Migrate from BC to BCFIPS libraries #17507

beanuwave · 2025-03-04T17:50:04Z

NOTE: Basically a split up from the original #14912

Description

Migration of BouncyCastle's BC libraries to their FIPS counterparts. BC-FIPS libraries are used in general mode only, FIPS-140-3 related changes are not included in this commit.

Other components with hard BC dependencies are likely to break. Fortunately @terryquickleysas has already provided a brief summery for v2.17.

Check List

Functionality includes testing.
API changes companion pull request created, if applicable.
Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

github-actions · 2025-03-04T17:56:26Z

❌ Gradle check result for 8540984: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T11:30:55Z

❌ Gradle check result for 3966e04: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T12:25:19Z

❌ Gradle check result for bedd7e6: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T13:21:14Z

❌ Gradle check result for 92abe7c: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T13:43:02Z

❌ Gradle check result for 0dccac7: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T14:43:07Z

❌ Gradle check result for 77cc952: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T15:00:10Z

❌ Gradle check result for cf65dcb: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T15:34:57Z

❌ Gradle check result for 64bf6c5: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T16:05:34Z

❌ Gradle check result for 37eae20: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-05T16:39:32Z

❌ Gradle check result for e2384f5: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-06T11:08:57Z

❌ Gradle check result for 0f0ae5d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-06T11:36:10Z

❌ Gradle check result for 78fddee: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-06T15:22:48Z

❌ Gradle check result for b904edc: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-06T16:16:14Z

❌ Gradle check result for b66477c: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-06T17:16:10Z

❌ Gradle check result for a6103e7: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-13T13:08:19Z

❌ Gradle check result for 0825345: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

cwperks · 2025-03-17T21:04:24Z

Other components with hard BC dependencies are likely to break. Fortunately @terryquickleysas has already provided a #14912 v2.17.

@beanuwave my understanding is that FIPS would be a separate build that requires passing OPENSEARCH_CRYPTO_STANDARD=FIPS-140-3 when building to build a version of core w/ BCFIPS jars. Is this still the case or is the intent to switchover entirely to BCFIPS jars with this PR? If Github issues don't already exist, we should create issues on affected repos and a META to track the progress for ensuring that existing functionality works with the BCFIPS jars such as SAML login in the security plugin, esp. if its known that there are issues if BCFIPS and non-FIPS jars are on the same classpath.

beanuwave · 2025-03-18T14:38:10Z

@cwperks For simplicity, the upcoming build parameter -Pcrypto.standard=FIPS-140-3 (not part of this PR) will instruct the application to run all cryptographic operations in approved-only mode without exchanging libraries. I will open a META task to track the necessary work - thank you!

Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]> # Conflicts: # release-notes/opensearch.release-notes-3.0.0-alpha1.md

github-actions · 2025-03-20T09:02:57Z

❌ Gradle check result for 31e983a: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-20T10:22:02Z

❌ Gradle check result for aa11b27: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

github-actions · 2025-03-20T12:26:31Z

❌ Gradle check result for e24118d: FAILURE

Please examine the workflow log, locate, and copy-paste the failure(s) below, then iterate to green. Is the failure a flaky test unrelated to your change?

Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>

server/src/main/resources/org/opensearch/bootstrap/security.policy

cwperks

Thank you @beanuwave, with the removal of the extra deps on the server module this LGTM. I just tested with the security plugin and the sec plugin can be installed w/ these changes in place.

@andrross @reta Could I also get a second set of eyes on this?

github-actions · 2025-03-20T13:54:44Z

❕ Gradle check result for 8edda48: UNSTABLE

TEST FAILURES:

      1 org.opensearch.snapshots.DedicatedClusterSnapshotRestoreIT.testSnapshotWithStuckNode
      1 org.opensearch.index.ShardIndexingPressureIT.testShardIndexingPressureTrackingDuringBulkWrites

Please review all flaky tests that succeeded after retry and create an issue if one does not already exist to track the flaky failure.

Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>

github-actions · 2025-03-21T13:06:13Z

✅ Gradle check result for 8132609: SUCCESS

* Migrate from BC to BCFIPS libraries Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]> # Conflicts: # release-notes/opensearch.release-notes-3.0.0-alpha1.md * reduce footprint of BC libs Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]> * restrain permissions in server policy file Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]> --------- Signed-off-by: Igonin <[email protected]> Co-authored-by: Igonin <[email protected]> Co-authored-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>

beanuwave force-pushed the bc_to_bcfips_migration branch from 8540984 to 3966e04 Compare March 5, 2025 11:17

beanuwave force-pushed the bc_to_bcfips_migration branch from 3966e04 to bedd7e6 Compare March 5, 2025 12:13

beanuwave force-pushed the bc_to_bcfips_migration branch from bedd7e6 to 92abe7c Compare March 5, 2025 13:07

beanuwave force-pushed the bc_to_bcfips_migration branch from 92abe7c to 0dccac7 Compare March 5, 2025 13:36

