[openssl] support fips build feature #30916

lbermes · 2023-04-17T08:29:05Z

I only implemented and tested it for windows as I have no option to do this under linux.
I'm new with changes here but I like to learn and to support this project

Changes comply with the maintainer guide
SHA512s are updated for each updated download
(no checksum changes)
The "supports" clause reflects platforms that may be fixed by this new version
(I would like to mark the feature as only available for Windows but did not found or understood the syntax how todo this)
Any fixed CI baseline entries are removed from that file.
(nothing changed)
Any patches that are no longer applied are deleted from the port's directory.
(nothing changed)
The version database is fixed by rerunning ./vcpkg x-add-version --all and committing the result.
Only one version is added to each modified port's versions file.

I only implement and tested it for windows as I have no option to do this under linux

lbermes · 2023-04-17T08:33:06Z

Added "supports" to the feature as I only tested it for windows

lbermes · 2023-04-17T08:44:54Z

@lbermes please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree

…ps-build

ports/openssl/portfile.cmake

dg0yt

This PR shouldn't be merged with a windows-only change, now that windows and !windows finally share most of the openssl setup. But I will need a few more days to look into a general solution.

ports/openssl/portfile.cmake

dg0yt · 2023-04-18T10:33:44Z

ports/openssl/vcpkg.json

@@ -20,6 +20,10 @@
    }
  ],
  "features": {
+    "fips": {
+      "description": "Enable fips",
+      "supports": "windows"


supports is to match upstream's position. We should help you to have all platforms supported.

I think this can also work under linux so removing "supports" would already fit but I had no option to test this

You can remove supports field, I have tested fips on linux and osx.

ports/openssl/portfile.cmake

Removed the not needed FEATURE FIPS Initialize INSTALL_FIPS as empty

Adela0814 · 2023-04-19T06:47:56Z

ports/openssl/vcpkg.json

@@ -20,6 +20,10 @@
    }
  ],
  "features": {
+    "fips": {
+      "description": "Enable fips",
+      "supports": "windows"


You can remove supports field, I have tested fips on linux and osx.

dg0yt

I tested the PR.
AFAIU fips support is only available with dynamic linkage. (There is no build error, but the feature will simply not be installed.) The feature should be declared with:

"supports": "!static"

As the provider conecpts needs dynamic linkage

BillyONeal · 2023-04-21T22:02:08Z

Thanks!

lbermes · 2023-04-22T05:57:48Z

Thank you for your support

lbermes · 2023-04-26T08:39:11Z

I had the time to rebuild all based on the merge and see now an issue under windows
warning: The following files are placed in C:\GitHub\vcpkg\packages\openssl_x64-windows:

C:\GitHub\vcpkg\packages\openssl_x64-windows\fipsmodule.cnf

warning: Files cannot be present in those directories.
error: Found 1 post-build check problem(s). To submit these ports to curated catalogs, please first correct the portfile: C:\GitHub\vcpkg\ports\openssl\portfile.cmake

What would be the right/best way to merge a fix.
Should I simply create a new pull request with the fix?

BillyONeal · 2023-04-26T18:43:21Z

Should I simply create a new pull request with the fix?

Yes please

dg0yt · 2023-04-26T18:48:38Z

While we are at fips: Should it become a default feature? (Is it a default feature upstream?)

BillyONeal · 2023-04-26T18:50:37Z

While we are at fips: Should it become a default feature? (Is it a default feature upstream?)

I don't think so; normally FIPS only certifies distribution in binary forms, not in source forms. Moreover, I don't know about OpenSSL specifically, but elsewhere I've seen a FIPS mode that usually implies turning things off (that have not been certified) rather than on.

guenterbe · 2023-04-28T12:52:34Z

After getting the latest updates from github and rebuilding openssl, I can't find any fips.dll on Windows or fips.so on Linux.
Isn't a "vcpkg install openssl" sufficient? Are there some undocumented (or not found by me) command line switches?

lbermes · 2023-04-28T14:05:03Z

Hi, please use the feature fips.
I added this first only for windows but the see the comment of [Adela0814]
It was requested that I remove this and so it now is a feature for all platforms.

lbermes · 2023-04-28T14:06:05Z

"vcpkg install openssl[fips]" or with the tools "vcpkg install openssl[tools,fips]"

lbermes · 2023-04-28T14:31:04Z

But I wonder how this influenced the linux build. I did not adjusted the linux port file.

guenterbe · 2023-04-28T19:52:49Z

@lbermes I have never needed the [features] in the past and was therefore not aware of them (must have missed them in the docs). Thanks very much!

