Skip to content

FIPS Adaptations#1

Open
vitalis89 wants to merge 1 commit intomainfrom
fips--build-adaptations
Open

FIPS Adaptations#1
vitalis89 wants to merge 1 commit intomainfrom
fips--build-adaptations

Conversation

@vitalis89
Copy link
Collaborator

No description provided.

find ${TOOLS_PATH}/deps -name '*.so*' -exec rm {} \;
# FIPS: In order to build FIPS compatible Python, we don't want to
# remove the shared libraries libssl and libcrypto
find ${TOOLS_PATH}/deps -name '*.so*' ! -name 'libssl.*' ! -name 'libcrypto.*' -exec rm {} \;
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

--host=${TARGET_TRIPLE}
--prefix=/install
--with-openssl=${TOOLS_PATH}/deps
--with-builtin-hashlib-hashes=sha256,sha512
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!


EXTRA_FLAGS="${EXTRA_FLAGS} ${EXTRA_TARGET_CFLAGS}"

# FIPS: Notice the 'fips' and 'shared' flags
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

section = (
"static" if "static" in build_options else info.get("build-mode", "static")
)
# FIPS: Always shared
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

@@ -245,10 +245,10 @@
# using the latest available.
# Remember to update OPENSSL_VERSION_INFO in verify_distribution.py whenever upgrading.
"openssl-3.0": {
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Important!

${OPENSSL_TARGET} \
no-legacy \
no-shared \
shared \
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@medigate-nir
Copy link

@vitalis89 a few questions:
(1) Is this meant to (configurably) build FIPS and non-FIPS standalone versions (e.g. for the next time we need to patch python on commercial)?
(2) What is the command line you use to build python based on this repo? (please specify the full command line including environmnent variables if any).
(3) What are the build dependencies (what packages does the building server need to have installed on it for the build to run, e.g. gcc, make, ...)
(4) What are the products of the build and what path are they created in? Please list all the files created that should be packaged.
I could probably answer most of these by running the build locally but I'm afraid my computer will explode if I try it 😬

@vitalis89
Copy link
Collaborator Author

vitalis89 commented Jun 24, 2025

@vitalis89 a few questions: (1) Is this meant to (configurably) build FIPS and non-FIPS standalone versions (e.g. for the next time we need to patch python on commercial)? (2) What is the command line you use to build python based on this repo? (please specify the full command line including environmnent variables if any). (3) What are the build dependencies (what packages does the building server need to have installed on it for the build to run, e.g. gcc, make, ...) (4) What are the products of the build and what path are they created in? Please list all the files created that should be packaged. I could probably answer most of these by running the build locally but I'm afraid my computer will explode if I try it 😬

@medigate-nir, please read here : https://team82.atlassian.net/browse/XD-23933?focusedCommentId=252684
I think it answers all the questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants