Skip to content

FIPS Adaptations #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

FIPS Adaptations #1

wants to merge 1 commit into from

Conversation

vitalis89
Copy link
Collaborator

No description provided.

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
cpython-unix/build-cpython.sh
find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
# FIPS: In order to build FIPS compatible Python, we don't want to
# remove the shared libraries libssl and libcrypto
find ${TOOLS_PATH}/deps -name '*.so*' ! -name 'libssl.*' ! -name 'libcrypto.*' -exec rm {} \;
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
cpython-unix/build-cpython.sh
@@ -389,7 +391,7 @@ CONFIGURE_FLAGS="
--build=${BUILD_TRIPLE}
--host=${TARGET_TRIPLE}
--prefix=/install
--with-openssl=${TOOLS_PATH}/deps
--with-builtin-hashlib-hashes=sha256,sha512
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
cpython-unix/build-openssl-3.0.sh
@@ -37,12 +37,14 @@ EXTRA_TARGET_CFLAGS=${EXTRA_TARGET_CFLAGS/\-arch x86_64/}

EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"

# FIPS: Notice the 'fips' and 'shared' flags
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
pythonbuild/cpython.py
section = (
"static" if "static" in build_options else info.get("build-mode", "static")
)
# FIPS: Always shared
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
pythonbuild/downloads.py
@@ -245,10 +245,10 @@
# using the latest available.
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.0": {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

vitalis89
vitalis89 commented Jun 18, 2025
View reviewed changes
cpython-unix/build-openssl-3.0.sh
--prefix=/tools/deps \
--libdir=lib \
${OPENSSL_TARGET} \
no-legacy \
no-shared \
shared \
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See: openssl/openssl#23830 (comment)

@medigate-nir
Copy link

@vitalis89 a few questions:
(1) Is this meant to (configurably) build FIPS and non-FIPS standalone versions (e.g. for the next time we need to patch python on commercial)?
(2) What is the command line you use to build python based on this repo? (please specify the full command line including environmnent variables if any).
(3) What are the build dependencies (what packages does the building server need to have installed on it for the build to run, e.g. gcc, make, ...)
(4) What are the products of the build and what path are they created in? Please list all the files created that should be packaged.
I could probably answer most of these by running the build locally but I'm afraid my computer will explode if I try it 😬

@vitalis89
Copy link
Collaborator Author

vitalis89 commented Jun 24, 2025 •
edited
Loading

@vitalis89 a few questions: (1) Is this meant to (configurably) build FIPS and non-FIPS standalone versions (e.g. for the next time we need to patch python on commercial)? (2) What is the command line you use to build python based on this repo? (please specify the full command line including environmnent variables if any). (3) What are the build dependencies (what packages does the building server need to have installed on it for the build to run, e.g. gcc, make, ...) (4) What are the products of the build and what path are they created in? Please list all the files created that should be packaged. I could probably answer most of these by running the build locally but I'm afraid my computer will explode if I try it 😬

@medigate-nir, please read here : https://team82.atlassian.net/browse/XD-23933?focusedCommentId=252684
I think it answers all the questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@vitalis89 @medigate-nir