Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: use ring as default provider #19874

Merged
merged 1 commit into from
Dec 20, 2024
Merged

fix: use ring as default provider #19874

merged 1 commit into from
Dec 20, 2024

Conversation

zwang28
Copy link
Contributor

@zwang28 zwang28 commented Dec 20, 2024

I hereby agree to the terms of the RisingWave Labs, Inc. Contributor License Agreement.

What's changed and what's your intention?

The original aws_lc_rs provider may default to FIPS mode in certain situations, where FIPS may not be available, leading to panic due to error:12800067:DSO support routines:dlfcn_load:could not load the shared library:../crypto/dso/dso_dlfcn.c:118:filename(/usr/lib/x86_64-linux-gnu/ossl-modules/fips.so): /usr/lib/x86_64-linux-gnu/ossl-modules/fips.so: cannot open shared object file: No such file or directory, error:12800067:DSO support routines:DSO_load:could not load the shared library:../crypto/dso/dso_lib.c:152:, error:07880025:common libcrypto routines:provider_init:reason(524325):../crypto/provider_core.c:912:name=fips

This PR changes the provider to ring.

Checklist

  • I have written necessary rustdoc comments.
  • I have added necessary unit tests and integration tests.
  • I have added test labels as necessary.
  • I have added fuzzing tests or opened an issue to track them.
  • My PR contains breaking changes.
  • My PR changes performance-critical code, so I will run (micro) benchmarks and present the results.
  • My PR contains critical fixes that are necessary to be merged into the latest release.

Documentation

  • My PR needs documentation updates.
Release note

@arkbriar
Copy link
Contributor

Several questions:

  • What's the difference between aws_lc_rs and ring?
  • Shall we also bundle the fips share lib in our image?

@arkbriar
Copy link
Contributor

@arkbriar arkbriar requested a review from lmatz December 20, 2024 04:46
@zwang28
Copy link
Contributor Author

zwang28 commented Dec 20, 2024

What's the difference between aws_lc_rs and ring?

aws_lc does not appear to be actively tested on BSD systems.

Copy link
Collaborator

@hzxa21 hzxa21 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Have we tested that using ring can also prevent the google-pub-sub issue mentioned in #19136?

@zwang28 zwang28 added this pull request to the merge queue Dec 20, 2024
Merged via the queue into main with commit 5423dee Dec 20, 2024
60 of 61 checks passed
@zwang28 zwang28 deleted the wangzheng/fix_tls branch December 20, 2024 08:57
github-actions bot pushed a commit that referenced this pull request Dec 20, 2024
github-actions bot pushed a commit that referenced this pull request Dec 20, 2024
github-actions bot pushed a commit that referenced this pull request Dec 20, 2024
github-merge-queue bot pushed a commit that referenced this pull request Dec 20, 2024
Co-authored-by: zwang28 <70626450+zwang28@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants