Update openssl version (Azure#2437)

* Update openssl version

Fixes GHSA-4fcv-w3qc-ppgg

* Add vcpkg.json

* Integrate vcpkg to get OpenSSL on Windows

* Use openssl in a test

It's the only way to be sure.

* Update CONTRIBUTING.md instructions

Author: heaths

.gitignore

@@ -12,6 +12,10 @@ Cargo.lock
 .assets/
 .proxy/
 tests/data/
+review/
+
+# Dependencies.
+vcpkg_installed/
 
 # Editor user customizations.
 .vscode/launch.json
@@ -27,5 +31,3 @@ tests/data/
 
 # Temporary folder to refresh SDK with TypeSpec.
 TempTypeSpecFiles/
-
-review/

CONTRIBUTING.md

@@ -55,7 +55,8 @@ Since `openssl-sys` supports [vcpkg](https://learn.microsoft.com/vcpkg/), you ca
 2. Run the bootstrap script to download a prebuilt binary:
 
    ```pwsh
-   cd vcpkg; .\bootstrap-vcpkg.bat
+   cd vcpkg
+   .\bootstrap-vcpkg.bat
    ```
 
 3. Set up environment variables:
@@ -67,10 +68,13 @@ Since `openssl-sys` supports [vcpkg](https://learn.microsoft.com/vcpkg/), you ca
 
    To persist these variables for future sessions, remember to set them in the Windows System Environment Variables panel.
 
-4. In the root of this repo, run:
+4. Change directories into the `eng/` folder in this repo and run:
 
    ```pwsh
+   cd eng
    vcpkg install
+
+   $env:OPENSSL_DIR = "$PWD\vcpkg_installed\x64-windows"
    ```
 
 ### Linting

Cargo.lock

@@ -93,7 +93,7 @@ hmac = { version = "0.12" }
 litemap = "0.7.4"
 log = "0.4"
 oauth2 = { version = "5.0.0", default-features = false }
-openssl = { version = "0.10.70" }
+openssl = { version = "0.10.72" }
 pin-project = "1.0"
 proc-macro2 = "1.0.86"
 quick-xml = { version = "0.31", features = ["serialize", "serde-types"] }

Cargo.toml

@@ -49,6 +49,8 @@ jobs:
     parameters:
       Toolchain: $(RustToolchainName)
 
+  - template: /eng/pipelines/templates/steps/vcpkg.yml
+  
   - template: /eng/common/pipelines/templates/steps/set-default-branch.yml@self
 
   - template: /eng/common/pipelines/templates/steps/save-package-properties.yml@self

eng/pipelines/templates/jobs/ci.tests.yml

@@ -66,6 +66,8 @@ jobs:
     parameters:
       Toolchain: $(RustToolchainName)
 
+  - template: /eng/pipelines/templates/steps/vcpkg.yml
+
   - ${{ parameters.PreSteps }}
 
   - template: /eng/common/TestResources/build-test-resource-config.yml

eng/pipelines/templates/jobs/live.tests.yml

@@ -0,0 +1,42 @@
+steps:
+  - pwsh: |
+      Write-Host '##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azblob,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,,read'
+      Write-Host '##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://azuresdkartifacts.blob.core.windows.net/public-vcpkg-container,,read'
+    displayName: Set vcpkg variables
+
+  - script: vcpkg --version
+    condition: >-
+      and(
+      succeeded(),
+      eq(variables['Agent.OS'], 'Windows_NT')
+      )
+    displayName: vcpkg --version
+
+  - ${{if and(eq(variables['System.TeamProject'], 'internal'), ne(variables['Build.Reason'], 'PullRequest')) }}:
+    - task: AzurePowerShell@5
+      displayName: Set vcpkg write-mode cache
+      inputs:
+        ScriptType: FilePath
+        ScriptPath: eng/scripts/Set-VcpkgWriteModeCache.ps1
+        azureSubscription: Azure SDK Artifacts
+        azurePowerShellVersion: LatestVersion
+        pwsh: true
+      # This step is idempotent and can be run multiple times in cases of
+      # failure and partial execution.
+      retryCountOnTaskFailure: 3
+
+  - pwsh: |
+      vcpkg install
+      Write-Host "##vso[task.setvariable variable=VCPKG_ROOT;]${env:VCPKG_INSTALLATION_ROOT}"
+      Write-Host "##vso[task.setvariable variable=VCPKG_INSTALLED_ROOT;]$PWD\vcpkg_installed"
+      Write-Host "##vso[task.setvariable variable=OPENSSL_DIR;]$PWD\vcpkg_installed\x64-windows"
+    condition: >-
+      and(
+      succeeded(),
+      eq(variables['Agent.OS'], 'Windows_NT')
+      )
+    displayName: vcpkg install
+    workingDirectory: eng/
+    env:
+      VCPKG_BINARY_SOURCES: $(VCPKG_BINARY_SOURCES_SECRET)
+      X_VCPKG_ASSET_SOURCES: $(X_VCPKG_ASSET_SOURCES_SECRET)