beanuwave force-pushed the bc_to_bcfips_migration branch from 0dccac7 to 77cc952 Compare March 5, 2025 14:31

beanuwave force-pushed the bc_to_bcfips_migration branch from 77cc952 to cf65dcb Compare March 5, 2025 14:53

beanuwave force-pushed the bc_to_bcfips_migration branch from cf65dcb to 64bf6c5 Compare March 5, 2025 15:19

beanuwave force-pushed the bc_to_bcfips_migration branch from 37eae20 to e2384f5 Compare March 5, 2025 16:13

beanuwave force-pushed the bc_to_bcfips_migration branch from e2384f5 to 0f0ae5d Compare March 6, 2025 11:03

beanuwave force-pushed the bc_to_bcfips_migration branch from 0f0ae5d to 78fddee Compare March 6, 2025 11:26

beanuwave force-pushed the bc_to_bcfips_migration branch from 78fddee to b904edc Compare March 6, 2025 14:23

beanuwave force-pushed the bc_to_bcfips_migration branch from b904edc to b66477c Compare March 6, 2025 15:55

beanuwave force-pushed the bc_to_bcfips_migration branch from b66477c to a6103e7 Compare March 6, 2025 16:23

opensearch-ci-bot mentioned this pull request Oct 23, 2024

[AUTOCUT] Gradle Check Flaky Test Report for QueueResizableOpenSearchThreadPoolExecutorTests #14297

Open

opensearch-ci-bot mentioned this pull request Feb 26, 2025

[AUTOCUT] Gradle Check Flaky Test Report for IndexActionIT #16576

Open

beanuwave mentioned this pull request Mar 19, 2025

[META] Replace Bouncycastle dependencies with FIPS counterparts #17634

Open

2 tasks

beanuwave force-pushed the bc_to_bcfips_migration branch from 9ff88b6 to eff2ba7 Compare March 20, 2025 08:46

beanuwave force-pushed the bc_to_bcfips_migration branch from eff2ba7 to 31e983a Compare March 20, 2025 08:54

beanuwave force-pushed the bc_to_bcfips_migration branch 2 times, most recently from 85761ee to aa11b27 Compare March 20, 2025 10:07

beanuwave force-pushed the bc_to_bcfips_migration branch from aa11b27 to e24118d Compare March 20, 2025 11:28

opensearch-ci-bot mentioned this pull request Mar 20, 2025

[AUTOCUT] Gradle Check Flaky Test Report for MoreExpressionIT #15823

Open

reduce footprint of BC libs

8edda48

Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>

beanuwave force-pushed the bc_to_bcfips_migration branch from e24118d to 8edda48 Compare March 20, 2025 12:53

cwperks reviewed Mar 20, 2025

View reviewed changes

server/src/main/resources/org/opensearch/bootstrap/security.policy Outdated Show resolved Hide resolved

cwperks reviewed Mar 20, 2025

View reviewed changes

This was referenced Mar 20, 2025

[AUTOCUT] Gradle Check Flaky Test Report for ShardIndexingPressureIT #15830

Open

[AUTOCUT] Gradle Check Flaky Test Report for SearchRestCancellationIT #14311

Open

restrain permissions in server policy file

8132609

Signed-off-by: Igonin <[email protected]> Co-authored-by: Benny Goerzig <[email protected]> Co-authored-by: Karsten Schnitter <[email protected]> Co-authored-by: Kai Sternad <[email protected]>

cwperks approved these changes Mar 21, 2025

View reviewed changes

andrross approved these changes Mar 21, 2025

View reviewed changes

andrross merged commit 08dc95e into opensearch-project:main Mar 21, 2025
33 of 34 checks passed

opensearch-ci-bot mentioned this pull request Mar 21, 2025

[AUTOCUT] Gradle Check Flaky Test Report for S3BlobStoreRepositoryTests #14299

Open

This was referenced Mar 22, 2025

Migrate from BC to BCFIPS libraries opensearch-project/flow-framework#1087

Merged

Bump tj-actions/changed-files from 46.0.1 to 46.0.3 #17666

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate from BC to BCFIPS libraries #17507

Migrate from BC to BCFIPS libraries #17507

beanuwave commented Mar 4, 2025

github-actions bot commented Mar 4, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 13, 2025

cwperks commented Mar 17, 2025

beanuwave commented Mar 18, 2025

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 20, 2025

cwperks left a comment

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 21, 2025

Migrate from BC to BCFIPS libraries #17507

Migrate from BC to BCFIPS libraries #17507

Conversation

beanuwave commented Mar 4, 2025

Description

Check List

github-actions bot commented Mar 4, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 5, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 6, 2025

github-actions bot commented Mar 13, 2025

cwperks commented Mar 17, 2025

beanuwave commented Mar 18, 2025

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 20, 2025

cwperks left a comment

Choose a reason for hiding this comment

github-actions bot commented Mar 20, 2025

github-actions bot commented Mar 21, 2025