-
Notifications
You must be signed in to change notification settings - Fork 718
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Nix awslc-fips #5035
base: main
Are you sure you want to change the base?
Nix awslc-fips #5035
Conversation
# Re-include cmake to update the environment with a new libcrypto. | ||
buildInputs = [ pkgs.cmake aws-lc-fips ]; | ||
S2N_LIBCRYPTO = "awslc-fips"; | ||
# Integ s_client/server tests expect openssl 1.1.1. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These next couple of changes seem unrelated to awslc-fips? What's happening here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
iirc, the shellHook couldn't be appended to, so in order to change one value(PS1), the whole thing had to be redefined. There is one irreverent comment on 183 I'll remove though..
aws-lc-fips = awslc-fips.packages.${system}.aws-lc-fips; | ||
# TODO: submit a flake PR |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Which version of awslc-fips is this? The one our CI calls "awslc-fips" or the one it calls "awslc-fips-2022"? Or is this a completely different version?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
PR says it's fips-2024-09-27
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
And I'm guessing that's not the "awslc-fips" used by the rest of the CI? Is the inconsistency a potential problem? Which version of awslc-fips SHOULD we be testing with?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, the rest of the CI is 2022. My preference is to test with the newest version though. Not sure why we're able to upgrade our nix awslc version easier than the rest of the CI.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Theoretically there is an aws-lc-fips release per year, and they are pretty stationary after release. This one is the ML-KEM and 140-3 validation flavor. Let discuss the SHOULD question offline, but we should add latest regardless.
Release Summary:
Resolved issues:
n/a
Description of changes:
Add in a nix build of aws-lc-fips.
Call-outs:
Aws-LC-FIPS version is from https://github.com/aws/aws-lc/tree/fips-2024-09-27
Testing:
CI job doesn't exist for this libcrypto, ad-hoc job: https://us-west-2.console.aws.amazon.com/codesuite/codebuild/024603541914/projects/s2nUnitNix/batch/s2nUnitNix%3Ae476183a-58e7-4443-8be6-ec30d25d76d2?region=us-west-2
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.