From af04580f2b844d4896a2eb0c3a0f8565de233125 Mon Sep 17 00:00:00 2001 From: Gabor Gyimesi Date: Mon, 27 Jul 2026 17:18:42 +0200 Subject: [PATCH] MINIFICPP-2871 Create conanfile for openssl-fips target --- cmake/GetOpenSSL.cmake | 50 ++++++++++++++- conanfile.py | 1 + thirdparty/openssl-fips/all/conandata.yml | 19 ++++++ thirdparty/openssl-fips/all/conanfile.py | 75 +++++++++++++++++++++++ thirdparty/openssl-fips/config.yml | 18 ++++++ 5 files changed, 162 insertions(+), 1 deletion(-) create mode 100644 thirdparty/openssl-fips/all/conandata.yml create mode 100644 thirdparty/openssl-fips/all/conanfile.py create mode 100644 thirdparty/openssl-fips/config.yml diff --git a/cmake/GetOpenSSL.cmake b/cmake/GetOpenSSL.cmake index f1a40ccf4f..b8fed72d8c 100644 --- a/cmake/GetOpenSSL.cmake +++ b/cmake/GetOpenSSL.cmake @@ -23,7 +23,55 @@ if(MINIFI_OPENSSL_SOURCE STREQUAL "CONAN") set(OPENSSL_BIN_DIR "${openssl_PACKAGE_FOLDER_RELEASE}" CACHE STRING "" FORCE) - include(BundledOpenSSLFips) + find_package(openssl-fips REQUIRED) + set(OPENSSL_FIPS_BIN_DIR "${openssl-fips_PACKAGE_FOLDER_RELEASE}" CACHE STRING "" FORCE) + + if(APPLE OR WIN32 OR CMAKE_SIZEOF_VOID_P EQUAL 4 OR CMAKE_SYSTEM_PROCESSOR MATCHES "(arm64)|(ARM64)|(aarch64)|(armv8)") + set(LIBDIR "lib") + else() + set(LIBDIR "lib64") + endif() + + if (WIN32) + set(BYPRODUCT_DYN_SUFFIX ".dll" CACHE STRING "" FORCE) + elseif(APPLE) + set(BYPRODUCT_DYN_SUFFIX ".dylib" CACHE STRING "" FORCE) + else() + set(BYPRODUCT_DYN_SUFFIX ".so" CACHE STRING "" FORCE) + endif() + + if (WIN32) + set(EXECUTABLE_SUFFIX ".exe" CACHE STRING "" FORCE) + else() + set(EXECUTABLE_SUFFIX "" CACHE STRING "" FORCE) + endif() + + set(FIPS_BYPRODUCTS "${LIBDIR}/ossl-modules/fips${BYPRODUCT_DYN_SUFFIX}") + + FOREACH(BYPRODUCT ${FIPS_BYPRODUCTS}) + LIST(APPEND OPENSSL_FIPS_FILE_LIST "${OPENSSL_FIPS_BIN_DIR}/${BYPRODUCT}") + ENDFOREACH(BYPRODUCT) + + if (MINIFI_PACKAGING_TYPE STREQUAL "RPM") + install(FILES ${OPENSSL_FIPS_FILE_LIST} + DESTINATION ${CMAKE_INSTALL_LIBDIR}/${PROJECT_NAME}/fips + COMPONENT bin) + + install(FILES "${OPENSSL_BIN_DIR}/bin/openssl${EXECUTABLE_SUFFIX}" + DESTINATION ${CMAKE_INSTALL_LIBDIR}/${PROJECT_NAME}/fips + COMPONENT bin + PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_EXECUTE GROUP_READ WORLD_READ WORLD_EXECUTE) + + elseif (MINIFI_PACKAGING_TYPE STREQUAL "TGZ") + install(FILES ${OPENSSL_FIPS_FILE_LIST} + DESTINATION fips + COMPONENT bin) + + install(FILES "${OPENSSL_BIN_DIR}/bin/openssl${EXECUTABLE_SUFFIX}" + DESTINATION fips + COMPONENT bin + PERMISSIONS OWNER_EXECUTE OWNER_WRITE OWNER_READ GROUP_EXECUTE GROUP_READ WORLD_READ WORLD_EXECUTE) + endif() elseif(MINIFI_OPENSSL_SOURCE STREQUAL "BUILD") message("Using CMake to build OpenSSL from source") diff --git a/conanfile.py b/conanfile.py index f4f0f69ac2..41dacc9c6b 100644 --- a/conanfile.py +++ b/conanfile.py @@ -59,6 +59,7 @@ def requirements(self): self.requires("lz4/1.10.0", force=True) self.requires("libcurl/8.20.0", force=True) self.requires("openssl/3.6.2", force=True) + self.requires("openssl-fips/3.1.2@minifi/develop") self.requires("zlib/1.3.2", force=True) self.requires("nlohmann_json/3.12.0", force=True) if