(PE-37599) Openssl-1.1.1-fips fix for client-tools-runtime-2021.7.x project for Redhatfips

[imaqsood]

Description

While constructing the client-tool-runtime-2021.7.x for Redhatfips-9-x86_64, we encountered a challenge related to OpenSSL. Specifically, we encountered an error message indicating "Unable to find a match: openssl-1.1.1k". Upon investigation, it became apparent that Redhat9 is equipped with OpenSSL 3.0.1 as its default version, rendering OpenSSL 1.1.1k unavailable for Redhat9.

The curl and ca-bundle components rely on OpenSSL, specified using build_require, which installs openssl-1.1.1k for Redhatfips. However, it neglects to utilize the openssl-1.1.1-fips component.

However, our preferred option should be openssl-1.1.1-fips instead of openssl-1.1.1k, as we are applying FIPS-related patches to openssl-1.1.1-fips. It's worth noting that openssl-1.1.1k is a CentOS package without FIPS patches.

Testing Done

redhatfips-7-x86_64
redhatfips-8-x86_64
redhatfips-9-x86_64

[joshcooper]

I see what's going on now. I think we should use continue using openssl 1.1.1k, so change this:

elsif platform.name =~ /^redhatfips-[89]/
  proj.setting(:openssl_version, '1.1.1k')

You also need to do the following below on line 114, so that we build our openssl-1.1.1k component:

elsif (platform.name =~ /^redhatfips-[89]/ && proj.openssl_version == '1.1.1k'
  proj.component "openssl-1.1.1-fips"

For example see how the agent does the same:

puppet-runtime/configs/projects/_shared-agent-components.rb

Lines 26 to 27 in 096e683

	elsif platform.name =~ /^redhatfips-.*/
	proj.component "openssl-1.1.1-fips"

[imaqsood]

I see what's going on now. I think we should use continue using openssl 1.1.1k, so change this:

elsif platform.name =~ /^redhatfips-[89]/
  proj.setting(:openssl_version, '1.1.1k')

You also need to do the following below on line 114, so that we build our openssl-1.1.1k component:

elsif (platform.name =~ /^redhatfips-[89]/ && proj.openssl_version == '1.1.1k'
  proj.component "openssl-1.1.1-fips"

For example see how the agent does the same:

puppet-runtime/configs/projects/_shared-agent-components.rb

Lines 26 to 27 in 096e683

	elsif platform.name =~ /^redhatfips-.*/
	proj.component "openssl-1.1.1-fips"

I tested this PR with OpenSSL 1.1.1k before, but we couldn't install it during the build. The error said it couldn't find a match. I also tried with OpenSSL-1.1.1, but got the same error.

Error: Unable to find a match: openssl-1.1.1k

[joshcooper]

@imaqsood could you describe what behavior changed and why this change was made? Specifically, why did proj.setting(:openssl_version, '1.1.1k') cause the client tools runtime to fail on RHEL FIPS 9 and what happens now?

[joshcooper]

For posterity, this changes RHELFIPS 8 and 9:

$ bundle exec rake vanagon:component_diff -- -P client-tools-runtime-2021.7.x -p all --from upstream/master --to HEAD 
...
Here is what your code changes would affect:

Project client-tools-runtime-2021.7.x

Platform name: redhatfips-8-x86_64
    Component 'curl'
        Field: build_requires[0]
        --------------------
        - openssl-1.1.1k
        + openssl-1.1.1-fips


    Component 'puppet-ca-bundle'
        Field: build_requires[0]
        --------------------
        - openssl-1.1.1k
        + openssl-1.1.1-fips


Platform name: redhatfips-9-x86_64
    Component 'openssl-1.1.1' was removed, not showing diff for it

    Component 'openssl-1.1.1-fips' was newly added, not showing diff for it

    Component 'curl'
        Field: build_requires[0]
        --------------------
        - openssl-1.1.1
        + openssl-1.1.1-fips


    Component 'puppet-ca-bundle'
        Field: build_requires[0]
        --------------------
        - openssl-1.1.1
        + openssl-1.1.1-fips

[joshcooper]

can you update the We need to explicitly define 1.1.1k here comment above?

[joshcooper]

It looks like configs/projects/pe-installer-runtime-2021.7.x.rb has the same problem, but since we don't support RHEL9 FIPS primary servers yet, then it's not an issue we need to solve right now. But perhaps file a JIRA ticket so we remember to fix it later?

$ git grep 1.1.1k configs/projects/
configs/projects/_shared-client-tools-runtime.rb:# We need to explicitly define 1.1.1k here to avoid
configs/projects/pe-installer-runtime-2021.7.x.rb:  # We need to explicitly define 1.1.1k here to avoid
configs/projects/pe-installer-runtime-2021.7.x.rb:    proj.setting(:openssl_version, '1.1.1k')