tools: add an OpenSSL FIPS build to test-shared.yml

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #64960
Fixes: #48379
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>

Author: panva

tools/dep_updaters/update-nixpkgs-pin.sh

@@ -93,6 +93,8 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   inherit (pkgs)
     \(.attrs | sort | join("\n    "))
     ;
+
+  openssl_fips = import ./openssl-fips.nix { };
 }"' > "$OPENSSL_MATRIX_FILE"
 
 cat -<<EOF

tools/nix/openssl-fips.nix

@@ -0,0 +1,57 @@
+{
+  openssl ? (import ./openssl-matrix.nix { }).openssl,
+}:
+
+openssl.overrideAttrs (oldAttrs: {
+  pname = "openssl-fips";
+
+  doCheck = false;
+  configureFlags = (oldAttrs.configureFlags or [ ]) ++ [
+    "no-docs"
+    "no-tests"
+    "enable-fips"
+  ];
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+  ];
+
+  # Nix strips the provider after installation, invalidating the module MAC
+  # generated by OpenSSL's install_fips target. Regenerate and verify it in
+  # postFixup, after stripping has finished modifying the provider.
+  postFixup = (oldAttrs.postFixup or "") + ''
+    opensslConfig="$out/etc/ssl/openssl.cnf"
+    fipsModule="$out/lib/ossl-modules/fips${openssl.stdenv.hostPlatform.extensions.sharedLibrary}"
+    fipsConfig="$out/etc/ssl/fipsmodule.cnf"
+
+    substituteInPlace "$opensslConfig" \
+      --replace-fail 'openssl_conf = openssl_init' $'openssl_conf = openssl_init\nnodejs_conf = openssl_init' \
+      --replace-fail '# .include fipsmodule.cnf' ".include $fipsConfig" \
+      --replace-fail 'providers = provider_sect' $'providers = provider_sect\nalg_section = algorithm_sect' \
+      --replace-fail '# fips = fips_sect' 'fips = fips_sect' \
+      --replace-fail '# activate = 1' $'activate = 1\n\n[algorithm_sect]\ndefault_properties = fips=yes'
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -module "$fipsModule" \
+      -out "$fipsConfig"
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -config "$opensslConfig"
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    export PATH="$bin/bin:$PATH"
+
+    openssl mac \
+      -digest SHA256 -macopt key:key HMAC </dev/null >/dev/null
+    openssl md5 </dev/null >/dev/null 2>&1 \
+    && echo "MD5 unexpectedly available with FIPS properties enabled" >&2 \
+    && exit 1
+
+    runHook postInstallCheck
+  '';
+})

tools/nix/openssl-matrix.nix

@@ -16,4 +16,6 @@
     openssl_3_6
     openssl_4_0
     ;
+
+  openssl_fips = import ./openssl-fips.nix { };
 }