From d1d9d5bd25d3cde39c657aeb805056d49e8be28b Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 22 May 2024 23:07:42 +0000
Subject: [PATCH 01/15] ci(nix): Setup a head build for the cross_compatibility
 integ test

---
 nix/install_s2n_head.sh | 42 +++++++++++++++++++++++++++++++++++++++++
 nix/shell.sh            | 11 ++++-------
 2 files changed, 46 insertions(+), 7 deletions(-)
 create mode 100755 nix/install_s2n_head.sh

diff --git a/nix/install_s2n_head.sh b/nix/install_s2n_head.sh
new file mode 100755
index 00000000000..cb77bc55d4c
--- /dev/null
+++ b/nix/install_s2n_head.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License").
+# You may not use this file except in compliance with the License.
+# A copy of the License is located at
+#
+#  http://aws.amazon.com/apache2.0
+#
+# or in the "license" file accompanying this file. This file is distributed
+# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+# express or implied. See the License for the specific language governing
+# permissions and limitations under the License.
+
+set -eu
+
+usage() {
+    echo "install_s2n_head.sh build_dir"
+    exit 1
+}
+
+if [ "$#" -ne "1" ]; then
+    usage
+fi
+
+BUILD_DIR=$1
+cd "$SRC_ROOT"
+
+if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
+    if [[ ! -d "s2n_head" ]]; then
+        # Clone the most recent s2n commit
+        git clone --depth=1 https://github.com/aws/s2n-tls s2n_head
+    fi
+    cmake ./s2n_head -B$BUILD_DIR -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
+    cmake --build $BUILD_DIR -- -j $(nproc)
+
+    # Copy new executables to bin directory
+    cp -f "$BUILD_DIR"/bin/s2nc "$SRC_ROOT"/build/bin/s2nc_head
+    cp -f "$BUILD_DIR"/bin/s2nd "$SRC_ROOT"/build/bin/s2nd_head
+fi
+
+exit 0
diff --git a/nix/shell.sh b/nix/shell.sh
index bed64de1d4c..e4c549c038c 100644
--- a/nix/shell.sh
+++ b/nix/shell.sh
@@ -47,6 +47,8 @@ function build {
     banner "Running Build"
     javac tests/integrationv2/bin/SSLSocketClient.java
     cmake --build ./build -j $(nproc)
+    #Build s2n from HEAD
+    $SRC_ROOT/nix/install_s2n_head.sh $(mktemp -d)
 }
 
 function unit {
@@ -60,21 +62,16 @@ function unit {
 function integ {
     if [ "$1" == "help" ]; then
         echo "The following tests are not supported:"
-        echo " - cross_compatibility"
-        echo "    This test depends on s2nc_head and s2nd_head. To run"
-        echo "    the test build s2n-tls from the main branch on github."
-        echo "    Change the names of s2n[cd] to s2n[cd]_head and add those"
-        echo "    binaries to \$PATH."
         echo "- renegotiate_apache"
         echo "   This test requires apache to be running. See codebuild/bin/s2n_apache.sh"
         echo "    for more info."
         return
     fi
     if [[ -z "$1" ]]; then
-        banner "Running all integ tests except cross_compatibility, renegotiate_apache."
+        banner "Running all integ tests except renegotiate_apache."
         (cd $SRC_ROOT/build; ctest -L integrationv2 -E "(integrationv2_cross_compatibility|integrationv2_renegotiate_apache)" --verbose)
     else
-        banner "Warning: cross_compatibility & renegotiate_apache are not supported in nix for various reasons integ help for more info."
+        banner "Warning: renegotiate_apache is not supported in nix for various reasons integ help for more info."
         for test in $@; do
             ctest --test-dir ./build -L integrationv2 --no-tests=error --output-on-failure -R "$test" --verbose
             if [ "$?" -ne 0 ]; then

From c636d13fae4d57455ed6537c1ef74371b44aa420 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 29 May 2024 18:48:15 +0000
Subject: [PATCH 02/15] tshoot git clone failures

---
 nix/install_s2n_head.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nix/install_s2n_head.sh b/nix/install_s2n_head.sh
index cb77bc55d4c..722c5044904 100755
--- a/nix/install_s2n_head.sh
+++ b/nix/install_s2n_head.sh
@@ -12,7 +12,7 @@
 # express or implied. See the License for the specific language governing
 # permissions and limitations under the License.
 
