Skip to content

feat: [SVLS-6242] bottlecap fips builds #644

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
May 6, 2025

Conversation

apiarian-datadog
Copy link
Contributor

@apiarian-datadog apiarian-datadog commented Apr 10, 2025

Building bottlecap with fips mode.

This is entirely focused on removing ring (and other non-FIPS-compliant dependencies from our fips-featured builds.)

@apiarian-datadog
Copy link
Contributor Author

This does not yet work for alpine, unfortunately. We're seeing errors similar to aws/aws-lc-rs#762 so maybe this is not just us.

@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch from e6f60f4 to d6522d9 Compare April 10, 2025 20:52
@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch 8 times, most recently from aeca829 to 1e97cd9 Compare April 15, 2025 15:06
@apiarian-datadog apiarian-datadog marked this pull request as ready for review April 16, 2025 14:38
@apiarian-datadog apiarian-datadog requested a review from a team as a code owner April 16, 2025 14:38

[features]
default = ["reqwest/rustls-tls", "dogstatsd/default"]
fips = [
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unfortunately, as written, the default feature is incompatible with the fips feature. so in order to build the fips feature correctly we have to disable the default feature. this is fine for normal builds where we don't care about fips, but it means that when building or checking the fips feature we have to remember to say --no-default-features in addition to --features=fips. our build scripts take care of this, but maybe there's a better way to do this?

@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch 4 times, most recently from f1b2982 to 5496e2b Compare April 16, 2025 17:21
@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch from 25a6976 to eea5a5b Compare April 17, 2025 14:34
@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch 2 times, most recently from f6c439d to a37ca6e Compare April 24, 2025 18:54
@apiarian-datadog apiarian-datadog changed the title chore: our upstream dependencies use the fips flag feat: [SVLS-6242] bottlecap fips builds Apr 24, 2025
@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch 5 times, most recently from 73c8b7e to 323f346 Compare April 29, 2025 14:41
Copy link
Contributor

@duncanista duncanista left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM – left a couple nits, but overall amazing job with this

@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch from 16f91e8 to d561651 Compare May 5, 2025 15:11
@apiarian-datadog apiarian-datadog force-pushed the aleksandr.pasechnik/svls-6242-bottlecap-fips branch from d561651 to 57a6119 Compare May 5, 2025 19:56
@apiarian-datadog apiarian-datadog merged commit f1a0193 into main May 6, 2025
45 checks passed
@apiarian-datadog apiarian-datadog deleted the aleksandr.pasechnik/svls-6242-bottlecap-fips branch May 6, 2025 15:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants