-
Notifications
You must be signed in to change notification settings - Fork 2.3k
Add build-tooling to run in the FIPS environment #18921
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Add build-tooling to run in the FIPS environment #18921
Conversation
|
❌ Gradle check result for f656bd4: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
f656bd4 to
20a5611
Compare
|
❌ Gradle check result for 20a5611: null Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
20a5611 to
2241009
Compare
|
❌ Gradle check result for 2241009: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
2241009 to
1829731
Compare
|
❕ Gradle check result for 1829731: UNSTABLE Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure. |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #18921 +/- ##
============================================
- Coverage 73.11% 73.06% -0.06%
- Complexity 70838 70870 +32
============================================
Files 5732 5748 +16
Lines 324191 324656 +465
Branches 46922 46972 +50
============================================
+ Hits 237017 237194 +177
- Misses 68068 68297 +229
- Partials 19106 19165 +59 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
Patch coverage is showing as 0% because the new tests are guarded with The actual patch coverage is much higher, but the gradle check of this repo does not run with FIPS enabled. |
server/src/main/java/org/opensearch/bootstrap/MultiProviderTrustStoreHandler.java
Outdated
Show resolved
Hide resolved
server/src/main/java/org/opensearch/bootstrap/MultiProviderTrustStoreHandler.java
Outdated
Show resolved
Hide resolved
|
❌ Gradle check result for 974cec3: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
server/src/main/java/org/opensearch/bootstrap/MultiProviderTrustStoreHandler.java
Outdated
Show resolved
Hide resolved
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
…erts file; add bc-jsse provider Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
…tegy for default trust-store Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
974cec3 to
b08999b
Compare
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
|
❌ Gradle check result for 69d46e3: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
|
❌ Gradle check result for f826d03: null Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
|
❌ Gradle check result for 7cfeb72: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
|
❌ Gradle check result for 2adc90f: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @beanuwave. The latest changes LGTM and the demo installer looks like a good solution to convey to configurer what its doing to prepare the cluster to run in FIPS-140-3 approved mode.
Can you please also raise a PR to the documentation-website for the new CLI to explain the various options and how to use it?
I think it would make sense under the Configuring OpenSearch menu item: https://docs.opensearch.org/latest/install-and-configure/configuring-opensearch/index/
|
❌ Gradle check result for bf9e893: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
bf9e893 to
1839524
Compare
|
❌ Gradle check result for 1839524: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
...er-cli/src/test/java/org/opensearch/tools/cli/fips/truststore/ConfigurationServiceTests.java
Outdated
Show resolved
Hide resolved
...aller-cli/src/main/java/org/opensearch/tools/cli/fips/truststore/UserInteractionService.java
Outdated
Show resolved
Hide resolved
...er-cli/src/test/java/org/opensearch/tools/cli/fips/truststore/ConfigurationServiceTests.java
Outdated
Show resolved
Hide resolved
...er-cli/src/test/java/org/opensearch/tools/cli/fips/truststore/CreateFipsTrustStoreTests.java
Outdated
Show resolved
Hide resolved
| * | ||
| * @param spec the command specification for output | ||
| */ | ||
| public static void printCurrentConfiguration(CommandLine.Model.CommandSpec spec) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This class is only used in ShowProvidersCommand, we could fold it there (and SecurityProviderServiceTests could use the command instead)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is true, however in terms of clear separation of concerns, I would like to keep commands and services separated:
- Commands: Handle CLI parsing, validation, help text
- Services: Handle business logic, file and crypto operations
In the future, we can also swap CLI frameworks more easily w/o touching the business logic, e.g., by providing PrintWriter directly instead of CommandLine.Model.CommandSpec#commandLine().getOut(). Speaking of PrintWriters - I just discovered we instantiate too many in the printCurrentConfiguration method :)
Thank you @beanuwave , I have few really minor things, @andrross I would love to hear your opinion regarding #18921 (comment) before getting it in, thank you |
…ut/output handling in CLI classes Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>
|
❌ Gradle check result for ecff1dc: FAILURE Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change? |
Description
Provides additional build tooling to support builds in FIPS env, including a CLI trust-store installer to override
$JAVA_HOME/lib/security/cacerts-- migrate JVM's default SSL trust store to a BCFKS-formatted one
-- use an existing PKCS#11 trust store
-- display installed 'KeyStore' providers
-- show help
-- execute above commands interactively or in script mode
Related Issues
Resolves RFC
Check List
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.