From: Theo Buehler <tb@theobuehler.org>
Subject: Re: [BUG] net/iamb: segfaults in latest 8.0 snapshot
To: ports@openbsd.org
Date: Mon, 5 Oct 2026 19:41:20 +0200

On Mon, Oct 05, 2026 at 05:52:37PM +0100, Stuart Henderson wrote:
> On 2026/10/05 18:11, Theo Buehler wrote:
> > > #0  0x00000596746d498f in aws_lc_0_45_0_curve25519_x25519base_alt ()
> > 
> > That's going to be the usual aws-lc xonly thing
> 
> indeed, that was a new dep in the last update
> 
> <sym: net/iamb>$ cvsps -s 11 -g | grep aws
> +MODCARGO_CRATES +=     aws-lc-rs       1.18.1  # ISC AND (Apache-2.0 OR ISC)
> +MODCARGO_CRATES +=     aws-lc-sys      0.45.0  # ISC AND (Apache-2.0 OR ISC) AND Apache-2.0 AND MIT AND BSD-3-Clause AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR ISC OR MIT-0)
> +SHA256 (cargo/aws-lc-rs-1.18.1.tar.gz) = soHTB1iNY03pIIdIkHMmWeLnZy9yteEOgbrcGoqDYh4=
> +SHA256 (cargo/aws-lc-sys-0.45.0.tar.gz) = m/9sO1T615ouYLgQLK9WWBlxFJfB9fCS9JUI4vXDGyc=
> +SIZE (cargo/aws-lc-rs-1.18.1.tar.gz) = 249534
> +SIZE (cargo/aws-lc-sys-0.45.0.tar.gz) = 9725710
> 
> > Index: Makefile
> > ===================================================================
> > RCS file: /cvs/ports/net/iamb/Makefile,v
> > diff -u -p -r1.10 Makefile
> > --- Makefile	26 Sep 2026 16:54:28 -0000	1.10
> > +++ Makefile	5 Oct 2026 16:11:02 -0000
> > @@ -2,11 +2,18 @@
> >  NOT_FOR_ARCHS =		sparc64
> >  BROKEN-i386 =		compile fails, possibly out of memory ("fatal runtime error: Rust cannot catch foreign exception")
> >  
> > +# aws-lc-sys has constants in .text
> > +# https://github.com/awslabs/s2n-bignum/pull/242
> > +.if ${MACHINE_ARCH} == "amd64" || ${MACHINE_ARCH} == "aarch64"
> > +USE_NOEXECONLY =	Yes
> > +.endif
> 
> I'm ok with that, but I wonder if we should automate it, or if that's
> too much magic. Bumps included for all the ports pulling in aws-lc-sys
> that don't yet set USE_NOEXECONLY.

Not against applying a big hammer until this is resolved but I'm not
sure all the things listing aws-lc in crates.inc actually use the aws-lc
backend. For example, ncspot uses native-tls iiuc and rust-openssl-tests
doesn't ship compiled code at all (it won't matter if it's tagged
USE_NOEXECONLY, but the bump could be omitted).