-set -eu
+set -eux
 
 usage() {
     echo "install_s2n_head.sh build_dir"
@@ -29,7 +29,7 @@ cd "$SRC_ROOT"
 if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then
         # Clone the most recent s2n commit
-        git clone --depth=1 https://github.com/aws/s2n-tls s2n_head
+        git clone -v --depth=1 https://github.com/aws/s2n-tls s2n_head
     fi
     cmake ./s2n_head -B$BUILD_DIR -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
     cmake --build $BUILD_DIR -- -j $(nproc)

From 46baf0068a49aef7faf7540a6a79c25b9bf6fcf4 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 29 May 2024 20:46:24 +0000
Subject: [PATCH 03/15] Don't go back to GitHub to clone.

---
 nix/install_s2n_head.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/install_s2n_head.sh b/nix/install_s2n_head.sh
index 722c5044904..8d4ec725132 100755
--- a/nix/install_s2n_head.sh
+++ b/nix/install_s2n_head.sh
@@ -29,7 +29,7 @@ cd "$SRC_ROOT"
 if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then
         # Clone the most recent s2n commit
-        git clone -v --depth=1 https://github.com/aws/s2n-tls s2n_head
+        git clone --branch main --single-branch . s2n_head
     fi
     cmake ./s2n_head -B$BUILD_DIR -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
     cmake --build $BUILD_DIR -- -j $(nproc)

From d899f1eddf9f60e72fdd401e04c98dd613d04403 Mon Sep 17 00:00:00 2001
From: Doug Chapman <54039637+dougch@users.noreply.github.com>
Date: Thu, 30 May 2024 11:47:26 -0700
Subject: [PATCH 04/15] Remove verbose output

---
 nix/install_s2n_head.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/install_s2n_head.sh b/nix/install_s2n_head.sh
index 8d4ec725132..863ae8d7ac0 100755
--- a/nix/install_s2n_head.sh
+++ b/nix/install_s2n_head.sh
@@ -12,7 +12,7 @@
 # express or implied. See the License for the specific language governing
 # permissions and limitations under the License.
 
-set -eux
+set -eu
 
 usage() {
     echo "install_s2n_head.sh build_dir"

From 516775a35d73eba2f7941ebd81843bc059b7a80c Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Fri, 31 May 2024 18:41:51 +0000
Subject: [PATCH 05/15] PR feedback

---
 codebuild/bin/install_s2n_head.sh | 45 +++++++++++++++++++------------
 nix/shell.sh                      |  2 +-
 2 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index ebad50d12b2..95310c5a1d1 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 #
 # Licensed under the Apache License, Version 2.0 (the "License").
@@ -12,31 +12,42 @@
 # express or implied. See the License for the specific language governing
 # permissions and limitations under the License.
 
-set -ex
-pushd "$(pwd)"
+set -eu
 
 usage() {
     echo "install_s2n_head.sh build_dir"
     exit 1
 }
 
+BUILD_DIR=$1
+SRC_ROOT=${SRC_ROOT:-$(pwd)}
+
 if [ "$#" -ne "1" ]; then
     usage
 fi
 
-BUILD_DIR=$1
-source codebuild/bin/jobs.sh
-cd "$BUILD_DIR"
-
-# Clone the most recent s2n commit
-git clone --depth=1 https://github.com/aws/s2n-tls s2n_head
-cmake ./s2n_head -Bbuild -DCMAKE_PREFIX_PATH="$LIBCRYPTO_ROOT" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
-cmake --build ./build -- -j $JOBS
-
-# Copy new executables to bin directory
-cp -f "$BUILD_DIR"/build/bin/s2nc "$BASE_S2N_DIR"/bin/s2nc_head
-cp -f "$BUILD_DIR"/build/bin/s2nd "$BASE_S2N_DIR"/bin/s2nd_head
+if [[ "$(git rev-parse --show-toplevel)" != "$SRC_ROOT" ]]; then
+    echo "Run $0 from the root of the s2n-tls repo"
+    exit 1
+fi
 
