auto-merge envoyproxy/envoy[release/v1.32] into envoyproxy/envoy-openssl[release/v1.32]

* upstream/release/v1.32:
  docker/release: Bump Ubuntu -> 01a3ee0 (#40026)
  ci/cache: Shift cache create action to do_ci.sh (#39845)
  Commit Message: Add support for building envoy against newer releases of BoringCrypto FIPS via override_repository
  coverage: Disable large tests
  Don't build WASM for fuzz-coverage tests (#39296)
  ci/coverage: Fix path
  repo: Dev v1.32.7

Signed-off-by: tedjpoole <[email protected]>

Author: tedjpoole

.bazelrc

@@ -247,6 +247,11 @@ build:test-coverage --test_tag_filters=-nocoverage,-fuzz_target
 build:fuzz-coverage --config=plain-fuzzer
 build:fuzz-coverage --run_under=@envoy//bazel/coverage:fuzz_coverage_wrapper.sh
 build:fuzz-coverage --test_tag_filters=-nocoverage
+build:fuzz-coverage --define=dynamic_link_tests=true
+# Existing fuzz tests don't need a full WASM runtime and in generally we don't really want to
+# fuzz dependencies anyways. On the other hand, disabling WASM reduces the build time and
+# resources required to build and run the tests.
+build:fuzz-coverage --define=wasm=disabled
 
 build:cache-local --remote_cache=grpc://localhost:9092
 

VERSION.txt

@@ -1 +1 @@
-1.32.6
+1.32.7-dev

changelogs/1.32.6.yaml

@@ -0,0 +1,8 @@
+date: May 7, 2025
+
+bug_fixes:
+- area: url_template
+  change: |
+    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
+    This behavioral change can be temporarily reverted by setting runtime guard
+    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.

changelogs/current.yaml

@@ -1,8 +1,17 @@
-date: May 7, 2025
+date: Pending
+
+behavior_changes:
+# *Changes that are expected to cause an incompatibility if applicable; deployment changes are likely required*
+
+minor_behavior_changes:
+# *Changes that may cause incompatibilities for some users, but should not for most*
 
 bug_fixes:
-- area: url_template
-  change: |
-    Included the asterisk ``*`` in the match pattern when using the * or ** operators in the URL template.
-    This behavioral change can be temporarily reverted by setting runtime guard
-    ``envoy.reloadable_features.uri_template_match_on_asterisk`` to ``false``.
+# *Changes expected to improve the state of the world and are unlikely to have negative effects*
+
+removed_config_or_runtime:
+# *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
+
+new_features:
+
+deprecated:

ci/Dockerfile-envoy

@@ -1,6 +1,6 @@
 ARG BUILD_OS=ubuntu
 ARG BUILD_TAG=22.04
-ARG BUILD_SHA=67cadaff1dca187079fce41360d5a7eb6f7dcd3745e53c79ad5efd8563118240
+ARG BUILD_SHA=01a3ee0b5e413cefaaffc6abe68c9c37879ae3cced56a8e088b1649e5b269eee
 ARG ENVOY_VRP_BASE_IMAGE=envoy-base
 
 

ci/do_ci.sh

@@ -379,6 +379,27 @@ case $CI_TARGET in
         # fi
         ;;
 
+    cache-create)
+        if [[ -z "${ENVOY_CACHE_TARGETS}" ]]; then
+            echo "ENVOY_CACHE_TARGETS not set" >&2
+            exit 1
+        fi
+        if [[ -z "${ENVOY_CACHE_ROOT}" ]]; then
+            echo "ENVOY_CACHE_ROOT not set" >&2
+            exit 1
+        fi
+        BAZEL_BUILD_OPTIONS=()
+        setup_clang_toolchain
+        echo "Fetching cache: ${ENVOY_CACHE_TARGETS}"
+        bazel --output_user_root="${ENVOY_CACHE_ROOT}" \
+              --output_base="${ENVOY_CACHE_ROOT}/base" \
+              aquery "deps(${ENVOY_CACHE_TARGETS})" \
+              --repository_cache="${ENVOY_REPOSITORY_CACHE}" \
+              "${BAZEL_BUILD_OPTIONS[@]}" \
+              "${BAZEL_BUILD_EXTRA_OPTIONS[@]}" \
+              > /dev/null
+        ;;
+
     format-api|check_and_fix_proto_format)
         setup_clang_toolchain
         echo "Check and fix proto format ..."

source/common/tls/context_impl.cc

@@ -571,10 +571,6 @@ void ContextImpl::logHandshake(SSL* ssl) const {
     stats_.no_certificate_.inc();
   }
 
-#if defined(BORINGSSL_FIPS) && BORINGSSL_API_VERSION >= 18
-#error "Delete preprocessor check below; no longer needed"
-#endif
-
 #if BORINGSSL_API_VERSION >= 18
   // Increment the `was_key_usage_invalid_` stats to indicate the given cert would have triggered an
   // error but is allowed because the enforcement that rsa key usage and tls usage need to be

test/config_test/BUILD

@@ -41,6 +41,7 @@ envoy_cc_test(
         "GODEBUG": "cgocheck=0",
     },
     rbe_pool = "6gig",
+    tags = ["nocoverage"],
     deps = [
         ":example_configs_test_lib",
     ],

test/exe/BUILD

@@ -125,6 +125,8 @@ envoy_cc_test(
     size = "large",
     srcs = ["extra_extensions_test.cc"],
     rbe_pool = "6gig",
+    # output is too large for workers
+    tags = ["nocoverage"],
     deps = [
         "//test/test_common:environment_lib",
     ] + select({
@@ -154,6 +156,7 @@ envoy_cc_test(
         "//source/extensions:extensions_metadata.yaml",
     ],
     rbe_pool = "6gig",
+    tags = ["nocoverage"],
     deps = [
         "//test/test_common:environment_lib",
     ] + select({

test/integration/BUILD

@@ -419,7 +419,10 @@ envoy_sh_test(
         "//test/config/integration:server_config_files",
     ],
     rbe_pool = "6gig",
-    tags = ["skip_on_windows"],
+    tags = [
+        "nocoverage",
+        "skip_on_windows",
+    ],
 )
 
 envoy_cc_test(