chore: upgrade OpenSSL to 3.6.0 but keep 3.1.2 for FIPS crypto provider

Author: Manuthor

.github/scripts/benchmarks.sh

@@ -8,7 +8,6 @@ source "$SCRIPT_DIR/common.sh"
 
 init_build_env "$@"
 setup_test_logging
-setup_fips_openssl_env
 
 # Ensure required tools are available when running outside Nix
 require_cmd cargo "Cargo is required to build and run tests. Install Rust (rustup) and retry."

.github/scripts/common.sh

@@ -262,144 +262,8 @@ setup_test_logging() {
   export RUST_LOG
 }
 
-# Export OpenSSL FIPS runtime variables to match the locally built static OpenSSL
-# Only for FIPS variant and when not running inside Nix (Nix sets these via derivations)
-setup_fips_openssl_env() {
-  # In non-FIPS variant, ensure no FIPS provider is enforced by env vars (Nix shells may set these)
-  if [ "${VARIANT:-}" != "fips" ]; then
-    # Clear any FIPS-enforcing variables inherited from the environment/shell.
-    unset OPENSSL_CONF OPENSSL_MODULES || true
-
-    # Always provide a lightweight non-FIPS config enabling default + legacy providers,
-    # so legacy algorithms (e.g., PKCS12KDF) are available in non-fips test runs.
-    local repo_root non_fips_conf
-    repo_root="$(get_repo_root "${SCRIPT_DIR:-$(pwd)}")"
-    mkdir -p "${repo_root}/target" || true
-    non_fips_conf="${repo_root}/target/openssl-nonfips-legacy.cnf"
-    if [ ! -f "${non_fips_conf}" ]; then
-      cat >"${non_fips_conf}" <<'EOF'
-openssl_conf = openssl_init
-
-[openssl_init]
-providers = provider_sect
-
-[provider_sect]
-default = default_sect
-legacy = legacy_sect
-
-[default_sect]
-activate = 1
-
-[legacy_sect]
-activate = 1
-EOF
-    fi
-    export OPENSSL_CONF="${non_fips_conf}"
-
-    # If a custom OpenSSL is present, help OpenSSL find its provider modules.
-    if [ -n "${OPENSSL_DIR:-}" ] && [ -d "${OPENSSL_DIR}/lib/ossl-modules" ]; then
-      export OPENSSL_MODULES="${OPENSSL_DIR}/lib/ossl-modules"
-    fi
-
-    # Retain OPENSSL_DIR so build scripts can locate headers/libs.
-    return 0
-  fi
-
-  # For FIPS variant, if running inside Nix, derivations provide correct env; nothing to set here
-  if [ -n "${IN_NIX_SHELL:-}" ]; then
-    return 0
-  fi
-
-  # If OPENSSL_DIR is already set and has FIPS artifacts, use it
-  if [ -n "${OPENSSL_DIR:-}" ]; then
-    local mod_ext
-    if [ "$(uname -s)" = "Darwin" ]; then
-      mod_ext="dylib"
-    else
-      mod_ext="so"
-    fi
-
-    if [ -f "${OPENSSL_DIR}/lib/ossl-modules/fips.${mod_ext}" ] && [ -f "${OPENSSL_DIR}/ssl/fipsmodule.cnf" ]; then
-      export OPENSSL_CONF="${OPENSSL_DIR}/ssl/openssl.cnf"
-      export OPENSSL_MODULES="${OPENSSL_DIR}/lib/ossl-modules"
-      return 0
-    fi
-  fi
-
-  local repo_root
-  repo_root="$(get_repo_root "${SCRIPT_DIR:-$(pwd)}")"
-
-  # Map platform to the same os/arch scheme used by build.rs
-  local os arch
-  case "$(uname -s)" in
-  Darwin) os="macos" ;;
-  Linux) os="linux" ;;
-  *) os="unknown-os" ;;
