Skip to content

Commit b9ded39

Browse files
tobiasb-msCopilot
authored and
reubeno
committed
feat(SymCrypt): onboard SymCrypt to Azure Linux 4.0
SymCrypt has no upstream Azure Linux 4.0 package, so this ports it from 3.0. Starting from the pristine AZL3 spec, the targeted changes for 4.0 are: - Preserve the FIPS integrity HMAC under AZL4's defaults: strip -Wl,-z,pack-relative-relocs (DT_RELR relocations break it) and drop the custom debuginfo post-processing inherited from 3.0. - Manage release and changelog with rpmautospec. - Switched to %cmake* macros where possible Upgraded to SymCrypt 103.11.0 in the same pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent e3eee35 commit b9ded39

10 files changed

Lines changed: 410 additions & 0 deletions

‎base/comps/SymCrypt/SymCrypt.comp.toml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[components.SymCrypt]
2+
spec = { type = "local", path = "SymCrypt.spec" }
3+
4+
[[components.SymCrypt.source-files]]
5+
filename = "SymCrypt-103.11.0.tar.gz"
6+
hash = "1c24ca0cf3ee30336a610421a64864db7f0756ac0846f0450525c473f85b5345"
7+
hash-type = "SHA256"
8+
origin = { type = "download", uri = "https://github.com/microsoft/SymCrypt/archive/v103.11.0.tar.gz" }
9+
10+
[[components.SymCrypt.source-files]]
11+
filename = "jitterentropy-library-3.3.1.tar.gz"
12+
hash = "4a50cb02b4836cd5550016e2fc2263e6982abaa11467a9e1cea260c1c2f7d487"
13+
hash-type = "SHA256"
14+
origin = { type = "download", uri = "https://github.com/smuellerDD/jitterentropy-library/archive/v3.3.1.tar.gz" }

‎base/comps/SymCrypt/SymCrypt.spec‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# Standard debuginfo generation breaks the FIPS self-test, so we disable it.
2+
%define debug_package %{nil}
3+
Summary: A core cryptographic library written by Microsoft
4+
Name: SymCrypt
5+
Version: 103.11.0
6+
Release: %autorelease
7+
License: MIT
8+
Vendor: Microsoft Corporation
9+
Distribution: Azure Linux
10+
Group: System/Libraries
11+
URL: https://github.com/microsoft/SymCrypt
12+
Source0: https://github.com/microsoft/SymCrypt/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
13+
Source1: https://github.com/smuellerDD/jitterentropy-library/archive/v3.3.1.tar.gz#/jitterentropy-library-3.3.1.tar.gz
14+
# Use ./generate-env-file.sh --release-tag <git-version-tag> to generate this. For example:
15+
# ./generate-env-file.sh --release-tag v103.5.1
16+
Source3: symcrypt-build-environment-variables-v%{version}.sh
17+
BuildRequires: cmake
18+
%ifarch aarch64
19+
BuildRequires: clang >= 12.0.1-4
20+
%endif
21+
BuildRequires: gcc
22+
BuildRequires: gcc-c++
23+
BuildRequires: libatomic
24+
BuildRequires: make
25+
BuildRequires: python3
26+
BuildRequires: python3-pyelftools
27+
28+
%description
29+
A core cryptographic library written by Microsoft
30+
31+
# Only x86_64 and aarch64 are currently supported
32+
%ifarch x86_64
33+
%define symcrypt_arch AMD64
34+
%define symcrypt_cc gcc
35+
%define symcrypt_c_flags "-Wno-maybe-uninitialized"
36+
%define symcrypt_cxx g++
37+
%endif
38+
39+
40+
%ifarch aarch64
41+
%define symcrypt_arch ARM64
42+
# Currently SymCrypt ARM64 build requires use of clang
43+
%define symcrypt_cc clang
44+
%define symcrypt_c_flags "-mno-outline-atomics -Wno-conditional-uninitialized"
45+
%define symcrypt_cxx clang++
46+
%endif
47+
48+
%prep
49+
%autosetup -a 1 -p1
50+
# SymCrypt's tagged tarballs have jitterentropy as an empty directory, so we
51+
# create a symbolic link as if jitterentropy-library has been pulled in as git submodule
52+
rm -rf 3rdparty/jitterentropy-library
53+
ln -s ../jitterentropy-library-3.3.1 3rdparty/jitterentropy-library
54+
55+
%build
56+
# CHANGE FROM 3.0: REMOVE -z pack-relative-relocs
57+
# AZL4's default LDFLAGS include -Wl,-z,pack-relative-relocs, which makes the
58+
# linker emit R_X86_64_RELATIVE entries in DT_RELR format instead of SHT_RELA.
59+
# SymCrypt's FIPS post-processor (process_fips_module.py) only walks SHT_RELA,
60+
# so RELR-packed relocations are not zeroed before the integrity HMAC is
61+
# computed. The dynamic loader still applies them at load time, so in-memory
62+
# bytes diverge from the hashed bytes and the FIPS self-test fails. Combined
63+
# with -z now, the failure surfaces as a SIGSEGV the instant libsymcrypt.so
64+
# is mapped (e.g. any LD_PRELOAD or DT_NEEDED user crashes immediately).
65+
# Remove until process_fips_module.py learns about DT_RELR.
66+
export LDFLAGS="${LDFLAGS//-Wl,-z,pack-relative-relocs/}"
67+
68+
source %{SOURCE3}
69+
70+
%cmake \
71+
-DSYMCRYPT_TARGET_ARCH=%{symcrypt_arch} \
72+
-DCMAKE_BUILD_TYPE=Release \
73+
-DCMAKE_C_COMPILER=%{symcrypt_cc} \
74+
-DCMAKE_CXX_COMPILER=%{symcrypt_cxx} \
75+
-DCMAKE_C_FLAGS="%{symcrypt_c_flags}" \
76+
-DCMAKE_CXX_FLAGS="-Wno-unused-but-set-variable"
77+
78+
%cmake_build
79+
80+
%install
81+
mkdir -p %{buildroot}%{_libdir}
82+
mkdir -p %{buildroot}%{_includedir}
83+
install inc/symcrypt* %{buildroot}%{_includedir}
84+
# Use cp -P to preserve symbolic links
85+
cp -P %{__cmake_builddir}/module/generic/libsymcrypt.so* %{buildroot}%{_libdir}
86+
chmod 755 %{buildroot}%{_libdir}/libsymcrypt.so.%{version}
87+
88+
%check
89+
./%{__cmake_builddir}/exe/symcryptunittest
90+
91+
%files
92+
%license LICENSE.txt
93+
%license NOTICE.txt
94+
%{_libdir}/libsymcrypt.so*
95+
%{_includedir}/*
96+
97+
%changelog
98+
%autochangelog

