Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

renaming FIPS classifier to be more clear #773

Merged
merged 5 commits into from
Mar 20, 2024
Merged

renaming FIPS classifier to be more clear #773

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
68337c4
renaming and add more warning
TingDaoK Mar 20, 2024
6ba5549
more
TingDaoK Mar 20, 2024
99a239b
make a separate section for FIPS
TingDaoK Mar 20, 2024
261b6db
address comments
TingDaoK Mar 20, 2024
2f792e5
no trailing space
TingDaoK Mar 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,10 +82,7 @@ From maven: (https://search.maven.org/artifact/software.amazon.awssdk.crt/aws-cr

The `aws-crt` JAR in Maven Central is a large "uber" jar that contains compiled C libraries for many different platforms (Windows, Linux, etc). If size is an issue, you can pick a smaller platform-specific JAR by setting the `<classifier>`.

The classifier `fips-compat` provides an "uber" jar with FIPS compliance on *some platforms*. **WARNING:** Platforms without FIPS compliance are also included in this jar, for compatibility's sake. Check `CRT.isFIPS()` at runtime to ensure you are on a FIPS compliant platform. The current breakdown is:
* **FIPS compliant**: linux-aarch_64, linux-x86_64
* **NOT compliant**: linux-armv6, linux-armv7, linux-armv7-musl, linux-aarch_64-musl, linux-x86_32, linux-x86_64-musl, osx-aarch_64, osx-x86_64, windows-x86_32, windows-x86_64

Sample to use classifier from aws-crt:
``` xml
<!-- Platform-specific Linux x86_64 JAR -->
<dependency>
Expand All @@ -105,7 +102,7 @@ The classifier `fips-compat` provides an "uber" jar with FIPS compliance on *som
</dependency>
```

### Available platform classifiers
### Available classifiers

- linux-armv6 (no auto-detect)
- linux-armv7 (no auto-detect)
Expand All @@ -119,7 +116,7 @@ The classifier `fips-compat` provides an "uber" jar with FIPS compliance on *som
- osx-x86_64
- windows-x86_32
- windows-x86_64
- fips-compat (no auto-detect)
- fips-where-available (no auto-detect)

### Auto-detect

Expand Down Expand Up @@ -151,6 +148,18 @@ a classifier-based jar, you must specify the classifier name yourself.
<dependencies>
```

## FIPS Compliance

Currently the classifier `fips-where-available` provides an "uber" jar with FIPS compliance on *some platforms*.

Platforms without FIPS compliance are also included in this jar, for compatibility's sake. Check `CRT.isFIPS()` at runtime to ensure you are on a FIPS compliant platform. The current breakdown is:
* **FIPS compliant**: linux-aarch_64, linux-x86_64
* **NOT compliant**: linux-armv6, linux-armv7, linux-armv7-musl, linux-aarch_64-musl, linux-x86_32, linux-x86_64-musl, osx-aarch_64, osx-x86_64, windows-x86_32, windows-x86_64

> [!WARNING]
> The classifier and the platforms with FIPS compliant are subjected to be changed in the future.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
> The classifier and the platforms with FIPS compliant are subjected to be changed in the future.
> The classifier, and platforms with FIPS compliance are subject to change in the future.



## System Properties

- To enable logging, set `aws.crt.log.destination` or `aws.crt.log.level`:
Expand Down
2 changes: 1 addition & 1 deletion codebuild/cd/deploy-platform-specific-jars.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ else
DEPLOY_REPOSITORY_URL=https://aws.oss.sonatype.org:443/service/local/staging/deployByRepositoryId/${STAGING_REPO_ID}
fi

CLASSIFIERS_ARRAY=("linux-armv6" "linux-armv7" "linux-aarch_64" "linux-x86_32" "linux-x86_64" "osx-aarch_64" "osx-x86_64" "windows-x86_32" "windows-x86_64" "linux-x86_64-musl" "linux-armv7-musl" "linux-aarch_64-musl" "fips-compat")
CLASSIFIERS_ARRAY=("linux-armv6" "linux-armv7" "linux-aarch_64" "linux-x86_32" "linux-x86_64" "osx-aarch_64" "osx-x86_64" "windows-x86_32" "windows-x86_64" "linux-x86_64-musl" "linux-armv7-musl" "linux-aarch_64-musl" "fips-where-available")

for str in ${CLASSIFIERS_ARRAY[@]}; do
FILES="${FILES}target/aws-crt-1.0.0-SNAPSHOT-$str.jar,"
Expand Down
4 changes: 2 additions & 2 deletions codebuild/cd/fips-compat-jar-build.yml
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fips-compat-jar-build.yml - > fips-where-available-jar-build.yml

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you'd need to update the release pipeline too, right? I can't find where this file is referenced, in the codebase

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, it's in the codebuild process

Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,13 @@ phases:
# upload artifacts to S3
- export GIT_TAG=$(git describe --tags)
- mkdir -p target/cmake-build/lib
# prepare fips-compat uber jar, download the regular libs
# prepare fips-where-available uber jar, download the regular libs
- aws s3 cp --recursive s3://aws-crt-java-pipeline/${GIT_TAG}/lib $CODEBUILD_SRC_DIR/aws-crt-java/target/cmake-build/lib
# Override with the FIPS libs
- aws s3 cp --recursive s3://aws-crt-java-pipeline/${GIT_TAG}/fips_lib $CODEBUILD_SRC_DIR/aws-crt-java/target/cmake-build/lib
# Run a test to make sure we get the FIPS libs
- CRT_FIPS=ON mvn test -Dtest=software.amazon.awssdk.crt.test.SystemInfoTest#testIsFIPS -Dshared-lib.skip=true
- mvn -B package -DskipTests -Dshared-lib.skip=true -Dcrt.classifier=fips-compat
- mvn -B package -DskipTests -Dshared-lib.skip=true -Dcrt.classifier=fips-where-available

post_build:
commands:
Expand Down
2 changes: 1 addition & 1 deletion codebuild/cd/test-platform-specific-jar-snapshot.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

set -ex

PLATFORM_ARRAY=("linux-armv6" "linux-armv7" "linux-aarch_64" "linux-x86_32" "linux-x86_64" "osx-aarch_64" "osx-x86_64" "windows-x86_32" "windows-x86_64" "linux-x86_64-musl" "linux-armv7-musl" "linux-aarch_64-musl" "fips-compat")
PLATFORM_ARRAY=("linux-armv6" "linux-armv7" "linux-aarch_64" "linux-x86_32" "linux-x86_64" "osx-aarch_64" "osx-x86_64" "windows-x86_32" "windows-x86_64" "linux-x86_64-musl" "linux-armv7-musl" "linux-aarch_64-musl" "fips-where-available")

# test uber jar
mvn -B dependency:get -DrepoUrl=https://aws.oss.sonatype.org/content/repositories/snapshots -Dartifact=software.amazon.awssdk.crt:aws-crt:${CRT_VERSION}-SNAPSHOT -Dtransitive=false
Expand Down
Loading