tools: add an OpenSSL FIPS build to test-shared.yml

Signed-off-by: Filip Skokan <panva.ip@gmail.com>

Author: panva

tools/dep_updaters/update-nixpkgs-pin.sh

@@ -72,6 +72,12 @@ nix-instantiate -I "nixpkgs=$NIXPKGS_PIN_FILE" --eval --strict --json -E "
   inherit (pkgs)
     \(.attrs | sort | join("\n    "))
     ;
+
+  # Keep this aligned with the bundled OpenSSL major/minor.
+  openssl_3_5_fips = import ./openssl-fips.nix {
+    inherit pkgs;
+    openssl = pkgs.openssl_3_5;
+  };
 }"' > "$OPENSSL_MATRIX_FILE"
 
 cat -<<EOF

tools/nix/openssl-fips.nix

@@ -0,0 +1,38 @@
+{ openssl }:
+
+openssl.overrideAttrs (oldAttrs: {
+  pname = "openssl-fips";
+
+  configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ "enable-fips" ];
+
+  # Nix strips the provider after installation, invalidating the module MAC
+  # generated by OpenSSL's install_fips target. Regenerate and verify it in
+  # postFixup, after stripping has finished modifying the provider.
+  postFixup = (oldAttrs.postFixup or "") + ''
+    opensslConfig="$out/etc/ssl/openssl.cnf"
+    fipsModule="$out/lib/ossl-modules/fips${openssl.stdenv.hostPlatform.extensions.sharedLibrary}"
+    fipsConfig="$out/etc/ssl/fipsmodule.cnf"
+
+    substituteInPlace "$opensslConfig" \
+      --replace-fail 'openssl_conf = openssl_init' $'openssl_conf = openssl_init\nnodejs_conf = openssl_init' \
+      --replace-fail '# .include fipsmodule.cnf' ".include $fipsConfig" \
+      --replace-fail 'providers = provider_sect' $'providers = provider_sect\nalg_section = algorithm_sect' \
+      --replace-fail '# fips = fips_sect' 'fips = fips_sect' \
+      --replace-fail '# activate = 1' $'activate = 1\n\n[algorithm_sect]\ndefault_properties = fips=yes'
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -module "$fipsModule" \
+      -out "$fipsConfig"
+
+    OPENSSL_CONF=/dev/null "$bin/bin/openssl" fipsinstall \
+      -config "$opensslConfig"
+
+    export OPENSSL_CONF="$opensslConfig"
+    "$bin/bin/openssl" mac \
+      -digest SHA256 -macopt key:key HMAC </dev/null >/dev/null
+    if "$bin/bin/openssl" md5 </dev/null >/dev/null 2>&1; then
+      echo "MD5 unexpectedly available with FIPS properties enabled" >&2
+      exit 1
+    fi
+  '';
+})

tools/nix/openssl-matrix.nix

@@ -13,4 +13,9 @@
     openssl_3_6
     openssl_4_0
     ;
+
+  # Keep this aligned with the bundled OpenSSL major/minor.
+  openssl_3_5_fips = import ./openssl-fips.nix {
+    openssl = pkgs.openssl_3_5;
+  };
 }