Openssl 3 base images #2874

tarnowsc · 2023-07-28T09:10:58Z

Desired Outcome

Please describe the desired outcome for this PR. Said another way, what was
the original request that resulted in these code changes? Feel free to copy
this information from the connected issue.

Implemented Changes

Describe how the desired outcome above has been achieved with this PR. In
particular, consider:

What's changed? Why were these changes made?
How should the reviewer approach this PR, especially if manual tests are required?
Are there relevant screenshots you can add to the PR description?

Connected Issue/Story

Resolves #[relevant GitHub issue(s), e.g. 76]

CyberArk internal issue ID: [insert issue ID]

Definition of Done

At least 1 todo must be completed in the sections below for the PR to be
merged.

Changelog

The CHANGELOG has been updated, or
This PR does not include user-facing changes and doesn't require a
CHANGELOG update

Test coverage

This PR includes new unit and integration tests to go with the code
changes, or
The changes in this PR do not require tests

Documentation

Docs (e.g. READMEs) were updated in this PR
A follow-up issue to update official docs has been filed here: [insert issue ID]
This PR does not require updating any documentation

Behavior

This PR changes product behavior and has been reviewed by a PO, or
These changes are part of a larger initiative that will be reviewed later, or
No behavior was changed with this PR

Security

Security architect has reviewed the changes in this PR,
These changes are part of a larger initiative with a separate security review, or
There are no security aspects to these changes

codeclimate · 2023-07-28T09:46:21Z

dev/files/authn-oidc/adfs/fetchCertificate

@@ -1,5 +1,5 @@
 #!/bin/sh
-httpclient_pem_location="/var/lib/gems/2.5.0/gems/httpclient-2.8.3/lib/httpclient"
+httpclient_pem_location=$(find $GEM_HOME -name httpclient -type d)


Double quote to prevent globbing and word splitting.

codeclimate · 2023-07-28T09:46:22Z

bin/conjurctl

@@ -1,5 +1,6 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
+require "bundler/setup"


Add an empty line after magic comments.

codeclimate · 2023-07-28T09:46:22Z

CHANGELOG.md

@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Nothing should go in this section, please add to the latest unreleased version
  (and update the corresponding date), or add a new version.

+## [0.0.5] - 2023-07-17
+### Security
+- Use newer base images with Ubuntu 22.04, Ruby 3.2 and OpenSSL 3


Lists should be surrounded by blank lines

codeclimate · 2023-07-28T09:46:22Z

CHANGELOG.md

@@ -9,6 +9,11 @@
 - Nothing should go in this section, please add to the latest unreleased version
  (and update the corresponding date), or add a new version.

+## [0.0.5] - 2023-07-17


Headers should be surrounded by blank lines

codeclimate · 2023-08-02T15:10:28Z

CHANGELOG.md

+## [1.19.7] - 2023-07-31
+
+### Changed
+- Conjur will now use the new FIPS Base Images.


Lists should be surrounded by blank lines

hdabrowski · 2023-08-07T09:53:05Z

VERSION_APPLIANCE

@@ -1 +1 @@
-5.0
+PR-57


will need to be reverted later

After merging this PR and being able to build appliance from master.

hdabrowski · 2023-08-07T12:03:18Z

Dockerfile

@@ -1,25 +1,32 @@
-FROM cyberark/ubuntu-ruby-fips:latest
+FROM registry.tld/cyberark/ubuntu-ruby-builder:22.04 as builder


will need to be changed back to docker.io

hdabrowski · 2023-08-07T12:03:38Z

Dockerfile.ubi

@@ -1,14 +1,25 @@
-# Conjur Base Image (UBI)
-FROM cyberark/ubi-ruby-fips:latest
+FROM registry.tld/cyberark/ubi-ruby-builder:ubi9 as builder


will need to be changed back to docker.io

hdabrowski · 2023-08-07T12:03:51Z

dev/Dockerfile.dev

@@ -1,40 +1,53 @@
-FROM cyberark/phusion-ruby-fips:latest
+FROM registry.tld/cyberark/ubuntu-ruby-builder:22.04 as builder


will need to be changed back to docker.io

hdabrowski · 2023-08-07T12:04:02Z

package.sh

@@ -8,14 +8,16 @@ chmod +x docker-debify
 docker run --rm \
  -v "$(pwd)":"$(pwd)" \
  --workdir "$(pwd)" \
-  cyberark/phusion-ruby-fips:latest \
-  sh -c "apt-get update -y && apt-get install -y git && bundle lock --update=conjur-api"
+  registry.tld/cyberark/ubuntu-ruby-builder:22.04 \


will need to be changed back to docker.io

marek-jakubowski · 2023-08-11T11:20:37Z

CHANGELOG.md

+## [1.20.1] - 2023-07-31
+
+### Changed
+- Conjur will now use the new FIPS Base Images.