* Added option to enable fips build for openssl I only implement and tested it for windows as I have no option to do this under linux * Adjusted port version * Updated to support only for Windows * Corrected Formatting * Corrected SHA for vcpkg x-add-version --all * Changes requested by review Removed the not needed FEATURE FIPS Initialize INSTALL_FIPS as empty * Corrected SHA for vcpkg x-add-version --all * Removed Windows only support * Corrected SHA for vcpkg x-add-version --all * Added "supports": "!static" As the provider conecpts needs dynamic linkage * Corrected SHA for vcpkg x-add-version --all

lbermes added 3 commits April 17, 2023 09:57

Added option to enable fips build for openssl

d02e1bc

I only implement and tested it for windows as I have no option to do this under linux

Adjusted port version

a7533a9

Updated to support only for Windows

fdb8ff7

jimwang118 assigned Adela0814 Apr 17, 2023

Adela0814 added the category:port-feature The issue is with a library, which is requesting new capabilities that didn’t exist label Apr 17, 2023

lbermes added 3 commits April 17, 2023 12:13

Merge remote-tracking branch 'upstream/master' into openssl-enable-fi…

b8093ee

…ps-build

Corrected Formatting

9eaef09

Corrected SHA for vcpkg x-add-version --all

7ee8e12

Adela0814 suggested changes Apr 18, 2023

View reviewed changes

ports/openssl/portfile.cmake Outdated Show resolved Hide resolved

ports/openssl/portfile.cmake Show resolved Hide resolved

Adela0814 added the requires:author-response label Apr 18, 2023

Adela0814 changed the title ~~Openssl optional fips build feature~~ [openssl] support fips build feature Apr 18, 2023

dg0yt reviewed Apr 18, 2023

View reviewed changes

lbermes added 2 commits April 19, 2023 08:22

Changes requested by review

0441781

Removed the not needed FEATURE FIPS Initialize INSTALL_FIPS as empty

Corrected SHA for vcpkg x-add-version --all

741e853

lbermes requested a review from Adela0814 April 19, 2023 06:24

Adela0814 suggested changes Apr 19, 2023

View reviewed changes

lbermes added 2 commits April 19, 2023 09:11

Removed Windows only support

1b911b1

Corrected SHA for vcpkg x-add-version --all

cc72e43

lbermes requested a review from Adela0814 April 19, 2023 08:28

Adela0814 previously approved these changes Apr 19, 2023

View reviewed changes

dg0yt suggested changes Apr 19, 2023

View reviewed changes

lbermes added 2 commits April 20, 2023 05:08

Added "supports": "!static"

84a3a54

As the provider conecpts needs dynamic linkage

Corrected SHA for vcpkg x-add-version --all

73ce04b

lbermes dismissed Adela0814’s stale review via 73ce04b April 20, 2023 03:09

dg0yt approved these changes Apr 20, 2023

View reviewed changes

dg0yt mentioned this pull request Apr 20, 2023

Difference in binary outputs in openssl package between Linux and Windows #29400

Closed

Adela0814 added info:reviewed Pull Request changes follow basic guidelines and removed requires:author-response labels Apr 21, 2023

BillyONeal merged commit 6ffa0fc into microsoft:master Apr 21, 2023

lbermes deleted the openssl-enable-fips-build branch April 22, 2023 05:58

daschuer mentioned this pull request Jun 1, 2023

Master merge mixxxdj/vcpkg#71

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[openssl] support fips build feature #30916

[openssl] support fips build feature #30916

lbermes commented Apr 17, 2023

lbermes commented Apr 17, 2023

lbermes commented Apr 17, 2023

dg0yt left a comment

dg0yt Apr 18, 2023

lbermes Apr 18, 2023

Adela0814 Apr 19, 2023

Adela0814 Apr 19, 2023

dg0yt left a comment

BillyONeal commented Apr 21, 2023

lbermes commented Apr 22, 2023

lbermes commented Apr 26, 2023

BillyONeal commented Apr 26, 2023

dg0yt commented Apr 26, 2023

BillyONeal commented Apr 26, 2023

guenterbe commented Apr 28, 2023

lbermes commented Apr 28, 2023

lbermes commented Apr 28, 2023

lbermes commented Apr 28, 2023

guenterbe commented Apr 28, 2023

[openssl] support fips build feature #30916

[openssl] support fips build feature #30916

Conversation

lbermes commented Apr 17, 2023

lbermes commented Apr 17, 2023

lbermes commented Apr 17, 2023

dg0yt left a comment

Choose a reason for hiding this comment

dg0yt Apr 18, 2023

Choose a reason for hiding this comment

lbermes Apr 18, 2023

Choose a reason for hiding this comment

Adela0814 Apr 19, 2023

Choose a reason for hiding this comment

Adela0814 Apr 19, 2023

Choose a reason for hiding this comment

dg0yt left a comment

Choose a reason for hiding this comment

BillyONeal commented Apr 21, 2023

lbermes commented Apr 22, 2023

lbermes commented Apr 26, 2023

BillyONeal commented Apr 26, 2023

dg0yt commented Apr 26, 2023

BillyONeal commented Apr 26, 2023

guenterbe commented Apr 28, 2023

lbermes commented Apr 28, 2023

lbermes commented Apr 28, 2023

lbermes commented Apr 28, 2023

guenterbe commented Apr 28, 2023