-popd
+if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
+    if [[ ! -d "s2n_head" ]]; then
+        # Clone the most recent s2n commit
+        git clone --branch main --single-branch . s2n_head
+    fi
+    if [[ "$IN_NIX_SHELL" ]]; then
+        cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
+    else
+        cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_PREFIX_PATH="$LIBCRYPTO_ROOT" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
+    fi
+    cmake --build "$BUILD_DIR" -- -j "$(nproc)"
+
+    # Copy new executables to bin directory
+    cp -f "$BUILD_DIR"/bin/s2nc "$SRC_ROOT"/build/bin/s2nc_head
+    cp -f "$BUILD_DIR"/bin/s2nd "$SRC_ROOT"/build/bin/s2nd_head
+else
+    echo "s2nc_head already exists; not rebuilding s2n_head"
+fi
 
-exit 0
+exit 0
\ No newline at end of file
diff --git a/nix/shell.sh b/nix/shell.sh
index e4c549c038c..80591480e32 100644
--- a/nix/shell.sh
+++ b/nix/shell.sh
@@ -48,7 +48,7 @@ function build {
     javac tests/integrationv2/bin/SSLSocketClient.java
     cmake --build ./build -j $(nproc)
     #Build s2n from HEAD
-    $SRC_ROOT/nix/install_s2n_head.sh $(mktemp -d)
+    $SRC_ROOT/codebuild/bin/install_s2n_head.sh $(mktemp -d)
 }
 
 function unit {

From 39ffe76c1e53214801a73e66636baa44e11fd86c Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Mon, 3 Jun 2024 21:02:45 +0000
Subject: [PATCH 06/15] Drop the git repo check

---
 codebuild/bin/install_s2n_head.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index 95310c5a1d1..a767d6d2ce3 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -12,7 +12,7 @@
 # express or implied. See the License for the specific language governing
 # permissions and limitations under the License.
 
-set -eu
+set -e
 
 usage() {
     echo "install_s2n_head.sh build_dir"
@@ -26,10 +26,6 @@ if [ "$#" -ne "1" ]; then
     usage
 fi
 
-if [[ "$(git rev-parse --show-toplevel)" != "$SRC_ROOT" ]]; then
-    echo "Run $0 from the root of the s2n-tls repo"
-    exit 1
-fi
 
 if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then
@@ -50,4 +46,4 @@ else
     echo "s2nc_head already exists; not rebuilding s2n_head"
 fi
 
-exit 0
\ No newline at end of file
+exit 0

From c32f68a1009cbc43014d4b397a01bbc5abb520aa Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Fri, 7 Jun 2024 22:17:46 +0000
Subject: [PATCH 07/15] =?UTF-8?q?Run=20order=20differs=20between=20nix=20a?=
 =?UTF-8?q?nd=20regular=F0=9F=A4=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 codebuild/bin/install_s2n_head.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index a767d6d2ce3..63d49768131 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -26,6 +26,9 @@ if [ "$#" -ne "1" ]; then
     usage
 fi
 
+# In the case where this script runs before the regular build,
+# we need a place to land the alternative test binary.
+mkdir -p "$SRC_ROOT/build/bin"
 
 if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then

From 3c0ae3d39f3d60e8cbe08e49a8e5bf9a03eea98e Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Fri, 7 Jun 2024 22:57:22 +0000
Subject: [PATCH 08/15] print the state of s2ncd

---
 codebuild/bin/install_s2n_head.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index 63d49768131..383b7df6a21 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -49,4 +49,6 @@ else
     echo "s2nc_head already exists; not rebuilding s2n_head"
 fi
 
+echo "\nChecking build for s2nc/d...\n$(ls -al $SRC_ROOT/build/bin/s2n[cd]*)" 
+
 exit 0

From bb3f7220c58e4a203f635a44c40fa391cb6efd40 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Sat, 8 Jun 2024 00:14:14 +0000
Subject: [PATCH 09/15] handle make dir layout

---
 codebuild/bin/install_s2n_head.sh | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index 383b7df6a21..59ddef37162 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -26,11 +26,16 @@ if [ "$#" -ne "1" ]; then
     usage
 fi
 