Line 15, 16 and 17 could be deleted.

marek-jakubowski · 2023-08-11T11:20:49Z

CHANGELOG.md

 ## [1.20.0] - 2023-07-11

 ### Added
 - Telemetry support
  [cyberark/conjur#2854](https://github.com/cyberark/conjur/pull/2854)

+## [1.19.6] - 2023-07-05


To be removed?

codeclimate · 2023-08-17T20:52:16Z

cucumber/authenticators_jwt/features/support/jwt_jwks_helper.rb

@@ -219,7 +219,7 @@ def self_signed_certificate(rsa_key)
    cert.public_key = rsa_key.public_key
    cert.serial = 0x0
    cert.version = 2
-    cert.sign rsa_key, OpenSSL::Digest::SHA1.new
+    cert.sign rsa_key, OpenSSL::Digest::SHA256.new


Use OpenSSL::Digest.new('SHA256') instead of OpenSSL::Digest::SHA256.new.

codeclimate · 2023-08-17T20:52:17Z

cucumber/authenticators_jwt/features/support/jwt_jwks_helper.rb

@@ -219,7 +219,7 @@
    cert.public_key = rsa_key.public_key
    cert.serial = 0x0
    cert.version = 2
-    cert.sign rsa_key, OpenSSL::Digest::SHA1.new
+    cert.sign rsa_key, OpenSSL::Digest::SHA256.new


Use parentheses for method calls with arguments.

jvanderhoof · 2023-09-08T16:00:40Z

config/puma.rb

@@ -90,4 +90,3 @@
    puts "- #{k} from #{v}"
  end
 end
-


[nit] - we do want an empty new line at the end of all files.

jvanderhoof

Looks good.

marek-jakubowski · 2023-09-11T09:17:20Z

dev/Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM cyberark/ubuntu-ruby-postgres-fips:latest
+FROM registry.tld/cyberark/ubuntu-ruby-postgres-fips:22.04


will need to be changed back to docker.io

marek-jakubowski · 2023-09-11T09:19:56Z

VERSION_APPLIANCE

@@ -1 +1 @@
-5.0
+PR-57


Prepared #2949 to clean this up.

codeclimate · 2023-09-11T15:08:24Z

Code Climate has analyzed commit 8feb9b9 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 88.5% (0.0% change).

View more on Code Climate.

tarnowsc force-pushed the openssl-3-base-images branch from 6fd42bc to eb40b59 Compare July 28, 2023 09:24

codeclimate bot reviewed Jul 28, 2023

View reviewed changes

marek-jakubowski force-pushed the openssl-3-base-images branch from eb40b59 to a77e0c5 Compare July 31, 2023 20:26

codeclimate bot reviewed Aug 2, 2023

View reviewed changes

hdabrowski reviewed Aug 7, 2023

View reviewed changes

hdabrowski force-pushed the openssl-3-base-images branch from f2c18fd to 392ff88 Compare August 8, 2023 08:01

marek-jakubowski reviewed Aug 11, 2023

View reviewed changes

hdabrowski force-pushed the openssl-3-base-images branch from 86c2c3d to 460d72e Compare August 11, 2023 14:30

marek-jakubowski force-pushed the openssl-3-base-images branch 3 times, most recently from 29c9d81 to 818c118 Compare August 16, 2023 13:07

codeclimate bot reviewed Aug 17, 2023

View reviewed changes

tarnowsc force-pushed the openssl-3-base-images branch 3 times, most recently from 3677639 to 288d037 Compare August 22, 2023 09:27

rjurekca force-pushed the openssl-3-base-images branch from 288d037 to 5af4f83 Compare August 23, 2023 09:25

marek-jakubowski mentioned this pull request Aug 29, 2023

Openssl3 base images part1 #2926

Merged

13 tasks

tarnowsc force-pushed the openssl-3-base-images branch from 5af4f83 to d609208 Compare August 30, 2023 08:43

marek-jakubowski force-pushed the openssl-3-base-images branch 3 times, most recently from 2a87b04 to 1c1e21b Compare September 6, 2023 10:50

tarnowsc force-pushed the openssl-3-base-images branch 3 times, most recently from 8f471d6 to 1d6d3e7 Compare September 7, 2023 19:54

marek-jakubowski force-pushed the openssl-3-base-images branch from 1d6d3e7 to 2c4e997 Compare September 8, 2023 06:57

jvanderhoof reviewed Sep 8, 2023

View reviewed changes

jvanderhoof previously approved these changes Sep 8, 2023

View reviewed changes

marek-jakubowski marked this pull request as ready for review September 11, 2023 08:07

marek-jakubowski requested a review from a team as a code owner September 11, 2023 08:07

marek-jakubowski reviewed Sep 11, 2023

View reviewed changes

marek-jakubowski mentioned this pull request Sep 11, 2023

Appliance pin cleanup #2949

Merged

13 tasks

marek-jakubowski reviewed Sep 11, 2023

View reviewed changes

VERSION_APPLIANCE

@@ -1 +1 @@

5.0

PR-57

Copy link

Contributor

marek-jakubowski Sep 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Prepared #2949 to clean this up.

hdabrowski dismissed jvanderhoof’s stale review via 6536329 September 11, 2023 10:09

hdabrowski force-pushed the openssl-3-base-images branch from 2c4e997 to 6536329 Compare September 11, 2023 10:09

tarnowsc force-pushed the openssl-3-base-images branch from 6536329 to ccdd984 Compare September 11, 2023 11:55

tarnowsc and others added 6 commits September 11, 2023 14:35

Use new FIPS base images

e4bc274

Display fips mode status in the UI, temporary fix for openssl gem

3f5b1e7

Update documentation

2642516

Update Authn-JWT test for openssl updates

e09f99f

Fix codeclimate issue

e65d9f9

!tmp: pin appliance version

8feb9b9

tarnowsc force-pushed the openssl-3-base-images branch 2 times, most recently from 4964420 to 8feb9b9 Compare September 11, 2023 14:23

marek-jakubowski approved these changes Sep 11, 2023

View reviewed changes

tarnowsc merged commit 7d6ac7c into master Sep 11, 2023

tarnowsc deleted the openssl-3-base-images branch September 11, 2023 15:09

gl-johnson mentioned this pull request Oct 2, 2023

Suite release v1.20.0+suite.1 cyberark/conjur-oss-suite-release#270

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Openssl 3 base images #2874

Openssl 3 base images #2874

tarnowsc commented Jul 28, 2023

codeclimate bot Jul 28, 2023

codeclimate bot Jul 28, 2023

codeclimate bot Jul 28, 2023

codeclimate bot Jul 28, 2023

codeclimate bot Aug 2, 2023

hdabrowski Aug 7, 2023

marek-jakubowski Aug 11, 2023

hdabrowski Aug 7, 2023

hdabrowski Aug 7, 2023

hdabrowski Aug 7, 2023

hdabrowski Aug 7, 2023

marek-jakubowski Aug 11, 2023

marek-jakubowski Aug 11, 2023 •

edited

Loading

codeclimate bot Aug 17, 2023

codeclimate bot Aug 17, 2023

jvanderhoof Sep 8, 2023

jvanderhoof left a comment

marek-jakubowski Sep 11, 2023

marek-jakubowski Sep 11, 2023

codeclimate bot commented Sep 11, 2023

		@@ -1,25 +1,32 @@
		FROM cyberark/ubuntu-ruby-fips:latest
		FROM registry.tld/cyberark/ubuntu-ruby-builder:22.04 as builder

		@@ -1,40 +1,53 @@
		FROM cyberark/phusion-ruby-fips:latest
		FROM registry.tld/cyberark/ubuntu-ruby-builder:22.04 as builder

		@@ -1,4 +1,4 @@
		FROM cyberark/ubuntu-ruby-postgres-fips:latest
		FROM registry.tld/cyberark/ubuntu-ruby-postgres-fips:22.04

Openssl 3 base images #2874

Openssl 3 base images #2874

Conversation

tarnowsc commented Jul 28, 2023

Desired Outcome

Implemented Changes

Connected Issue/Story

Definition of Done

Changelog

Test coverage

Documentation

Behavior

Security

codeclimate bot Jul 28, 2023

Choose a reason for hiding this comment

codeclimate bot Jul 28, 2023

Choose a reason for hiding this comment

codeclimate bot Jul 28, 2023

Choose a reason for hiding this comment

codeclimate bot Jul 28, 2023

Choose a reason for hiding this comment

codeclimate bot Aug 2, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

marek-jakubowski Aug 11, 2023 • edited Loading

Choose a reason for hiding this comment

codeclimate bot Aug 17, 2023

Choose a reason for hiding this comment

codeclimate bot Aug 17, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jvanderhoof left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codeclimate bot commented Sep 11, 2023

marek-jakubowski Aug 11, 2023 •

edited

Loading