‎base/comps/SymCrypt/changelog‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
* Fri Jan 31 2025 Tobias Brick <tobiasb@microsoft.com> - 103.8.0-1
2+
- Add FIPS approved services indicator
3+
- Add ML-DSA implementation
4+
5+
* Mon Nov 25 2024 Tobias Brick <tobiasb@microsoft.com> - 103.6.0-1
6+
- Upgrde to 103.6.0
7+
8+
* Mon Oct 21 2024 Tobias Brick <tobiasb@microsoft.com> - 103.5.1-1
9+
- Update 103.5.1
10+
11+
* Mon Oct 14 2024 Tobias Brick <tobiasb@microsoft.com> - 103.4.2-2
12+
- Add debuginfo package
13+
14+
* Wed Jun 26 2024 Maxwell Moyer-McKee <mamckee@microsoft.com> - 103.4.2-1
15+
- Update SymCrypt to v103.4.2 for FIPS certification
16+
17+
* Thu Apr 25 2024 Maxwell Moyer-McKee <mamckee@microsoft.com> - 103.4.1-2
18+
- Disable outline atomics in aarch64 builds
19+
20+
* Thu Dec 28 2023 Maxwell Moyer-McKee <mamckee@microsoft.com> - 103.4.1-1
21+
- Update SymCrypt to v103.4.1 for SymCrypt-OpenSSL provider.
22+
23+
* Mon May 22 2023 Samuel Lee <saml@microsoft.com> - 103.0.1-1
24+
- Update SymCrypt to v103.0.1 for FIPS certification. Run unit tests in check
25+
26+
* Fri Oct 07 2022 Andy Caldwell <andycaldwell@microsoft.com> - 102.0.0-2
27+
- Update `clang` on aarch64 builds to enable `-pie`
28+
29+
* Mon Jun 06 2022 Samuel Lee <saml@microsoft.com> - 102.0.0-1
30+
- Update SymCrypt to v102.0.0 to improve performance of FIPS self-tests
31+
32+
* Tue Apr 05 2022 Cameron Baird <cameronbaird@microsoft.com> - 101.2.0-2
33+
- BuildRequires clang in aarch64 builds
34+
35+
* Tue Mar 29 2022 Samuel Lee <saml@microsoft.com> - 101.2.0-1
36+
- Update SymCrypt to v101.2.0 to include FIPS self-tests, certifiable AES-GCM, and fix aarch64 build
37+
38+
* Mon Feb 14 2022 Samuel Lee <saml@microsoft.com> - 101.0.0-1
39+
- Original version for CBL-Mariner
40+
- Verified license