eng/pipelines/templates/steps/vcpkg.yml

@@ -0,0 +1,46 @@
+#!/bin/env pwsh
+param(
+  [string] $StorageAccountName = 'azuresdkartifacts',
+  [string] $StorageContainerName = 'public-vcpkg-container'
+)
+
+. "$PSScriptRoot/../common/scripts/Helpers/PSModule-Helpers.ps1"
+
+Write-Host "`$env:PSModulePath = $($env:PSModulePath)"
+
+# Work around double backslash
+if ($IsWindows) {
+  $hostedAgentModulePath = $env:SystemDrive + "\\Modules"
+  $moduleSeperator = ";"
+}
+else {
+  $hostedAgentModulePath = "/usr/share"
+  $moduleSeperator = ":"
+}
+$modulePaths = $env:PSModulePath -split $moduleSeperator
+$modulePaths = $modulePaths.Where({ !$_.StartsWith($hostedAgentModulePath) })
+$AzModuleCachePath = (Get-ChildItem "$hostedAgentModulePath/az_*" -Attributes Directory) -join $moduleSeperator
+if ($AzModuleCachePath -and $env.PSModulePath -notcontains $AzModuleCachePath) {
+  $modulePaths += $AzModuleCachePath
+}
+
+$env:PSModulePath = $modulePaths -join $moduleSeperator
+
+Install-ModuleIfNotInstalled "Az.Storage" "4.3.0" | Import-Module
+
+$ctx = New-AzStorageContext `
+  -StorageAccountName $StorageAccountName `
+  -UseConnectedAccount
+
+$vcpkgBinarySourceSas = New-AzStorageContainerSASToken `
+  -Name $StorageContainerName `
+  -Permission "rwcl" `
+  -Context $ctx `
+  -ExpiryTime (Get-Date).AddHours(1)
+
+Write-Host "Ensure redaction of SAS tokens in logs"
+Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SAS_TOKEN;issecret=true;]$vcpkgBinarySourceSas"
+
+Write-Host "Setting vcpkg binary cache to read and write"
+Write-Host "##vso[task.setvariable variable=VCPKG_BINARY_SOURCES_SECRET;issecret=true;]clear;x-azblob,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"
+Write-Host "##vso[task.setvariable variable=X_VCPKG_ASSET_SOURCES_SECRET;issecret=true;]clear;x-azurl,https://$StorageAccountName.blob.core.windows.net/$StorageContainerName,$vcpkgBinarySourceSas,readwrite"

eng/scripts/Set-VcpkgWriteModeCache.ps1

@@ -0,0 +1,6 @@
+{
+  "name": "azure-sdk-for-rust",
+  "dependencies": [
+    "openssl"
+  ]
+}

eng/vcpkg.json

@@ -29,6 +29,7 @@ azure_core_test = { workspace = true, features = [
 azure_identity.workspace = true
 azure_security_keyvault_keys = { path = "../azure_security_keyvault_keys" }
 azure_security_keyvault_test = { path = "../azure_security_keyvault_test" }
+openssl.workspace = true
 rand.workspace = true
 tokio.workspace = true