self.settings.os != "Windows": diff --git a/thirdparty/openssl-fips/all/conandata.yml b/thirdparty/openssl-fips/all/conandata.yml new file mode 100644 index 0000000000..6264348d61 --- /dev/null +++ b/thirdparty/openssl-fips/all/conandata.yml @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +sources: + "3.1.2": + url: "https://github.com/openssl/openssl/releases/download/openssl-3.1.2/openssl-3.1.2.tar.gz" + sha256: "a0ce69b8b97ea6a35b96875235aa453b966ba3cba8af2de23657d8b6767d6539" diff --git a/thirdparty/openssl-fips/all/conanfile.py b/thirdparty/openssl-fips/all/conanfile.py new file mode 100644 index 0000000000..e3f96ec3e1 --- /dev/null +++ b/thirdparty/openssl-fips/all/conanfile.py @@ -0,0 +1,75 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +import os + +from conan import ConanFile +from conan.tools.build import build_jobs +from conan.tools.files import copy, get +from conan.tools.layout import basic_layout +from conan.tools.microsoft import is_msvc, VCVars + +required_conan_version = ">=2.0" + + +class OpenSSLFipsConan(ConanFile): + name = "openssl-fips" + description = "OpenSSL FIPS provider module (fips.so / fips.dll) built from FIPS-validated OpenSSL sources" + license = "Apache-2.0" + homepage = "https://github.com/openssl/openssl" + topics = ("openssl", "fips", "ssl", "tls", "encryption", "security") + package_type = "shared-library" + settings = "os", "arch", "compiler", "build_type" + + def layout(self): + basic_layout(self, src_folder="src") + self.folders.build = self.folders.source + + def source(self): + get(self, **self.conan_data["sources"][self.version], strip_root=True) + + def generate(self): + if is_msvc(self): + VCVars(self).generate() + + @property + def _configure_flags(self): + return [ + "no-tests", + "no-capieng", + "no-legacy", + "no-ssl", + "no-engine", + "enable-fips", + ] + + def build(self): + flags = " ".join(self._configure_flags) + prefix_args = f'"--prefix={self.package_folder}" "--openssldir={self.package_folder}"' + if is_msvc(self): + self.run(f"perl Configure {flags} {prefix_args}", cwd=self.source_folder) + self.run("nmake", cwd=self.source_folder) + else: + self.run(f'./Configure "CFLAGS=-fPIC" "CXXFLAGS=-fPIC" {flags} {prefix_args}', cwd=self.source_folder) + self.run(f"make -j{build_jobs(self)}", cwd=self.source_folder) + + def package(self): + copy(self, "LICENSE.txt", src=self.source_folder, dst=os.path.join(self.package_folder, "licenses")) + self.run("nmake install_fips" if is_msvc(self) else "make install_fips", cwd=self.source_folder) + + def package_info(self): + self.cpp_info.libs = [] + self.cpp_info.includedirs = [] + self.cpp_info.set_property("cmake_file_name", "openssl-fips") diff --git a/thirdparty/openssl-fips/config.yml b/thirdparty/openssl-fips/config.yml new file mode 100644 index 0000000000..50e15be45f --- /dev/null +++ b/thirdparty/openssl-fips/config.yml @@ -0,0 +1,18 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +versions: + "3.1.2": + folder: all