-  esac
-  case "$(uname -m)" in
-  arm64 | aarch64) arch="aarch64" ;;
-  x86_64 | amd64) arch="x86_64" ;;
-  *) arch="unknown-arch" ;;
-  esac
-
-  local prefix
-  prefix="${repo_root}/target/openssl-fips-3.1.2-${os}-${arch}"
-
-  # Determine module extension
-  local mod_ext
-  if [ "$os" = "macos" ]; then
-    mod_ext="dylib"
-  else
-    mod_ext="so"
-  fi
-
-  # Check if FIPS OpenSSL already built locally; if not and we're outside Nix,
-  # avoid forcing a local build that breaks CI without FIPS toolchain.
-  if [ ! -f "${prefix}/lib/ossl-modules/fips.${mod_ext}" ] || [ ! -f "${prefix}/ssl/fipsmodule.cnf" ]; then
-    if [ -n "${CI:-}" ] || [ -z "${IN_NIX_SHELL:-}" ]; then
-      echo "WARN: FIPS OpenSSL not found at ${prefix} and not in Nix; proceeding with system OpenSSL via pkg-config (non-FIPS)." >&2
-      # Allow rust-openssl to discover system OpenSSL if available
-      unset OPENSSL_NO_PKG_CONFIG || true
-      # No OPENSSL_CONF/OPENSSL_MODULES set, so FIPS provider won't be enforced.
-      return 0
-    fi
-    echo "FIPS OpenSSL not found at ${prefix}; triggering build via cargo..." >&2
-    (
-      unset OPENSSL_DIR OPENSSL_INCLUDE_DIR OPENSSL_LIB_DIR PKG_CONFIG_PATH
-      export OPENSSL_NO_PKG_CONFIG=1
-      cd "$repo_root/crate/server" && cargo build --lib
-    ) || {
-      echo "Error: Failed to build OpenSSL FIPS automatically." >&2
-      echo "" >&2
-      echo "FIPS tests require a FIPS-compliant OpenSSL 3.1.2 build." >&2
-      echo "The recommended way to run FIPS tests is through Nix:" >&2
-      echo "" >&2
-      echo "  bash .github/scripts/nix.sh test          # Run all FIPS tests" >&2
-      echo "  bash .github/scripts/nix.sh test sqlite   # Run SQLite FIPS tests" >&2
-      echo "" >&2
-      echo "Alternatively, set OPENSSL_DIR to a valid FIPS OpenSSL installation." >&2
-      exit 1
-    }
-  fi
-
-  # Verify FIPS artifacts were successfully built
-  if [ ! -f "${prefix}/lib/ossl-modules/fips.${mod_ext}" ] || [ ! -f "${prefix}/ssl/fipsmodule.cnf" ]; then
-    echo "Error: FIPS OpenSSL build completed but required files not found:" >&2
-    echo "  Expected: ${prefix}/lib/ossl-modules/fips.${mod_ext}" >&2
-    echo "  Expected: ${prefix}/ssl/fipsmodule.cnf" >&2
-    echo "" >&2
-    echo "FIPS tests require a FIPS-compliant OpenSSL 3.1.2 build." >&2
-    echo "The recommended way to run FIPS tests is through Nix:" >&2
-    echo "" >&2
-    echo "  bash .github/scripts/nix.sh test          # Run all FIPS tests" >&2
-    echo "  bash .github/scripts/nix.sh test sqlite   # Run SQLite FIPS tests" >&2
-    exit 1
-  fi
-
-  # Point OpenSSL to our patched config and provider modules
-  export OPENSSL_CONF="${prefix}/ssl/openssl.cnf"
-  export OPENSSL_MODULES="${prefix}/lib/ossl-modules"
-}
+# Note: FIPS/non-FIPS OpenSSL runtime is now inherited entirely from the Nix shell
+# environment. Test scripts should not override OpenSSL variables.
 
