Test that optimization flags are preserved

.github/docker_images/alpine-3.20/Dockerfile

@@ -1,3 +1,6 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
 FROM alpine:3.20
 
 VOLUME ["/aws_lc_rs"]

.github/docker_images/fedora-41/Dockerfile

@@ -0,0 +1,18 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+FROM fedora:41
+
+RUN dnf install -y qemu-user-static mock
+RUN useradd mockbuilder
+RUN usermod -a -G mock mockbuilder \
+    && chmod -R g+w /etc/mock
+
+COPY aws_lc_rs_build.sh /
+COPY entry.sh /
+
+ENV AWS_LC_RS_DISABLE_SLOW_TESTS=1
+ENV CFLAGS="-O2 -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3"
+
+USER root
+ENTRYPOINT ["/entry.sh"]

.github/docker_images/fedora-41/aws_lc_rs_build.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+set -ex -o pipefail
+
+SRC_DIR="${SRC_DIR:-/aws_lc_rs}"
+
+su mockbuilder -c "mock -r fedora-rawhide-s390x --install git cargo cmake perl rustfmt clang"
+su mockbuilder -c "mock -r fedora-rawhide-s390x --shell 'mkdir /builddir/aws-lc-rs/'"
+# Use globbing to avoid copying the .git directory
+su mockbuilder -c "mock -r fedora-rawhide-s390x --copyin /aws_lc_rs/* /builddir/aws-lc-rs/"
+su mockbuilder -c "mock -r fedora-rawhide-s390x --enable-network --cwd /builddir/aws-lc-rs/ --shell 'cargo test -p aws-lc-rs'"

.github/docker_images/fedora-41/build_image.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+set -ex
+
+SCRIPT_DIR=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
+
+
+# Log Docker hub limit https://docs.docker.com/docker-hub/download-rate-limit/#how-can-i-check-my-current-rate
+TOKEN=$(curl "https://auth.docker.io/token?service=registry.docker.io&scope=repository:ratelimitpreview/test:pull" | jq -r .token)
+curl --head -H "Authorization: Bearer $TOKEN" https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest
+
+EXTRA_ARGS=()
+if [[ -n "${GOPROXY:+x}" ]]; then
+    EXTRA_ARGS=("--build-arg" "GOPROXY=${GOPROXY}" "${EXTRA_ARGS[@]}")
+fi
+
+pushd "${SCRIPT_DIR}"
+docker build -t fedora-41 . --load "${EXTRA_ARGS[@]}"
+popd

.github/docker_images/fedora-41/entry.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0 OR ISC
+
+set -ex -o pipefail
+
+/aws_lc_rs_build.sh "${argv[@]}"

.github/workflows/integration.yml

@@ -209,3 +209,19 @@ jobs:
       - name: Verify msrv
         working-directory: ./aws-lc-rs
         run: cargo +1.63.0 check --features bindgen
+
+  preserve-optimizations:
+    runs-on: ubuntu-24.04-arm
+    env:
+      DOCKER_BUILDKIT: 1
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: "recursive"
+      - name: Build Docker Image
+        working-directory: .github/docker_images/fedora-41
+        run: |
+          ./build_image.sh
+      - name: Build
+        run: |
+          docker run --privileged --user root -v "${{ github.workspace }}:/aws_lc_rs"  fedora-41

.gitignore

@@ -2,6 +2,7 @@
 # will have compiled files and executables
 /target/
 
+.cargo/
 # Remove Cargo.lock from gitignore if creating an executable, leave it for libraries
 # More information here https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html
 Cargo.lock