feat: add fips option for aws-lc (#20287)

risingwavelabs · Feb 20, 2025 · cee2d2d · cee2d2d
1 parent c632835
commit cee2d2d
Show file tree

Hide file tree

Showing 7 changed files with 35 additions and 8 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/ci/Dockerfile b/ci/Dockerfile
@@ -15,6 +15,7 @@ RUN apt-get update -yy && \
     openssl libssl-dev libsasl2-dev libcurl4-openssl-dev pkg-config bash openjdk-17-jdk wget unzip git tmux lld postgresql-client kcat netcat-openbsd mysql-client \
     maven zstd libzstd-dev locales \
     python3.12 python3.12-dev \
+    golang perl \
     && rm -rf /var/lib/{apt,dpkg,cache,log}/
 ENV PYO3_PYTHON=python3.12
 

diff --git a/ci/build-ci-image.sh b/ci/build-ci-image.sh
@@ -10,7 +10,7 @@ cat ../rust-toolchain
 # shellcheck disable=SC2155
 
 # REMEMBER TO ALSO UPDATE ci/docker-compose.yml
-export BUILD_ENV_VERSION=v20250218
+export BUILD_ENV_VERSION=v20250220
 
 export BUILD_TAG="public.ecr.aws/w1p7b4n3/rw-build-env:${BUILD_ENV_VERSION}"
 

diff --git a/ci/docker-compose.yml b/ci/docker-compose.yml
@@ -90,7 +90,7 @@ services:
       retries: 5
 
   source-test-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     depends_on:
       - mysql
       - mysql-meta
@@ -106,7 +106,7 @@ services:
       - ..:/risingwave
 
   sink-test-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     depends_on:
       - mysql
       - mysql-meta
@@ -129,28 +129,28 @@ services:
       - ..:/risingwave
 
   rw-build-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     volumes:
       - ..:/risingwave
 
   # Standard environment for CI, including MySQL and Postgres for metadata.
   ci-standard-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     depends_on:
       - mysql-meta
       - db
     volumes:
       - ..:/risingwave
 
   iceberg-engine-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     depends_on:
       - db
     volumes:
       - ..:/risingwave
 
   ci-flamegraph-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     # NOTE(kwannoel): This is used in order to permit
     # syscalls for `nperf` (perf_event_open),
     # so it can do CPU profiling.
@@ -161,7 +161,7 @@ services:
       - ..:/risingwave
 
   regress-test-env:
-    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250218
+    image: public.ecr.aws/w1p7b4n3/rw-build-env:v20250220
     depends_on:
       db:
         condition: service_healthy

diff --git a/src/cmd/Cargo.toml b/src/cmd/Cargo.toml
@@ -12,6 +12,7 @@ rw-static-link = ["workspace-config/rw-static-link"]
 rw-dynamic-link = ["workspace-config/rw-dynamic-link"]
 openssl-vendored = ["workspace-config/openssl-vendored"]
 default = ["rw-static-link"]
+fips = ["workspace-config/fips"]
 
 [package.metadata.cargo-machete]
 ignored = [

diff --git a/src/cmd_all/Cargo.toml b/src/cmd_all/Cargo.toml
@@ -17,6 +17,7 @@ external-udf = ["risingwave_expr_impl/external-udf"]
 wasm-udf = ["risingwave_expr_impl/wasm-udf"]
 js-udf = ["risingwave_expr_impl/js-udf"]
 python-udf = ["risingwave_expr_impl/python-udf"]
+fips = ["workspace-config/fips"]
 
 [package.metadata.cargo-machete]
 ignored = ["workspace-hack", "workspace-config", "task_stats_alloc", "tikv-jemallocator"]

diff --git a/src/utils/workspace-config/Cargo.toml b/src/utils/workspace-config/Cargo.toml
@@ -19,6 +19,7 @@ ignored = [
     "static-sasl2-sys",
     "vendored-openssl-sys",
     "dynamic-zstd-sys",
+    "aws-lc-rs",
 ]
 
 [features]
@@ -27,6 +28,7 @@ ignored = [
 openssl-vendored = ["vendored-openssl-sys"]
 rw-static-link = ["static-libz-sys", "static-lzma-sys", "static-sasl2-sys"]
 rw-dynamic-link = ["dynamic-zstd-sys"]
+fips = ["aws-lc-rs"]
 
 [dependencies]
 # Disable verbose logs for release builds
@@ -51,6 +53,11 @@ vendored-openssl-sys = { package = "openssl-sys", version = "0.9.96", optional =
 dynamic-zstd-sys = { package = "zstd-sys", version = "2", optional = true, default-features = false, features = [
     "pkg-config",
 ] }
+
+# FIPS
+aws-lc-rs ={ version = "1.6", optional = true, default-features = false, features = [
+    "fips",
+] }
 # workspace-hack = { path = "../../workspace-hack" }
 # Don't add workspace-hack into this crate!