Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nix awslc-fips #5035

Draft
wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

Nix awslc-fips #5035

wants to merge 9 commits into from

Conversation

dougch
Copy link
Contributor

@dougch dougch commented Jan 15, 2025

Release Summary:

Resolved issues:

n/a

Description of changes:

Add in a nix build of aws-lc-fips.

Call-outs:

Aws-LC-FIPS version is from https://github.com/aws/aws-lc/tree/fips-2024-09-27

Testing:

CI job doesn't exist for this libcrypto, ad-hoc job: https://us-west-2.console.aws.amazon.com/codesuite/codebuild/024603541914/projects/s2nUnitNix/batch/s2nUnitNix%3Ae476183a-58e7-4443-8be6-ec30d25d76d2?region=us-west-2

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@dougch dougch marked this pull request as ready for review January 21, 2025 23:50
@dougch dougch requested a review from lrstewart January 21, 2025 23:50
@dougch dougch marked this pull request as draft January 21, 2025 23:58
@dougch dougch marked this pull request as ready for review January 22, 2025 00:47
@dougch dougch requested a review from maddeleine January 22, 2025 17:01
flake.nix Show resolved Hide resolved
# Re-include cmake to update the environment with a new libcrypto.
buildInputs = [ pkgs.cmake aws-lc-fips ];
S2N_LIBCRYPTO = "awslc-fips";
# Integ s_client/server tests expect openssl 1.1.1.
Copy link
Contributor

@maddeleine maddeleine Jan 22, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These next couple of changes seem unrelated to awslc-fips? What's happening here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

iirc, the shellHook couldn't be appended to, so in order to change one value(PS1), the whole thing had to be redefined. There is one irreverent comment on 183 I'll remove though..

Comment on lines +14 to 15
aws-lc-fips = awslc-fips.packages.${system}.aws-lc-fips;
# TODO: submit a flake PR
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Which version of awslc-fips is this? The one our CI calls "awslc-fips" or the one it calls "awslc-fips-2022"? Or is this a completely different version?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR says it's fips-2024-09-27

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And I'm guessing that's not the "awslc-fips" used by the rest of the CI? Is the inconsistency a potential problem? Which version of awslc-fips SHOULD we be testing with?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, the rest of the CI is 2022. My preference is to test with the newest version though. Not sure why we're able to upgrade our nix awslc version easier than the rest of the CI.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Theoretically there is an aws-lc-fips release per year, and they are pretty stationary after release. This one is the ML-KEM and 140-3 validation flavor. Let discuss the SHOULD question offline, but we should add latest regardless.

@dougch dougch marked this pull request as draft January 23, 2025 20:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants