Skip to content
Snippets Groups Projects
Commit 7f6ff530c9f7 authored by Stan Hu's avatar Stan Hu
Browse files

ruby: Enable OPENSSL_FIPS macro for system SSL builds

In the Ubuntu 18.04 FIPS builds, currently `OpenSSL.fips_mode` is
`false`, which prevents GitLab from entering FIPS mode.

Even though these builds properly link against the FIPS-enabled system
OpenSSL, this flag is `false` because Ruby compiles out the dynamic
`FIPS_mode()` checks (https://wiki.openssl.org/index.php/FIPS_mode())
unless the `OPENSSL_FIPS` macro is defined. In RedHat, `OPENSSL_FIPS`
is always defined in `/usr/include/openssl/opensslconf-x86_64.h`, but
this is not the case for Ubuntu. On non FIPS-systems, `FIPS_mode()`
should return 0 (not available), so this compile-time guard should not
be necessary. For now, we only enable it for builds that link
against the system SSL.

Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6775

Changelog: fixed
parent a458ece56c8e
No related branches found
No related tags found
2 merge requests!71heptapod#685: making 0.32 the new stable,!69GitLab 14.10 / Heptapod 0.32
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment