Skip to content

Commit 8269980

Browse files
nmburgannmburgan
committed
Use new ezbake methods for managing BC FIPS jars
The method we were using before was very hacky, taking advantage of this project copying stuff from resources/ext/build-scripts into the staging dir and using the vox:build Rake task to put things in the right place. This uses the changes in the latest ezbake to do the same procedure, pulling BC jars from the classpath and Maven cache, but letting ezbake handle it instead of hacking it in.
1 parent f8710d1 commit 8269980

6 files changed

Lines changed: 29 additions & 49 deletions

File tree

‎.gitignore‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,9 +36,4 @@ acceptance/scripts/hosts.cfg
3636
/resources/puppetlabs/puppetserver/*.class
3737
/dev-resources/i18n/bin
3838

39-
# Ignore temp directory where BC jars go during build
40-
# in case it doesn't get cleaned up.
41-
resources/ext/build-scripts/bc-fips-jars
42-
resources/ext/build-scripts/bc-nonfips-jars
43-
4439
.DS_Store

‎project.clj‎

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -214,15 +214,30 @@
214214
:lein-ezbake {:vars {:java-args ~(str
215215
"-Djava.security.properties==/opt/puppetlabs/server/data/puppetserver/java.security.fips "
216216
"-Xms2g -Xmx2g "
217-
"-Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger")}}
217+
"-Djruby.logger.class=com.puppetlabs.jruby_utils.jruby.Slf4jLogger")}
218+
:classpath-jars [{:artifact org.bouncycastle/bc-fips
219+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
220+
:mode "0644"}}
221+
{:artifact org.bouncycastle/bcpkix-fips
222+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
223+
:mode "0644"}}
224+
{:artifact org.bouncycastle/bctls-fips
225+
:install {:path "/opt/puppetlabs/server/data/puppetserver/jars"
226+
:mode "0644"}}
227+
;; Only used for installing vendored gems during packaging and not included
228+
;; in the final package, thus no :install key.
229+
{:artifact org.bouncycastle/bcpkix-jdk18on}
230+
{:artifact org.bouncycastle/bcprov-jdk18on}]
231+
:project-files [{:file "resources/ext/java.security.fips"
232+
:install {:path "/opt/puppetlabs/server/data/puppetserver"}}]}
218233
:jvm-opts ~(let [version (System/getProperty "java.specification.version")
219234
[major minor _] (clojure.string/split version #"\.")
220235
unsupported-ex (ex-info "Unsupported major Java version."
221236
{:major major
222237
:minor minor})]
223238
(condp = (java.lang.Integer/parseInt major)
224-
17 ["-Djava.security.properties==./resources/ext/build-scripts/java.security.fips"]
225-
21 ["-Djava.security.properties==./resources/ext/build-scripts/java.security.fips"]
239+
17 ["-Djava.security.properties==./resources/ext/java.security.fips"]
240+
21 ["-Djava.security.properties==./resources/ext/java.security.fips"]
226241
(do)))}
227242
:fips [:defaults :fips-deps]
228243

@@ -256,19 +271,24 @@
256271
[org.openvoxproject/puppetserver "8.13.0-SNAPSHOT"]
257272
[org.openvoxproject/trapperkeeper-webserver-jetty10]
258273
[org.openvoxproject/trapperkeeper-metrics]]
259-
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.2")]]
274+
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.3")]]
260275
:name "puppetserver"}
261276

262277
:ezbake-fips {:dependencies ^:replace [[org.clojure/clojure]
278+
;; The non-FIPS BC jar is only needed for installing vendored gems
279+
;; at packaging time, and is not included in the final package.
263280
[org.bouncycastle/bcpkix-jdk18on]
281+
[org.bouncycastle/bc-fips]
282+
[org.bouncycastle/bcpkix-fips]
283+
[org.bouncycastle/bctls-fips]
264284
[org.openvoxproject/jruby-utils]
265285
;; Do not modify this line. It is managed by the release process
266286
;; via the scripts/sync_ezbake_dep.rb script.
267287
[org.openvoxproject/puppetserver "8.13.0-SNAPSHOT"]
268288
[org.openvoxproject/trapperkeeper-webserver-jetty10]
269289
[org.openvoxproject/trapperkeeper-metrics]]
270290
:uberjar-exclusions [#"^org/bouncycastle/.*"]
271-
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.2")]]
291+
:plugins [[org.openvoxproject/lein-ezbake ~(or (System/getenv "EZBAKE_VERSION") "2.7.3")]]
272292
:name "puppetserver"}
273293
:uberjar {:dependencies [[org.openvoxproject/trapperkeeper-webserver-jetty10]]
274294
:aot [puppetlabs.trapperkeeper.main

‎resources/ext/build-scripts/install-vendored-gems.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ install_gems () {
1515
gem_list+=("$gem_name:$gem_version")
1616
done < $gem_file
1717

18-
java -cp ext/build-scripts/bc-nonfips-jars/*:puppet-server-release.jar:jruby-9k.jar clojure.main -m puppetlabs.puppetserver.cli.gem --config jruby.conf -- install ${additional_args:+"$additional_args"} --no-document "${gem_list[@]}"
18+
java -cp ext/classpath-jars/*:puppet-server-release.jar:jruby-9k.jar clojure.main -m puppetlabs.puppetserver.cli.gem --config jruby.conf -- install ${additional_args:+"$additional_args"} --no-document "${gem_list[@]}"
1919
}
2020

2121
SOURCE="${BASH_SOURCE[0]}"

‎resources/ext/ezbake.conf‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,8 @@ ezbake: {
99
foss: {
1010
redhat: { dependencies: ["openvox-agent >= 8.21.1"],
1111
build-dependencies: ["%{open_jdk}"],
12-
# Install some gems, and install BC FIPS jars if the build task copied them to the right place.
13-
# This is admittedly pretty hacky, but it prevents us from having to add another strand of
14-
# complexity to the already complex ezbake build process.
15-
install: [
16-
"bash ./ext/build-scripts/install-vendored-gems.sh",
17-
"install -d -m 0700 \"${DESTDIR}${app_data}/jars\"",
18-
"if [ -d ext/build-scripts/bc-fips-jars ]; then files=(ext/build-scripts/bc-fips-jars/*); install -m 0644 \"${files[@]}\" \"${DESTDIR}${app_data}/jars/\"; install -m 0644 ext/build-scripts/java.security.fips \"${DESTDIR}${app_data}/\"; fi",
19-
]
12+
# Install some gems
13+
install: ["bash ./ext/build-scripts/install-vendored-gems.sh"]
2014
# This is terrible, but we need write access to puppet's
2115
# var/conf dirs, so we need to add ourselves to the group.
2216
# Then we need to chmod some dirs until the Puppet packaging
@@ -42,12 +36,7 @@ ezbake: {
4236

4337
debian: { dependencies: ["openvox-agent (>= 8.21.1)"],
4438
build-dependencies: ["openjdk-17-jre-headless"],
45-
# see redhat comments on why this is hacky
46-
install: [
47-
"bash ./ext/build-scripts/install-vendored-gems.sh",
48-
"install -d -m 0700 \"${DESTDIR}${app_data}/jars\"",
49-
"if [ -d ext/build-scripts/bc-fips-jars ]; then files=(ext/build-scripts/bc-fips-jars/*); install -m 0644 \"${files[@]}\" \"${DESTDIR}${app_data}/jars/\"; install -m 0644 ext/build-scripts/java.security.fips \"${DESTDIR}${app_data}/\"; fi",
50-
]
39+
install: ["bash ./ext/build-scripts/install-vendored-gems.sh"]
5140
# see redhat comments on why this is terrible
5241
postinst-install: [
5342
"install --owner={{user}} --group={{user}} -d /opt/puppetlabs/server/data/puppetserver/jruby-gems",

resources/ext/build-scripts/java.security.fips renamed to resources/ext/java.security.fips

File renamed without changes.

‎tasks/build.rake‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -152,31 +152,7 @@ namespace :vox do
152152
run("cd /code && COW=\"#{@debs}\" MOCK=\"#{@nonfips_rpms}\" GEM_SOURCE='https://rubygems.org' #{ezbake_version_var} EZBAKE_ALLOW_UNREPRODUCIBLE_BUILDS=true EZBAKE_NODEPLOY=true LEIN_PROFILES=ezbake lein with-profile user,ezbake,provided ezbake local-build")
153153
end
154154

155-
# When building for FIPS, we have to have the Bouncy Castle FIPS jars live on disk separate
156-
# from the uberjar, due to signing of those jars. Ezbake doesn't have a great way to handle this,
157-
# so we copy them from the local Maven cache inside the container to a place ezbake knows how to
158-
# find them, and then have it build the RPM with it laying down those files in the right place.
159155
unless @fips_rpms.empty?
160-
puts "Copy Bouncy Castle FIPS jars into ezbake resource location"
161-
dest = '/code/resources/ext/build-scripts/bc-fips-jars'
162-
run("mkdir -p #{dest}")
163-
cmd = "cd /code && lein with-profile ezbake-fips,fips classpath"
164-
stdout, stderr, status = Open3.capture3("docker exec #{@container} /bin/bash --login -c '#{cmd}'")
165-
unless status.success?
166-
puts "Failed to get classpath for FIPS build: #{stderr}"
167-
exit 1
168-
end
169-
classpath = stdout.strip
170-
paths = classpath.split(':').select { |p| p =~ /bcpkix-fips|bc-fips|bctls-fips/ }
171-
paths.each { |p| run("cp #{p} #{dest}/") }
172-
173-
# We also copy the non-FIPS jdk18on jars as well. This is only for the step where we install
174-
# vendored gems during the packaging step and they are not included in the final package.
175-
dest = '/code/resources/ext/build-scripts/bc-nonfips-jars'
176-
run("mkdir -p #{dest}")
177-
paths = classpath.split(':').select { |p| p =~ /jdk18on/ }
178-
paths.each { |p| run("cp #{p} #{dest}/") }
179-
180156
run("cd /code && COW= MOCK=\"#{@fips_rpms}\" GEM_SOURCE='https://rubygems.org' #{ezbake_version_var} EZBAKE_ALLOW_UNREPRODUCIBLE_BUILDS=true EZBAKE_NODEPLOY=true LEIN_PROFILES=ezbake lein with-profile fips,user,ezbake-fips,provided ezbake local-build")
181157
end
182158

0 commit comments

Comments
 (0)