-# In the case where this script runs before the regular build,
-# we need a place to land the alternative test binary.
-mkdir -p "$SRC_ROOT/build/bin"
+# CMake(nix) and Make are using different directory structures.
+if [[ "$IN_NIX_SHELL" ]]; then
+    export DEST_DIR="$SRC_ROOT"/build/bin
+    # Safety measure
+    mkdir -p "$DEST_DIR"
+else
+    export DEST_DIR="$SRC_ROOT"/bin
+fi
 
-if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
+if [[ ! -x "$DEST_DIR/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then
         # Clone the most recent s2n commit
         git clone --branch main --single-branch . s2n_head
@@ -41,14 +46,13 @@ if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
         cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_PREFIX_PATH="$LIBCRYPTO_ROOT" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
     fi
     cmake --build "$BUILD_DIR" -- -j "$(nproc)"
-
-    # Copy new executables to bin directory
-    cp -f "$BUILD_DIR"/bin/s2nc "$SRC_ROOT"/build/bin/s2nc_head
-    cp -f "$BUILD_DIR"/bin/s2nd "$SRC_ROOT"/build/bin/s2nd_head
+    # Copy head executables for make build
+    cp -f "$BUILD_DIR"/bin/s2nc "$DEST_DIR"/s2nc_head
+    cp -f "$BUILD_DIR"/bin/s2nd "$DEST_DIR"/s2nd_head
 else
     echo "s2nc_head already exists; not rebuilding s2n_head"
 fi
 
-echo "\nChecking build for s2nc/d...\n$(ls -al $SRC_ROOT/build/bin/s2n[cd]*)" 
+echo "\nChecking build for s2nc/d...\n$(ls -al $DEST_DIR/s2n[cd]*)" 
 
 exit 0

From 887c0a4d39ebab8b322d5784b612a340e613f5c3 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Mon, 10 Jun 2024 16:11:22 +0000
Subject: [PATCH 10/15] remove duplicate install script.

---
 nix/install_s2n_head.sh | 42 -----------------------------------------
 1 file changed, 42 deletions(-)
 delete mode 100755 nix/install_s2n_head.sh

diff --git a/nix/install_s2n_head.sh b/nix/install_s2n_head.sh
deleted file mode 100755
index 863ae8d7ac0..00000000000
--- a/nix/install_s2n_head.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License").
-# You may not use this file except in compliance with the License.
-# A copy of the License is located at
-#
-#  http://aws.amazon.com/apache2.0
-#
-# or in the "license" file accompanying this file. This file is distributed
-# on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
-# express or implied. See the License for the specific language governing
-# permissions and limitations under the License.
-
-set -eu
-
-usage() {
-    echo "install_s2n_head.sh build_dir"
-    exit 1
-}
-
-if [ "$#" -ne "1" ]; then
-    usage
-fi
-
-BUILD_DIR=$1
-cd "$SRC_ROOT"
-
-if [[ ! -x "$SRC_ROOT/build/bin/s2nc_head" ]]; then
-    if [[ ! -d "s2n_head" ]]; then
-        # Clone the most recent s2n commit
-        git clone --branch main --single-branch . s2n_head
-    fi
-    cmake ./s2n_head -B$BUILD_DIR -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
-    cmake --build $BUILD_DIR -- -j $(nproc)
-
-    # Copy new executables to bin directory
-    cp -f "$BUILD_DIR"/bin/s2nc "$SRC_ROOT"/build/bin/s2nc_head
-    cp -f "$BUILD_DIR"/bin/s2nd "$SRC_ROOT"/build/bin/s2nd_head
-fi
-
-exit 0

From 2a26204d4b315c3b7c63f566633dfca8e3b10f29 Mon Sep 17 00:00:00 2001
From: Doug Chapman <54039637+dougch@users.noreply.github.com>
Date: Tue, 11 Jun 2024 14:49:55 -0700
Subject: [PATCH 11/15] Update nix/shell.sh

Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com>
---
 nix/shell.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/shell.sh b/nix/shell.sh
index 80591480e32..58c19936d64 100644
--- a/nix/shell.sh
+++ b/nix/shell.sh
@@ -47,7 +47,7 @@ function build {
     banner "Running Build"
     javac tests/integrationv2/bin/SSLSocketClient.java
     cmake --build ./build -j $(nproc)
-    #Build s2n from HEAD
+    # Build s2n from HEAD
     $SRC_ROOT/codebuild/bin/install_s2n_head.sh $(mktemp -d)
 }
 