‎base/comps/SymCrypt/generate-env-file.sh‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
#!/bin/bash
2+
3+
# Fail out if anything fails.
4+
set -e
5+
6+
SYMCRYPT_REPO='https://github.com/microsoft/SymCrypt.git'
7+
SYMCRYPT_DIR='./SymCrypt'
8+
9+
CURRENT_DIR=$(pwd)
10+
RELEASE_TAG=
11+
12+
function show_help() {
13+
echo "Usage: $0 [--release-tag <tag>]"
14+
echo
15+
echo "Options:"
16+
echo " --release-tag <tag> The release tag to use for the build, e.g.: v103.5.1"
17+
echo " --debug Enable debug output, which is just 'set -x'"
18+
echo " --help Display this help message"
19+
echo
20+
echo "Generates a sourceable script file that sets git-related environment variables for the SymCrypt build."
21+
echo "The script file will be named 'symcrypt-build-environment-variables-<release-tag>.sh"
22+
}
23+
24+
while [[ "$#" -gt 0 ]]; do
25+
case $1 in
26+
-h|--help)
27+
show_help
28+
exit 0
29+
;;
30+
-t|--tag|--release-tag)
31+
RELEASE_TAG="$2"
32+
shift
33+
;;
34+
-d|--debug)
35+
set -x
36+
;;
37+
*)
38+
echo "Unknown parameter passed: $1"
39+
exit 1
40+
;;
41+
esac
42+
shift
43+
done
44+
45+
if [ -z "${RELEASE_TAG}" ]; then
46+
echo "release tag is required" >> /dev/stderr
47+
show_help
48+
exit 1
49+
fi
50+
51+
echo "generating env file for release tag: '${RELEASE_TAG}'"
52+
53+
# Create a temporary directory to clone the git repo
54+
TEMP_DIR=$(mktemp -d)
55+
if [[ ! "$TEMP_DIR" || ! -d "$TEMP_DIR" ]]; then
56+
echo "Could not create temp dir to clone git repo" >> /dev/stderr
57+
exit 1
58+
fi
59+
60+
# Clone into the temp directory
61+
pushd "${TEMP_DIR}" > /dev/null
62+
echo "Cloning SymCrypt repo '${SYMCRYPT_REPO}' into temp directory '${TEMP_DIR}"
63+
git clone "${SYMCRYPT_REPO}"
64+
65+
# The version script uses the current git branch, which want to main but at the commit for the release tag.
66+
echo "Getting to the commit for release tag '${RELEASE_TAG}'"
67+
cd "${SYMCRYPT_DIR}"
68+
TAG_COMMIT=$(git rev-parse --verify "${RELEASE_TAG}")
69+
if [[ ! "$TAG_COMMIT" ]]; then
70+
echo "Could not find commit for release tag '${RELEASE_TAG}'"
71+
exit 1
72+
fi
73+
echo "Tag commit is '${TAG_COMMIT}'"
74+
git reset --hard "${TAG_COMMIT}"
75+
76+
# Call the version script to get the properly formmatted git info
77+
ENV_SCRIPT_FILE_NAME="symcrypt-build-environment-variables-${RELEASE_TAG}.sh"
78+
echo "#!/bin/bash" > "${CURRENT_DIR}/${ENV_SCRIPT_FILE_NAME}"
79+
echo "# Generated by 'generate-env-file.sh'" >> "${CURRENT_DIR}/${ENV_SCRIPT_FILE_NAME}"
80+
echo "Running version script"
81+
python3 scripts/version.py --no-print-version-number --commit-info >> "${CURRENT_DIR}/${ENV_SCRIPT_FILE_NAME}"
82+
echo "Generated '${ENV_SCRIPT_FILE_NAME}'"
83+
84+
# Clean up the temp directory
85+
popd > /dev/null
86+
rm -rf "${TEMP_DIR}"

‎base/comps/SymCrypt/symcrypt-build-environment-variables-v103.11.0.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/bash
2+
# Generated by 'generate-env-file.sh'
3+
export SYMCRYPT_BRANCH=main
4+
export SYMCRYPT_COMMIT_HASH=748c20f
5+
export SYMCRYPT_COMMIT_TIMESTAMP=2026-03-27T23:56:29+00:00

‎base/comps/components-publish-channels.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2415,6 +2415,7 @@ components = [
24152415
"SuperLU",
24162416
"swig",
24172417
"swtpm",
2418+
"SymCrypt",
24182419
"symlinks",
24192420
"sympy",
24202421
"synce4l",

‎locks/SymCrypt.lock‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Managed by azldev component update. Do not edit manually.
2+
version = 1
3+
input-fingerprint = 'sha256:32ad2115a3c83ac7eb32acacc792c6c86386614d81677559bbec6b55b09b64a0'

0 commit comments

Comments
 (0)