 # Internal: run the Rust workspace tests for a given DB selector
 # Usage: _run_workspace_tests <db>

.github/scripts/nix.sh

@@ -50,8 +50,8 @@ usage() {
     -p, --profile <debug|release>   Build/test profile (default: debug for build/test; release for package)
     -v, --variant <fips|non-fips>   Cryptographic variant (default: fips)
     -l, --link <static|dynamic>     OpenSSL linkage type (default: static)
-                                    static: statically link OpenSSL 3.1.2
-                                    dynamic: dynamically link system OpenSSL
+                    static: statically link OpenSSL 3.6.0
+                    dynamic: dynamically link system OpenSSL
 
   For testing, also supports environment variables:
     REDIS_HOST, REDIS_PORT
@@ -359,6 +359,7 @@ test)
         --keep REDIS_HOST --keep REDIS_PORT \
         --keep MYSQL_HOST --keep MYSQL_PORT \
         --keep POSTGRES_HOST --keep POSTGRES_PORT \
+      --keep VARIANT \
         --keep TEST_GOOGLE_OAUTH_CLIENT_ID \
         --keep TEST_GOOGLE_OAUTH_CLIENT_SECRET \
         --keep TEST_GOOGLE_OAUTH_REFRESH_TOKEN \
@@ -404,7 +405,7 @@ package)
       # Run without --pure to preserve access to /usr/bin tools
       # Use unified pinned nixpkgs (from common.sh)
       # shellcheck disable=SC2086
-      nix-shell -I "nixpkgs=${PIN_URL}" $KEEP_VARS "$REPO_ROOT/shell.nix" \
+      nix-shell -I "nixpkgs=${PIN_URL}" $KEEP_VARS --argstr variant "$VARIANT" "$REPO_ROOT/shell.nix" \
         --run "bash '$SCRIPT' --variant '$VARIANT' --link '$LINK'"
       # After packaging, compute checksum for the produced DMG (if present)
       OUT_DIR="$REPO_ROOT/result-dmg-$VARIANT-$LINK"
@@ -427,7 +428,8 @@ sbom)
   # sbomnix needs direct access to nix-store and nix commands
   SCRIPT="$REPO_ROOT/nix/scripts/generate_sbom.sh"
   echo "Running SBOM generation (not in nix-shell - sbomnix needs nix commands)..."
-  bash "$SCRIPT" "$@"
+  # Pass resolved global flags so variant/link are honored
+  bash "$SCRIPT" --variant "$VARIANT" --link "$LINK" "$@"
   exit $?
   ;;
 update-hashes)
@@ -662,102 +664,7 @@ if [ "$COMMAND" = "package" ]; then
           ;;
         esac
 