From d5dc51815cc9869df4a461db94e538f56050482a Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 12 Jun 2024 00:16:53 +0000
Subject: [PATCH 12/15] PR feedback

---
 codebuild/bin/install_s2n_head.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index 59ddef37162..71c9992bfdd 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -39,6 +39,11 @@ if [[ ! -x "$DEST_DIR/s2nc_head" ]]; then
     if [[ ! -d "s2n_head" ]]; then
         # Clone the most recent s2n commit
         git clone --branch main --single-branch . s2n_head
+    else
+        cd s2n_head
+        echo "Checking the age of s2n_head..."
+        test $(date -d '-3 days' +%s) -lt $(git log -1 --format="%at") || echo "s2n_head is too old, refusing to use it";exit 1
+        cd ..
     fi
     if [[ "$IN_NIX_SHELL" ]]; then
         cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
@@ -53,6 +58,4 @@ else
     echo "s2nc_head already exists; not rebuilding s2n_head"
 fi
 
-echo "\nChecking build for s2nc/d...\n$(ls -al $DEST_DIR/s2n[cd]*)" 
-
 exit 0

From 57076397243d96635b303c2927b0d66632a787f8 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 19 Jun 2024 21:53:02 +0000
Subject: [PATCH 13/15] more PR feedback

---
 codebuild/bin/install_s2n_head.sh | 33 +++++++++++++++----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index 71c9992bfdd..e350e3fbc7c 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -29,33 +29,32 @@ fi
 # CMake(nix) and Make are using different directory structures.
 if [[ "$IN_NIX_SHELL" ]]; then
     export DEST_DIR="$SRC_ROOT"/build/bin
+    export EXTRA_BUILD_FLAGS=""
     # Safety measure
     mkdir -p "$DEST_DIR"
 else
     export DEST_DIR="$SRC_ROOT"/bin
+    export EXTRA_BUILD_FLAGS="-DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT"
 fi
 
-if [[ ! -x "$DEST_DIR/s2nc_head" ]]; then
-    if [[ ! -d "s2n_head" ]]; then
-        # Clone the most recent s2n commit
-        git clone --branch main --single-branch . s2n_head
-    else
-        cd s2n_head
-        echo "Checking the age of s2n_head..."
-        test $(date -d '-3 days' +%s) -lt $(git log -1 --format="%at") || echo "s2n_head is too old, refusing to use it";exit 1
-        cd ..
-    fi
-    if [[ "$IN_NIX_SHELL" ]]; then
-        cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
-    else
-        cmake ./s2n_head -B"$BUILD_DIR" -DCMAKE_PREFIX_PATH="$LIBCRYPTO_ROOT" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
+# Cleanup any stale s2n_head clones.
+if [[ -d "$DEST_DIR/s2nc_head" ]]; then
+    now=$(date +%s)
+    last_modified=$(stat -c %Y s2n_head)
+    days_old=$(( (now - last_modified) / 86400))
+    if ((days_old > 1 )); then
+        rm -rf s2n_head
     fi
+fi
+
+if [[ -d "$DEST_DIR/s2n_head" ]]; then
+    echo "s2n_head already exists and is $days_old days old."
+else
+    git clone --branch main --single-branch . s2n_head
+    cmake ./s2n_head -B"$BUILD_DIR" $EXTRA_BUILD_FLAGS -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
     cmake --build "$BUILD_DIR" -- -j "$(nproc)"
-    # Copy head executables for make build
     cp -f "$BUILD_DIR"/bin/s2nc "$DEST_DIR"/s2nc_head
     cp -f "$BUILD_DIR"/bin/s2nd "$DEST_DIR"/s2nd_head
-else
-    echo "s2nc_head already exists; not rebuilding s2n_head"
 fi
 
 exit 0

From bb862db2ed647d3659e7da3f333cd3585fca9025 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Tue, 25 Jun 2024 20:15:05 +0000
Subject: [PATCH 14/15] cleanup the logic

---
 codebuild/bin/install_s2n_head.sh | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/codebuild/bin/install_s2n_head.sh b/codebuild/bin/install_s2n_head.sh
index e350e3fbc7c..3fbb3f609be 100755
--- a/codebuild/bin/install_s2n_head.sh
+++ b/codebuild/bin/install_s2n_head.sh
@@ -12,7 +12,7 @@
 # express or implied. See the License for the specific language governing
 # permissions and limitations under the License.
 
