                self.compiler.linker_so = orig_linker_so
+        else:
+            super().build_extension(ext)
+
     def run(self):
         if using_system_libs():
             print("Skip building dependencies")
@@ -422,7 +450,6 @@ def awscrt_ext():
 
     elif sys.platform == 'darwin':
         extra_link_args += ['-framework', 'Security']
-
     else:  # unix
         if forcing_static_libs():
             # linker will prefer shared libraries over static if it can find both.
+28 −0		.github/workflows/ci.yml
+32 −0		.github/workflows/codecov.yml
+7 −0		builder.json
+35 −0		include/aws/cal/ecc.h
+29 −0		include/aws/cal/hash.h
+34 −0		include/aws/cal/hmac.h
+43 −0		include/aws/cal/private/der.h
+8 −2		include/aws/cal/private/ecc.h
+24 −4		source/darwin/commoncrypto_hmac.c
+0 −4		source/darwin/commoncrypto_sha1.c
+1 −4		source/darwin/commoncrypto_sha256.c
+72 −0		source/darwin/commoncrypto_sha512.c
+61 −5		source/der.c
+824 −57		source/ecc.c
+19 −0		source/hash.c
+40 −0		source/hmac.c
+12 −5		source/unix/openssl_rsa.c
+75 −57		source/unix/opensslcrypto_ecc.c
+30 −25		source/unix/opensslcrypto_hash.c
+40 −5		source/unix/opensslcrypto_hmac.c
+4 −25		source/windows/bcrypt_ecc.c
+47 −12		source/windows/bcrypt_hash.c
+65 −6		source/windows/bcrypt_hmac.c
+30 −0		tests/CMakeLists.txt
+50 −2		tests/der_test.c
+182 −11		tests/ecc_test.c
+31 −0		tests/rsa_test.c
+354 −0		tests/sha512_hmac_test.c
+300 −0		tests/sha512_test.c