You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@gluten.apache.org by "FelixYBW (via GitHub)" <gi...@apache.org> on 2024/12/13 20:56:54 UTC
[I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
FelixYBW opened a new issue, #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232
### Description
In some use cases we need to enable FIPS for openssl and use certain version of system installed libcrypto. It's related to security requirement. Let's add the exception of openssl for static link.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "FelixYBW (via GitHub)" <gi...@apache.org>.
FelixYBW commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2568389998
> @FelixYBW, it seems a bit complex to handle it. Openssl is also introduced as a transitive dependency. I note grpc, folly and aws-sdk-cpp are depending on it. If we want to use shared openssl thoroughly, we may have to also remove these libs from vcpkg since static openssl lib is linked to these libs in vcpkg.
Update here, vcpkg can build openssl as dynamic library and linked to grpc, folly etc, though grpc, folly etc. still are static link.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "FelixYBW (via GitHub)" <gi...@apache.org>.
FelixYBW commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2549344423
No, it's said the libcrypto.so is certified. vcpkg does have FIPS enabled option but looks it's not enough. To avoid any potential issue related to security, the safe way is to use system's libcrypto.so always.
So we need to add an option to remove libssl from vcpkg, use system installed one instead. Is it easy?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "FelixYBW (via GitHub)" <gi...@apache.org>.
FelixYBW commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2542355888
more details of FIPS can be found here:
https://access.redhat.com/compliance/fips
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/switching-rhel-to-fips-mode_security-hardening#federal-information-processing-standards-140-and-fips-mode_switching-rhel-to-fips-mode
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "PHILO-HE (via GitHub)" <gi...@apache.org>.
PHILO-HE commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2547883382
@FelixYBW, can static link still be used for openssl if required openssl & libcrypto version are installed by vcpkg?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "FelixYBW (via GitHub)" <gi...@apache.org>.
FelixYBW closed issue #8232: [VL] Link openssl dynamicly for FIPS
URL: https://github.com/apache/incubator-gluten/issues/8232
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "majetideepak (via GitHub)" <gi...@apache.org>.
majetideepak commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2571657293
> Update here, vcpkg can build openssl as dynamic library and linked to grpc, folly etc, though grpc, folly etc. still are static link.
Won't this cause ODR violations if the dynamic OpenSSL library version differs from the static link? How will users know which library version was statically linked?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "majetideepak (via GitHub)" <gi...@apache.org>.
majetideepak commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2571657814
> Update here, vcpkg can build openssl as dynamic library and linked to grpc, folly etc, though grpc, folly etc. still are static link.
To clarify, I am reading this as OpenSSL is always dynamically linked even for transitive dependencies.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "PHILO-HE (via GitHub)" <gi...@apache.org>.
PHILO-HE commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2550470299
@FelixYBW, it seems a bit complex to handle it. Openssl is also introduced as a transitive dependency. I note grpc, folly and aws-sdk-cpp are depending on it. If we want to use shared openssl thoroughly, we may have to also remove these libs from vcpkg since static openssl lib is linked to these libs in vcpkg.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org
Re: [I] [VL] Link openssl dynamicly for FIPS [incubator-gluten]
Posted by "FelixYBW (via GitHub)" <gi...@apache.org>.
FelixYBW commented on issue #8232:
URL: https://github.com/apache/incubator-gluten/issues/8232#issuecomment-2574239885
close with #8298
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@gluten.apache.org
For additional commands, e-mail: commits-help@gluten.apache.org