Commit 0e1a99a
tools: add an OpenSSL FIPS build to test-shared.yml
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64960
Fixes: #48379
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>1 parent 8c4531b commit 0e1a99a
3 files changed
Lines changed: 61 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -77,6 +77,8 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E " | |||
| 77 | 77 | inherit (pkgs) | |
| 78 | 78 | \(.attrs | sort | join("\n ")) | |
| 79 | 79 | ; | |
| 80 | + | ||
| 81 | + openssl_fips = import ./openssl-fips.nix { }; | ||
| 80 | 82 | }"' > "$OPENSSL_MATRIX_FILE" | |
| 81 | 83 | ||
| 82 | 84 | cat -<<EOF | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,57 @@ | |||
| 1 | + { | ||
| 2 | + openssl ? (import ./openssl-matrix.nix { }).openssl, | ||
| 3 | + }: | ||
| 4 | + | ||
| 5 | + openssl.overrideAttrs (oldAttrs: { | ||
| 6 | + pname = "openssl-fips"; | ||
| 7 | + | ||
| 8 | + doCheck = false; | ||
| 9 | + configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ | ||
| 10 | + "no-docs" | ||
| 11 | + "no-tests" | ||
| 12 | + "enable-fips" | ||
| 13 | + ]; | ||
| 14 | + outputs = [ | ||
| 15 | + "bin" | ||
| 16 | + "out" | ||
| 17 | + "dev" | ||
| 18 | + ]; | ||
| 19 | + | ||
| 20 | + # Nix strips the provider after installation, invalidating the module MAC | ||
| 21 | + # generated by OpenSSL's install_fips target. Regenerate and verify it in | ||
| 22 | + # postFixup, after stripping has finished modifying the provider. | ||
| 23 | + postFixup = (oldAttrs.postFixup or "") + '' | ||
| 24 | + opensslConfig="$out/etc/ssl/openssl.cnf" | ||
| 25 | + fipsModule="$out/lib/ossl-modules/fips${openssl.stdenv.hostPlatform.extensions.sharedLibrary}" | ||
| 26 | + fipsConfig="$out/etc/ssl/fipsmodule.cnf" | ||
| 27 | + | ||
| 28 | + substituteInPlace "$opensslConfig" \ | ||
| 29 | + --replace-fail 'openssl_conf = openssl_init' $'openssl_conf = openssl_init\nnodejs_conf = openssl_init' \ | ||
| 30 | + --replace-fail '# .include fipsmodule.cnf' ".include $fipsConfig" \ | ||
| 31 | + --replace-fail 'providers = provider_sect' $'providers = provider_sect\nalg_section = algorithm_sect' \ | ||
| 32 | + --replace-fail '# fips = fips_sect' 'fips = fips_sect' \ | ||
| 33 | + --replace-fail '# activate = 1' $'activate = 1\n\n[algorithm_sect]\ndefault_properties = fips=yes' | ||
| 34 | + | ||
| 35 | + OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \ | ||
| 36 | + -module "$fipsModule" \ | ||
| 37 | + -out "$fipsConfig" | ||
| 38 | + | ||
| 39 | + OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \ | ||
| 40 | + -config "$opensslConfig" | ||
| 41 | + ''; | ||
| 42 | + | ||
| 43 | + doInstallCheck = true; | ||
| 44 | + installCheckPhase = '' | ||
| 45 | + runHook preInstallCheck | ||
| 46 | + | ||
| 47 | + export PATH="$bin/bin:$PATH" | ||
| 48 | + | ||
| 49 | + openssl mac \ | ||
| 50 | + -digest SHA256 -macopt key:key HMAC </dev/null >/dev/null | ||
| 51 | + openssl md5 </dev/null >/dev/null 2>&1 \ | ||
| 52 | + && echo "MD5 unexpectedly available with FIPS properties enabled" >&2 \ | ||
| 53 | + && exit 1 | ||
| 54 | + | ||
| 55 | + runHook postInstallCheck | ||
| 56 | + ''; | ||
| 57 | + }) | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -16,4 +16,6 @@ | |||
| 16 | 16 | openssl_3_6 | |
| 17 | 17 | openssl_4_0 | |
| 18 | 18 | ; | |
| 19 | + | ||
| 20 | + openssl_fips = import ./openssl-fips.nix { }; | ||
| 19 | 21 | } | |
0 commit comments