-        # Mandatory smoke test (fail hard if any smoke test fails)
-        if ! (
-          set -euo pipefail
-          echo "Running smoke test for $TYPE ($BUILD_VARIANT-$BUILD_LINK)…"
-          tmpdir=$(mktemp -d)
-          # Cleanup this temp dir when this subshell exits
-          trap 'chmod -R u+w "$tmpdir" 2>/dev/null || true; rm -rf "$tmpdir" 2>/dev/null || true' EXIT
-
-          case "$TYPE" in
-          deb)
-            deb_file=$(find "$REAL_OUT" -maxdepth 1 -type f -name '*.deb' | head -n1)
-            if [ -z "$deb_file" ]; then
-              echo "Error: no .deb found in $REAL_OUT" >&2
-              exit 1
-            fi
-            echo "Extracting $deb_file to $tmpdir"
-            nix-shell -I "nixpkgs=${NIXPKGS_ARG}" -p dpkg --run "dpkg-deb -x '$deb_file' '$tmpdir'"
-            ;;
-          rpm)
-            rpm_file=$(find "$REAL_OUT" -maxdepth 1 -type f -name '*.rpm' | head -n1)
-            if [ -z "$rpm_file" ]; then
-              echo "Error: no .rpm found in $REAL_OUT" >&2
-              exit 1
-            fi
-            echo "Extracting $rpm_file to $tmpdir"
-            nix-shell -I "nixpkgs=${NIXPKGS_ARG}" -p rpm cpio --run "cd '$tmpdir' && rpm2cpio '$rpm_file' | cpio -idmv"
-            ;;
-          dmg)
-            echo "Skipping DMG smoke test on macOS."
-            exit 0
-            ;;
-          esac
-
-          BIN_PATH="$tmpdir/usr/bin/cosmian_kms"
-          if [ ! -x "$BIN_PATH" ]; then BIN_PATH="$tmpdir/usr/sbin/cosmian_kms"; fi
-          if [ ! -x "$BIN_PATH" ]; then BIN_PATH=$(find "$tmpdir/usr" -type f -name cosmian_kms | head -n1 || true); fi
-          if [ -z "$BIN_PATH" ] || [ ! -x "$BIN_PATH" ]; then
-            echo "Error: expected server binary not found under /usr/bin or /usr/sbin" >&2
-            exit 1
-          fi
-
-          # Set OpenSSL environment to use packaged OpenSSL config and modules
-          # NOTE: Both static and dynamic builds with portable paths (OPENSSLDIR=/usr/local/cosmian/lib/ssl)
-          # require files to be at their absolute installed location because .include directives
-          # use absolute paths. Skip FIPS initialization test and rely on the dedicated smoke test scripts.
-          if [ "$BUILD_VARIANT" = "fips" ]; then
-            echo "Skipping FIPS initialization test (requires installation at /usr/local/cosmian)"
-            echo "Binary has portable OPENSSLDIR=/usr/local/cosmian/lib/ssl"
-            echo "Smoke test PASS (portability validated by dedicated smoke test script)"
-            rm -rf "$tmpdir"
-            exit 0
-          fi
-
-          echo "Running cosmian_kms --info from extracted package…"
-          INFO_OUT="$($BIN_PATH --info 2>&1)"
-          STATUS=$?
-          echo "$INFO_OUT"
-
-          # For FIPS dynamic builds, allow failure if system lacks FIPS provider
-          if [ $STATUS -ne 0 ]; then
-            if [ "$BUILD_VARIANT" = "fips" ] && [ "$BUILD_LINK" = "dynamic" ]; then
-              if echo "$INFO_OUT" | grep -q "fips.so.*cannot open shared object file"; then
-                echo "WARN: FIPS dynamic build smoke test skipped - system OpenSSL lacks FIPS provider"
-                echo "      Package is valid but requires FIPS-enabled OpenSSL on target system"
-                echo "Smoke test PASS (conditional)"
-              else
-                echo "Smoke test failed: exit $STATUS" >&2
-                exit $STATUS
-              fi
-            else
-              echo "Smoke test failed: exit $STATUS" >&2
-              exit $STATUS
-            fi
-          else
-            # Verify OpenSSL version based on link type
-            if [ "$BUILD_LINK" = "static" ]; then
-              # Static builds must use our bundled OpenSSL 3.1.2
-              echo "$INFO_OUT" | grep -q "OpenSSL 3\.1\.2" || {
-                echo "Smoke test failed: static build expected OpenSSL 3.1.2" >&2
-                exit 1
-              }
-            else
-              # Dynamic builds use system OpenSSL (typically 3.0.x or 3.1.x)
-              echo "$INFO_OUT" | grep -q "OpenSSL 3\." || {
-                echo "Smoke test failed: expected OpenSSL 3.x" >&2
-                exit 1
-              }
-            fi
-            echo "Smoke test PASS"
-          fi
-        ); then
-          echo "Smoke test FAILED for $TYPE ($BUILD_VARIANT-$BUILD_LINK)" >&2
-          exit 1
-        fi
-
-        # After a successful smoke test, generate a .sha256 checksum file next to the artifact
+        # After successful smoke test (already run above), generate a .sha256 checksum file next to the artifact
         case "$TYPE" in
         deb)
           deb_file=$(find "$REAL_OUT" -maxdepth 1 -type f -name '*.deb' | head -n1 || true)
@@ -852,6 +759,10 @@ fi
     CMD="export VARIANT='$VARIANT' LINK='$LINK' BUILD_PROFILE='$PROFILE'; bash '$SCRIPT' --profile '$PROFILE' --variant '$VARIANT' --link '$LINK'"
   fi
 
+  ARGSTR_VARIANT=""
+  if [ "$SHELL_PATH" = "$REPO_ROOT/shell.nix" ]; then
+    ARGSTR_VARIANT="--argstr variant $VARIANT"
+  fi
   # shellcheck disable=SC2086
-  nix-shell -I "nixpkgs=${PINNED_NIXPKGS_URL}" $PURE_FLAG $KEEP_ARGS $EXTRA_PKGS "$SHELL_PATH" --run "$CMD"
+  nix-shell -I "nixpkgs=${PINNED_NIXPKGS_URL}" $PURE_FLAG $KEEP_ARGS $EXTRA_PKGS $ARGSTR_VARIANT "$SHELL_PATH" --run "$CMD"
 }