Skip to content

Commit fa9e700

Browse files
nmburgannmburgan
authored
Merge pull request #196 from OpenVoxProject/classpath_jars
Use new ezbake methods for managing BC FIPS jars
2 parents f8710d1 + 8269980 commit fa9e700

File tree

6 files changed

+29
-49
lines changed

6 files changed

+29
-49
lines changed

‎.gitignore‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,4 @@ acceptance/scripts/hosts.cfg
3636
/resources/puppetlabs/puppetserver/*.class
3737
/dev-resources/i18n/bin
3838

39-
# Ignore temp directory where BC jars go during build
40-
# in case it doesn't get cleaned up.
41-
resources/ext/build-scripts/bc-fips-jars
42-
resources/ext/build-scripts/bc-nonfips-jars
43-
4439
.DS_Store

‎project.clj‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -214,15 +214,30 @@
214214
:lein-ezbake {:vars {:java-args ~(str
215215
"-Djava.security.properties==/opt/puppetlabs/server/data/puppetserver/java.security.fips "
216216
"-Xms2g -Xmx2g "
217-
"-Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger")}}
217+
"-Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger")}
218+
:classpath-jars [{:artifact org.bouncycastle/bc-fips
219+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
220+
:mode "0644"}}
221+
{:artifact org.bouncycastle/bcpkix-fips
222+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
223+
:mode "0644"}}
224+
{:artifact org.bouncycastle/bctls-fips
225+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
226+
:mode "0644"}}
227+
;; Only used for installing vendored gems during packaging and not included
228+
;; in the final package, thus no :install key.
229+
{:artifact org.bouncycastle/bcpkix-jdk18on}
230+
{:artifact org.bouncycastle/bcprov-jdk18on}]
231+
:project-files [{:file "resources/ext/java.security.fips"
232+
:install {:path "/opt/puppetlabs/server/data/puppetserver"}}]}
218233
:jvm-opts ~(let [version (System/getProperty "java.specification.version")
219234
[major minor _] (clojure.string/split version #"\.")
220235
unsupported-ex (ex-info "Unsupported major Java version."
221236
{:major major
222237
:minor minor})]
223238
(condp = (java.lang.Integer/parseInt major)
224-
17 ["-Djava.security.properties==./resources/ext/build-scripts/java.security.fips"]
225-
21 ["-Djava.security.properties==./resources/ext/build-scripts/java.security.fips"]
239+
17 ["-Djava.security.properties==./resources/ext/java.security.fips"]
240+
21 ["-Djava.security.properties==./resources/ext/java.security.fips"]
226241
(do)))}
227242
:fips [:defaults :fips-deps]
228243

@@ -256,19 +271,24 @@
256271
[org.openvoxproject/puppetserver "8.13.0-SNAPSHOT"]
257272
[org.openvoxproject/trapperkeeper-webserver-jetty10]
258273
[org.openvoxproject/trapperkeeper-metrics]]
259-
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.2")]]
274+
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.3")]]
260275
:name "puppetserver"}
261276

262277
:ezbake-fips {:dependencies ^:replace [[org.clojure/clojure]
278+
;; The non-FIPS BC jar is only needed for installing vendored gems
279+
;; at packaging time, and is not included in the final package.
263280
[org.bouncycastle/bcpkix-jdk18on]
281+
[org.bouncycastle/bc-fips]
282+
[org.bouncycastle/bcpkix-fips]
283+
[org.bouncycastle/bctls-fips]
264284
[org.openvoxproject/jruby-utils]
265285
;; Do not modify this line. It is managed by the release process
266286
;; via the scripts/sync_ezbake_dep.rb script.
267287
[org.openvoxproject/puppetserver "8.13.0-SNAPSHOT"]
268288
[org.openvoxproject/trapperkeeper-webserver-jetty10]
269289
[org.openvoxproject/trapperkeeper-metrics]]
270290
:uberjar-exclusions [#"^org/bouncycastle/.*"]
271-
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.2")]]
291+
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.3")]]
272292
:name "puppetserver"}
273293
:uberjar {:dependencies [[org.openvoxproject/trapperkeeper-webserver-jetty10]]
274294
:aot [puppetlabs.trapperkeeper.main

‎resources/ext/build-scripts/install-vendored-gems.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ install_gems () {
1515
gem_list+=("$gem_name:$gem_version")
1616
done < $gem_file
1717

18-
java -cp ext/build-scripts/bc-nonfips-jars/*:puppet-server-release.jar:jruby-9k.jar clojure.main -m puppetlabs.puppetserver.cli.gem --config jruby.conf -- install ${additional_args:+"$additional_args"} --no-document "${gem_list[@]}"
18+
java -cp ext/classpath-jars/*:puppet-server-release.jar:jruby-9k.jar clojure.main -m puppetlabs.puppetserver.cli.gem --config jruby.conf -- install ${additional_args:+"$additional_args"} --no-document "${gem_list[@]}"
1919
}
2020

