diff --git a/dockerfile_alpine_cryptowheel.txt b/dockerfile_alpine_cryptowheel.txt new file mode 100644 index 000000000..70f6074b3 --- /dev/null +++ b/dockerfile_alpine_cryptowheel.txt @@ -0,0 +1,93 @@ +FROM alpine:3.19 + +RUN apk add python3 py3-pip + +#### OPENSSL STUFF #### + +ARG OPENSSL_VERSION=3.0.8 + +# Make the fips module using FIPS-approved openssl 3.0.8 +RUN apk add --no-cache --virtual .build-deps \ + make gcc libgcc musl-dev linux-headers perl vim \ + && wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz \ + && tar -xf openssl-${OPENSSL_VERSION}.tar.gz\ + && cd openssl-${OPENSSL_VERSION} \ + && ./Configure enable-fips --libdir=lib --prefix=/usr/local --openssldir=/usr/local/ssl \ + && make \ + && make install \ + && make install_fips + # && apk del .build-deps \ + # && rm -rf openssl-${OPENSSL_VERSION}.tar.gz openssl-${OPENSSL_VERSION} + + + +# Add openssl to the path +ENV PATH="${PATH}:/usr/local/bin" + +# As per documentation, tests have to be run on every machine that uses +# openssl in FIPS mode +WORKDIR "/openssl-3.0.8" +RUN make tests + +# TODO NOTE that we are running tests against /openssl-3.0.8 and not +# against /usr/local/bin. Something is wrong with /usr/local/bin still! + +# TODO why does this say "/etc/ssl" and not "/usr/local/ssl"? +RUN echo "GET THE CONF DIRECTORY HERE" +RUN openssl version -d + + + +# See https://www.openssl.org/docs/manmaster/man7/fips_module.html +RUN echo -e '\ +config_diagnostics = 1\n\ +openssl_conf = openssl_init\n\ +\n\ +.include /usr/local/ssl/fipsmodule.cnf\n\ +\n\ +[openssl_init]\n\ +providers = provider_sect\n\ +alg_section = algorithm_sect\n\ +\n\ +[provider_sect]\n\ +fips = fips_sect\n\ +default = default_sect\n\ +\n\ +[default_sect]\n\ +activate = 1\n\ +\n\ +[algorithm_sect]\n\ +default_properties = fips=yes'\ +>> /usr/local/ssl/openssl.cnf + +# Just to look at what you think you wrote +# RUN cat /usr/local/ssl/openssl.cnf + + +# This tells us what versions of openssl we have and if any are FIPs providers +RUN echo "looking /openssl-3.0.8" +WORKDIR "/openssl-3.0.8" +RUN ls -l +RUN ./util/wrap.pl -fips apps/openssl list -provider-path providers -provider fips -providers + + +RUN set -e +WORKDIR "/" + +# Have to do --break-system-packages to avoid need for virtual env +# RUN virtualenv env +# RUN . env/bin/activate +RUN pip3 install -U setuptools --break-system-packages +RUN pip3 install -U wheel --break-system-packages +WORKDIR "/openssl-${OPENSSL_VERSION}" +RUN ./config no-shared no-ssl2 no-ssl3 -fPIC --prefix=/openssl-3.0.8/openssl +RUN make && make install +WORKDIR "/" +ARG OPENSSL_DIR="/openssl-3.0.8/openssl" +RUN pip wheel --no-cache-dir --no-binary cryptography cryptography + +# Fails missing some functions, one of which specifically references md. +# Documention at cryptography.io on how to build the wheel specifically says +# to use a non-fips compliant version of openssl to build with, so the guess +# is that fips-compliant openssl makes certain functions unavailable and makes +# the cryptography build blow up.