diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml index a5d8be2e6..cc399d15c 100644 --- a/.github/workflows/CI.yml +++ b/.github/workflows/CI.yml @@ -53,7 +53,7 @@ jobs: - name: Build and Run Tests shell: bash run: | - ./gradlew check -x integTest -x yamlRestTest -x spotlessJava "-Pcrypto.standard=FIPS-140-3" + ./gradlew check -x integTest -x yamlRestTest -x spotlessJava - name: Upload Coverage Report if: contains(matrix.os, 'ubuntu') && contains(matrix.java, '21') uses: codecov/codecov-action@v5 @@ -80,7 +80,7 @@ jobs: - name: Build and Run Tests shell: bash run: | - ./gradlew integTest yamlRestTest "-Pcrypto.standard=FIPS-140-3" + ./gradlew integTest yamlRestTest integMultiNodeTest: needs: [spotless, javadoc] strategy: @@ -100,7 +100,7 @@ jobs: - name: Build and Run Tests shell: bash run: | - ./gradlew integTest -PnumNodes=3 "-Pcrypto.standard=FIPS-140-3" + ./gradlew integTest -PnumNodes=3 integTenantAwareTest: needs: [spotless, javadoc] strategy: @@ -123,4 +123,4 @@ jobs: - name: Build and Run Tests shell: bash run: | - ./gradlew integTest "-Dtests.rest.tenantaware=true" "-Pcrypto.standard=FIPS-140-3" + ./gradlew integTest "-Dtests.rest.tenantaware=true" diff --git a/.github/workflows/publish-snapshots.yml b/.github/workflows/publish-snapshots.yml index 1237e5196..b51897b04 100644 --- a/.github/workflows/publish-snapshots.yml +++ b/.github/workflows/publish-snapshots.yml @@ -44,4 +44,4 @@ jobs: - name: publish snapshots to maven run: | - ./gradlew publishPluginZipPublicationToSnapshotsRepository "-Pcrypto.standard=FIPS-140-3" + ./gradlew publishPluginZipPublicationToSnapshotsRepository diff --git a/.github/workflows/test_bwc.yml b/.github/workflows/test_bwc.yml index 14943541f..48f595c5e 100644 --- a/.github/workflows/test_bwc.yml +++ b/.github/workflows/test_bwc.yml @@ -33,7 +33,7 @@ jobs: run: | plugin_version=`./gradlew properties -q | grep "opensearch_build:" | awk '{print $2}'` echo plugin_version $plugin_version - ./gradlew assemble "-Pcrypto.standard=FIPS-140-3" + ./gradlew assemble echo "Creating ./src/test/resources/org/opensearch/flowframework/bwc/flow-framework/$plugin_version ..." mkdir -p ./src/test/resources/org/opensearch/flowframework/bwc/flow-framework/$plugin_version echo "Copying ./build/distributions/*.zip to ./src/test/resources/org/opensearch/flowframework/bwc/flow-framework/$plugin_version ..." @@ -44,4 +44,4 @@ jobs: - name: Run Flow Framework Backwards Compatibility Tests run: | echo "Running backwards compatibility tests ..." - ./gradlew bwcTestSuite -Dtests.security.manager=false "-Pcrypto.standard=FIPS-140-3" + ./gradlew bwcTestSuite -Dtests.security.manager=false diff --git a/.github/workflows/test_security.yml b/.github/workflows/test_security.yml index 850970316..7be57a232 100644 --- a/.github/workflows/test_security.yml +++ b/.github/workflows/test_security.yml @@ -50,5 +50,4 @@ jobs: -Dsecurity.enabled=true \ -Dhttps=true \ -Dresource_sharing.enabled=${{ matrix.resource_sharing_flag }} \ - \"-Pcrypto.standard=FIPS-140-3\" \ --tests '*IT'" diff --git a/DEVELOPER_GUIDE.md b/DEVELOPER_GUIDE.md index 7e922c2ba..1a17e8dec 100644 --- a/DEVELOPER_GUIDE.md +++ b/DEVELOPER_GUIDE.md @@ -4,6 +4,7 @@ - [Java](#java) - [Setup](#setup) - [Build](#build) + - [FIPS Crypto Configuration](#fips-crypto-configuration) - [Building from the command line](#building-from-the-command-line) - [Building from the IDE](#building-from-the-ide) - [Backports](#backports) @@ -36,6 +37,15 @@ The Flow Framework `main` branch targets JDK 21. To ease backporting to `2.x`, m This package uses the [Gradle](https://docs.gradle.org/current/userguide/userguide.html) build system. Gradle comes with excellent documentation that should be your first stop when trying to figure out how to operate or modify the build. we also use the OpenSearch build tools for Gradle. These tools are idiosyncratic and don't always follow the conventions and instructions for building regular Java code using Gradle. Not everything in this package will work the way it's described in the Gradle documentation. If you encounter such a situation, the OpenSearch build tools [source code](https://github.com/opensearch-project/OpenSearch/tree/main/buildSrc/src/main/groovy/org/opensearch/gradle) is your best bet for figuring out what's going on. +#### FIPS Crypto Configuration + +The `gradle.properties` file includes `crypto.standard=FIPS-140-3` by default, so there is no need to pass `-Pcrypto.standard=FIPS-140-3` on the command line. All build and test commands automatically use this setting. + +To build without FIPS, override the property: +``` +./gradlew assemble -Pcrypto.standard=any-supported +``` + #### Building from the command line 1. `./gradlew check` builds and tests. diff --git a/gradle.properties b/gradle.properties new file mode 100644 index 000000000..1e822a6a6 --- /dev/null +++ b/gradle.properties @@ -0,0 +1 @@ +crypto.standard=FIPS-140-3