2121
SOURCE="${BASH_SOURCE[0]}"

‎resources/ext/ezbake.conf‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,8 @@ ezbake: {
99
foss: {
1010
redhat: { dependencies: ["openvox-agent >= 8.21.1"],
1111
build-dependencies: ["%{open_jdk}"],
12-
# Install some gems, and install BC FIPS jars if the build task copied them to the right place.
13-
# This is admittedly pretty hacky, but it prevents us from having to add another strand of
14-
# complexity to the already complex ezbake build process.
15-
install: [
16-
"bash ./ext/build-scripts/install-vendored-gems.sh",
17-
"install -d -m 0700 \"${DESTDIR}${app_data}/jars\"",
18-
"if [ -d ext/build-scripts/bc-fips-jars ]; then files=(ext/build-scripts/bc-fips-jars/*); install -m 0644 \"${files[@]}\" \"${DESTDIR}${app_data}/jars/\"; install -m 0644 ext/build-scripts/java.security.fips \"${DESTDIR}${app_data}/\"; fi",
19-
]
12+
# Install some gems
13+
install: ["bash ./ext/build-scripts/install-vendored-gems.sh"]
2014
# This is terrible, but we need write access to puppet's
2115
# var/conf dirs, so we need to add ourselves to the group.
2216
# Then we need to chmod some dirs until the Puppet packaging
@@ -42,12 +36,7 @@ ezbake: {
4236

4337
debian: { dependencies: ["openvox-agent (>= 8.21.1)"],
4438
build-dependencies: ["openjdk-17-jre-headless"],
45-
# see redhat comments on why this is hacky
46-
install: [
47-
"bash ./ext/build-scripts/install-vendored-gems.sh",
48-
"install -d -m 0700 \"${DESTDIR}${app_data}/jars\"",
49-
"if [ -d ext/build-scripts/bc-fips-jars ]; then files=(ext/build-scripts/bc-fips-jars/*); install -m 0644 \"${files[@]}\" \"${DESTDIR}${app_data}/jars/\"; install -m 0644 ext/build-scripts/java.security.fips \"${DESTDIR}${app_data}/\"; fi",
50-
]
39+
install: ["bash ./ext/build-scripts/install-vendored-gems.sh"]
5140
# see redhat comments on why this is terrible
5241
postinst-install: [
5342
"install --owner={{user}} --group={{user}} -d /opt/puppetlabs/server/data/puppetserver/jruby-gems",

resources/ext/build-scripts/java.security.fips renamed to resources/ext/java.security.fips

File renamed without changes.

‎tasks/build.rake‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -152,31 +152,7 @@ namespace :vox do
152152
run("cd /code && COW=\"#{@debs}\" MOCK=\"#{@nonfips_rpms}\" GEM_SOURCE='https://rubygems.org' #{ezbake_version_var} EZBAKE_ALLOW_UNREPRODUCIBLE_BUILDS=true EZBAKE_NODEPLOY=true LEIN_PROFILES=ezbake lein with-profile user,ezbake,provided ezbake local-build")
153153
end
154154

155-
# When building for FIPS, we have to have the Bouncy Castle FIPS jars live on disk separate
156-
# from the uberjar, due to signing of those jars. Ezbake doesn't have a great way to handle this,
157-
# so we copy them from the local Maven cache inside the container to a place ezbake knows how to
158-
# find them, and then have it build the RPM with it laying down those files in the right place.
159155
unless @fips_rpms.empty?
160-
puts "Copy Bouncy Castle FIPS jars into ezbake resource location"
161-
dest = '/code/resources/ext/build-scripts/bc-fips-jars'
162-
run("mkdir -p #{dest}")
163-
cmd = "cd /code && lein with-profile ezbake-fips,fips classpath"
164-
stdout, stderr, status = Open3.capture3("docker exec #{@container} /bin/bash --login -c '#{cmd}'")
165-
unless status.success?
166-
puts "Failed to get classpath for FIPS build: #{stderr}"
167-
exit 1
168-
end
169-
classpath = stdout.strip
170-
paths = classpath.split(':').select { |p| p =~ /bcpkix-fips|bc-fips|bctls-fips/ }
171-
paths.each { |p| run("cp #{p} #{dest}/") }
172-
173-
# We also copy the non-FIPS jdk18on jars as well. This is only for the step where we install
174-
# vendored gems during the packaging step and they are not included in the final package.
175-
dest = '/code/resources/ext/build-scripts/bc-nonfips-jars'
176-
run("mkdir -p #{dest}")
177-
paths = classpath.split(':').select { |p| p =~ /jdk18on/ }
178-
paths.each { |p| run("cp #{p} #{dest}/") }
179-
180156
run("cd /code && COW= MOCK=\"#{@fips_rpms}\" GEM_SOURCE='https://rubygems.org' #{ezbake_version_var} EZBAKE_ALLOW_UNREPRODUCIBLE_BUILDS=true EZBAKE_NODEPLOY=true LEIN_PROFILES=ezbake lein with-profile fips,user,ezbake-fips,provided ezbake local-build")
181157
end
182158

0 commit comments

Comments
 (0)