Update logic in FipsBuildParams.isInFipsApprovedOnlyMode to check for env param instead of org.bouncycastle.fips.approved_only (#21366)

Signed-off-by: Craig Perkins <cwperx@amazon.com>

Author: cwperks

buildSrc/src/main/java/org/opensearch/gradle/info/FipsBuildParams.java

@@ -9,6 +9,7 @@
 package org.opensearch.gradle.info;
 
 import java.util.function.Function;
+import java.util.function.Supplier;
 
 public class FipsBuildParams {
 
@@ -18,6 +19,7 @@ public class FipsBuildParams {
     public static final String DEFAULT_FIPS_MODE = "FIPS-140-3";
 
     private static String fipsMode;
+    static Supplier<String> fipsModeEnvSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
 
     public static void init(Function<String, Object> fipsValue) {
         var fipsBuildParamForTests = Boolean.parseBoolean((String) fipsValue.apply(FIPS_BUILD_PARAM_FOR_TESTS));
@@ -37,7 +39,7 @@ public static boolean isInFipsMode() {
     }
 
     public static boolean isInFipsApprovedOnlyMode() {
-        return isInFipsMode() && "true".equals(System.getProperty("org.bouncycastle.fips.approved_only"));
+        return isInFipsMode() && "true".equalsIgnoreCase(fipsModeEnvSupplier.get());
     }
 
     public static String getFipsMode() {

buildSrc/src/test/java/org/opensearch/gradle/info/FipsBuildParamsTests.java

@@ -14,6 +14,30 @@
 
 public class FipsBuildParamsTests extends GradleUnitTestCase {
 
+    public void testIsInFipsApprovedOnlyMode() {
+        FipsBuildParams.init(cryptoEntryFnWithStringParam);
+
+        FipsBuildParams.fipsModeEnvSupplier = () -> "true";
+        assertTrue(FipsBuildParams.isInFipsApprovedOnlyMode());
+
+        FipsBuildParams.fipsModeEnvSupplier = () -> "TRUE";
+        assertTrue(FipsBuildParams.isInFipsApprovedOnlyMode());
+
+        FipsBuildParams.fipsModeEnvSupplier = () -> "false";
+        assertFalse(FipsBuildParams.isInFipsApprovedOnlyMode());
+
+        FipsBuildParams.fipsModeEnvSupplier = () -> null;
+        assertFalse(FipsBuildParams.isInFipsApprovedOnlyMode());
+
+        // Not in FIPS mode — should always be false regardless of env var
+        FipsBuildParams.init(param -> null);
+        FipsBuildParams.fipsModeEnvSupplier = () -> "true";
+        assertFalse(FipsBuildParams.isInFipsApprovedOnlyMode());
+
+        // Reset
+        FipsBuildParams.fipsModeEnvSupplier = () -> System.getenv("OPENSEARCH_FIPS_MODE");
+    }
+
     public void testIsInFipsMode() {
         FipsBuildParams.init(cryptoEntryFnWithStringParam);
         assertTrue(FipsBuildParams.isInFipsMode());