From 42a8cd30e155933432969b5eba22c74523d593e1 Mon Sep 17 00:00:00 2001 From: Norm Johanson Date: Thu, 20 Aug 2026 16:14:53 -0700 Subject: [PATCH] Add PQC opt-out in Lambda bootstrap (#2539) --- LambdaRuntimeDockerfiles/build.ps1 | 2 +- .../src/Amazon.Lambda.RuntimeSupport/bootstrap.net8.sh | 7 +++++++ Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.sh | 7 +++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/LambdaRuntimeDockerfiles/build.ps1 b/LambdaRuntimeDockerfiles/build.ps1 index 5dc348339..ac59441c3 100644 --- a/LambdaRuntimeDockerfiles/build.ps1 +++ b/LambdaRuntimeDockerfiles/build.ps1 @@ -2,7 +2,7 @@ param( [ValidateSet('amd64','arm64')] [string]$Architecture = "amd64", - [ValidateSet('net6', 'net8', 'net9')] + [ValidateSet('net8', 'net9', 'net10', 'net11')] [string]$TargetFramework = "net6" ) diff --git a/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.net8.sh b/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.net8.sh index 9dc77ab3a..a722236a4 100644 --- a/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.net8.sh +++ b/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.net8.sh @@ -1,5 +1,12 @@ #!/bin/bash +# PQC TLS keyshares are enabled by default via the AL2023 base-OS crypto policy. Customers can opt +# out by setting AWS_LAMBDA_DISABLE_PQC_KEYSHARES (presence-based, including an empty value), which +# selects the shipped classical-only openssl_non_pqc.cnf and takes precedence over a customer OPENSSL_CONF. +if [ -n "${AWS_LAMBDA_DISABLE_PQC_KEYSHARES+x}" ]; then + export OPENSSL_CONF=/var/runtime/openssl_conf/openssl_non_pqc.cnf +fi + # .NET on Linux uses OpenSSL to handle certificates. The .NET runtime will load the certs by first reading # the default cert bundle file which can be overriden by the SSL_CERT_FILE env var. Then it will load the # certs in the default cert directory which can be overriden by the SSL_CERT_DIR env var. On AL2023 diff --git a/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.sh b/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.sh index 2c4a517f9..6352d95c2 100644 --- a/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.sh +++ b/Libraries/src/Amazon.Lambda.RuntimeSupport/bootstrap.sh @@ -1,5 +1,12 @@ #!/bin/bash +# PQC TLS keyshares are enabled by default via the AL2023 base-OS crypto policy. Customers can opt +# out by setting AWS_LAMBDA_DISABLE_PQC_KEYSHARES (presence-based, including an empty value), which +# selects the shipped classical-only openssl_non_pqc.cnf and takes precedence over a customer OPENSSL_CONF. +if [ -n "${AWS_LAMBDA_DISABLE_PQC_KEYSHARES+x}" ]; then + export OPENSSL_CONF=/var/runtime/openssl_conf/openssl_non_pqc.cnf +fi + # This script is used to locate 2 files in the /var/task folder, where the end-user assembly is located # The 2 files are .deps.json and .runtimeconfig.json # These files are used to add the end-user assembly into context and make the code reachable to the dotnet process