-set -e
+set -eu
 
 usage() {
     echo "install_s2n_head.sh build_dir"
@@ -26,35 +26,39 @@ if [ "$#" -ne "1" ]; then
     usage
 fi
 
+clone(){
+    git clone --branch main --single-branch . "$SRC_ROOT"/s2n_head
+}
+
 # CMake(nix) and Make are using different directory structures.
+set +u
 if [[ "$IN_NIX_SHELL" ]]; then
     export DEST_DIR="$SRC_ROOT"/build/bin
     export EXTRA_BUILD_FLAGS=""
-    # Safety measure
-    mkdir -p "$DEST_DIR"
 else
     export DEST_DIR="$SRC_ROOT"/bin
     export EXTRA_BUILD_FLAGS="-DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT"
 fi
+set -u
 
 # Cleanup any stale s2n_head clones.
-if [[ -d "$DEST_DIR/s2nc_head" ]]; then
+if [[ -d "$SRC_ROOT/s2n_head" ]]; then
     now=$(date +%s)
     last_modified=$(stat -c %Y s2n_head)
     days_old=$(( (now - last_modified) / 86400))
     if ((days_old > 1 )); then
+        echo "s2n_head is $days_old days old, removing and cloning again."
         rm -rf s2n_head
+        clone
+    else
+        echo "s2n_head already exists and is $days_old days old."
     fi
-fi
-
-if [[ -d "$DEST_DIR/s2n_head" ]]; then
-    echo "s2n_head already exists and is $days_old days old."
 else
-    git clone --branch main --single-branch . s2n_head
-    cmake ./s2n_head -B"$BUILD_DIR" $EXTRA_BUILD_FLAGS -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
-    cmake --build "$BUILD_DIR" -- -j "$(nproc)"
-    cp -f "$BUILD_DIR"/bin/s2nc "$DEST_DIR"/s2nc_head
-    cp -f "$BUILD_DIR"/bin/s2nd "$DEST_DIR"/s2nd_head
+    clone
 fi
+cmake "$SRC_ROOT"/s2n_head -B"$BUILD_DIR" "$EXTRA_BUILD_FLAGS" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DBUILD_SHARED_LIBS=on -DBUILD_TESTING=on
+cmake --build "$BUILD_DIR" -- -j "$(nproc)"
+cp -f "$BUILD_DIR"/bin/s2nc "$DEST_DIR"/s2nc_head
+cp -f "$BUILD_DIR"/bin/s2nd "$DEST_DIR"/s2nd_head
 
 exit 0

From dc8228f7733a3d9f07c5922104c7fdd7a4a409f0 Mon Sep 17 00:00:00 2001
From: Doug Chapman <dougch@amazon.com>
Date: Wed, 24 Jul 2024 21:48:45 +0000
Subject: [PATCH 15/15] Disable head builds for kTLS

---
 nix/shell.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/nix/shell.sh b/nix/shell.sh
index 58c19936d64..75072d244cd 100644
--- a/nix/shell.sh
+++ b/nix/shell.sh
@@ -28,7 +28,7 @@ libcrypto_alias libressl "${LIBRESSL_INSTALL_DIR}/bin/openssl"
 
 function clean {
     banner "Cleanup ./build"
-    rm -rf ./build
+    rm -rf ./build ./s2n_head
 }
 
 function configure {
@@ -48,7 +48,9 @@ function build {
     javac tests/integrationv2/bin/SSLSocketClient.java
     cmake --build ./build -j $(nproc)
     # Build s2n from HEAD
-    $SRC_ROOT/codebuild/bin/install_s2n_head.sh $(mktemp -d)
+    if [[ -z "${S2N_KTLS_TESTING_EXPECTED}" ]]; then
+        $SRC_ROOT/codebuild/bin/install_s2n_head.sh $(mktemp -d)
+    fi
 }
 
 function unit {