tools/nix/openssl-fips.nix - main - githubmirror/node

tools/nix/openssl-fips.nix

57 строк2 KB

Filip Skokan

tools: add an OpenSSL FIPS build to test-shared.yml

05 авг 2026, 18:38

05 авг 2026, 18:38dc7838c

{
  openssl ? (import ./openssl-matrix.nix { }).openssl,
}:

openssl.overrideAttrs (oldAttrs: {
  pname = "openssl-fips";

  doCheck = false;
  configureFlags = (oldAttrs.configureFlags or [ ]) ++ [
    "no-docs"
    "no-tests"
    "enable-fips"
  ];
  outputs = [
    "bin"
    "out"
    "dev"
  ];

  # Nix strips the provider after installation, invalidating the module MAC
  # generated by OpenSSL's install_fips target. Regenerate and verify it in
  # postFixup, after stripping has finished modifying the provider.
  postFixup = (oldAttrs.postFixup or "") + ''
    opensslConfig="$out/etc/ssl/openssl.cnf"
    fipsModule="$out/lib/ossl-modules/fips${openssl.stdenv.hostPlatform.extensions.sharedLibrary}"
    fipsConfig="$out/etc/ssl/fipsmodule.cnf"

    substituteInPlace "$opensslConfig" \
      --replace-fail 'openssl_conf = openssl_init' $'openssl_conf = openssl_init\nnodejs_conf = openssl_init' \
      --replace-fail '# .include fipsmodule.cnf' ".include $fipsConfig" \
      --replace-fail 'providers = provider_sect' $'providers = provider_sect\nalg_section = algorithm_sect' \
      --replace-fail '# fips = fips_sect' 'fips = fips_sect' \
      --replace-fail '# activate = 1' $'activate = 1\n\n[algorithm_sect]\ndefault_properties = fips=yes'

    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
      -module "$fipsModule" \
      -out "$fipsConfig"

    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
      -config "$opensslConfig"
  '';

  doInstallCheck = true;
  installCheckPhase = ''
    runHook preInstallCheck

    export PATH="$bin/bin:$PATH"

    openssl mac \
      -digest SHA256 -macopt key:key HMAC </dev/null >/dev/null
    openssl md5 </dev/null >/dev/null 2>&1 \
    && echo "MD5 unexpectedly available with FIPS properties enabled" >&2 \
    && exit 1

    runHook postInstallCheck
  '';
})