add cryptography wheel effort

dockerfile_alpine_cryptowheel.txt

@@ -0,0 +1,93 @@
+FROM alpine:3.19
+
+RUN apk add python3 py3-pip
+
+#### OPENSSL STUFF ####
+
+ARG OPENSSL_VERSION=3.0.8
+
+# Make the fips module using FIPS-approved openssl 3.0.8
+RUN apk add --no-cache --virtual .build-deps \
+   make gcc libgcc musl-dev linux-headers perl vim \
+   &&  wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \
+   && tar -xf openssl-${OPENSSL_VERSION}.tar.gz\
+   && cd openssl-${OPENSSL_VERSION} \
+   && ./Configure enable-fips --libdir=lib --prefix=/usr/local --openssldir=/usr/local/ssl \
+   && make \
+   && make install \
+   && make install_fips
+   # && apk del .build-deps \
+   # && rm -rf openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION}
+
+
+
+# Add openssl to the path
+ENV PATH="${PATH}:/usr/local/bin"
+
+# As per documentation, tests have to be run on every machine that uses
+# openssl in FIPS mode
+WORKDIR "/openssl-3.0.8"
+RUN make tests
+
+# TODO NOTE that we are running tests against /openssl-3.0.8 and not
+# against /usr/local/bin.  Something is wrong with /usr/local/bin still!
+
+# TODO why does this say "/etc/ssl" and not "/usr/local/ssl"?
+RUN echo "GET THE CONF DIRECTORY HERE"
+RUN openssl version -d
+
+
+
+# See https://www.openssl.org/docs/manmaster/man7/fips_module.html
+RUN echo -e '\
+config_diagnostics = 1\n\
+openssl_conf = openssl_init\n\
+\n\
+.include /usr/local/ssl/fipsmodule.cnf\n\
+\n\
+[openssl_init]\n\
+providers = provider_sect\n\
+alg_section = algorithm_sect\n\
+\n\
+[provider_sect]\n\
+fips = fips_sect\n\
+default = default_sect\n\
+\n\
+[default_sect]\n\
+activate = 1\n\
+\n\
+[algorithm_sect]\n\
+default_properties = fips=yes'\
+>> /usr/local/ssl/openssl.cnf
+
+# Just to look at what you think you wrote
+# RUN cat /usr/local/ssl/openssl.cnf
+
+
+# This tells us what versions of openssl we have and if any are FIPs providers
+RUN echo "looking /openssl-3.0.8"
+WORKDIR "/openssl-3.0.8"
+RUN ls -l
+RUN ./util/wrap.pl -fips apps/openssl list -provider-path providers -provider fips -providers
+
+
+RUN set -e
+WORKDIR "/"
+
+# Have to do --break-system-packages to avoid need for virtual env
+# RUN virtualenv env
+# RUN . env/bin/activate
+RUN pip3 install -U setuptools  --break-system-packages
+RUN pip3 install -U wheel --break-system-packages
+WORKDIR "/openssl-${OPENSSL_VERSION}"
+RUN ./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=/openssl-3.0.8/openssl
+RUN make && make install
+WORKDIR "/"
+ARG OPENSSL_DIR="/openssl-3.0.8/openssl"
+RUN pip wheel --no-cache-dir --no-binary cryptography cryptography
+
+# Fails missing some functions, one of which specifically references md.
+# Documention at cryptography.io on how to build the wheel specifically says
+# to use a non-fips compliant version of openssl to build with, so the guess
+# is that fips-compliant openssl makes certain functions unavailable and makes
+# the cryptography build blow up.