From e0b3c4f0b3b0944f6b18a6963d62731af9dad24f Mon Sep 17 00:00:00 2001 From: Emil Lerch Date: Thu, 29 Apr 2021 16:27:23 -0700 Subject: [PATCH] switch openssl->aws-lc This switch moves to a full AWS stack and a core ssl library with smaller security attack surface. It increases final binary size by 3MB which may be largely avoided by tweaking the aws-lc build commands at the expense of some performance. Note aws-lc will likely be the primarily supported ssl library by the AWS c runtime libs moving forward, and thus this also allows us to move to more recent versions of the dependant libraries. We still require a custom fork of aws-c-cal until PR 89 is merged --- Dockerfile | 42 ++++++++++++++++++++++++------------------ build.zig | 4 ++-- 2 files changed, 26 insertions(+), 20 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9a28e8d..9bf144e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,3 +1,9 @@ +# We are looking for a static build, so we need to be on a musl system +# Zig uses clang, so for best compatibility, everything should be built +# using that compiler + + +# Establish a base container with build tools common to most projects FROM alpine:3.13 AS base # gcc gets us libgcc.a, even though the build should be using clang RUN apk add --no-cache clang git cmake make lld musl-dev gcc && \ @@ -5,8 +11,6 @@ RUN apk add --no-cache clang git cmake make lld musl-dev gcc && \ ln -s /usr/bin/ld.lld /usr/bin/ld && rm /usr/bin/gcc # just to be sure FROM base AS common -# d5f9398d48d9c318563db08100e2e87b24ea3656 -# RUN git clone --depth 1 -b pthread-np https://github.com/r-burns/aws-c-common && \ RUN git clone --depth 1 -b v0.5.2 https://github.com/awslabs/aws-c-common && \ mkdir aws-c-common-build && cd aws-c-common-build && \ cmake ../aws-c-common && \ @@ -14,33 +18,35 @@ RUN git clone --depth 1 -b v0.5.2 https://github.com/awslabs/aws-c-common && \ RUN tar -czf aws-c-common-clang.tgz /usr/local/* -FROM base AS openssl -RUN apk add --no-cache perl linux-headers && \ - git clone --depth 1 -b OpenSSL_1_1_1i https://github.com/openssl/openssl && \ - cd openssl && ./Configure linux-x86_64-clang && make && make install +# The only tags currently on the repo are from 9/2020 and don't install +# anything, so we'll use current head of main branch (d60b60e) +FROM base AS awslc +RUN apk add --no-cache perl go g++ linux-headers && rm /usr/bin/g++ && rm /usr/bin/c++ && \ + git clone --depth 1000 https://github.com/awslabs/aws-lc && cd aws-lc && \ + git reset d60b60e --hard && cd .. && \ + cmake -S aws-lc -B aws-lc/build -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local && \ + cmake --build aws-lc/build --config RelWithDebInfo --target install -RUN tar -czf openssl-clang.tgz /usr/local/* +RUN tar -czf aws-lc-clang.tgz /usr/local/* FROM base AS s2n -ENV S2N_LIBCRYPTO=openssl-1.1.1 -COPY --from=openssl /openssl-clang.tgz / -RUN git clone --depth 1 -b v0.10.26 https://github.com/awslabs/s2n && \ - tar -xzf openssl-clang.tgz && \ +ENV S2N_LIBCRYPTO=awslc +COPY --from=awslc /aws-lc-clang.tgz / +RUN git clone --depth 1 -b v1.0.5 https://github.com/aws/s2n-tls && \ + tar -xzf aws-lc-clang.tgz && \ mkdir s2n-build && cd s2n-build && \ - cmake ../s2n && \ + cmake ../s2n-tls && \ make -j12 && make install RUN tar -czf s2n-clang.tgz /usr/local/* FROM base AS cal -COPY --from=openssl /openssl-clang.tgz / +COPY --from=awslc /aws-lc-clang.tgz / COPY --from=common /aws-c-common-clang.tgz / -# environment not used - just busting docker's cache -ENV COMMIT=d1a4d -# RUN git clone --depth 1 -b v0.4.5 https://github.com/awslabs/aws-c-cal && \ -RUN git clone --depth 1 https://github.com/elerch/aws-c-cal && \ +# RUN git clone --depth 1 -b v0.5.5 https://github.com/awslabs/aws-c-cal && \ +RUN git clone --depth 1 -b static-musl-builds https://github.com/elerch/aws-c-cal && \ tar -xzf aws-c-common-clang.tgz && \ - tar -xzf openssl-clang.tgz && \ + tar -xzf aws-lc-clang.tgz && \ mkdir cal-build && cd cal-build && \ cmake -DCMAKE_MODULE_PATH=/usr/local/lib64/cmake ../aws-c-cal && \ make -j12 && make install diff --git a/build.zig b/build.zig index 8f5b12e..346f27a 100644 --- a/build.zig +++ b/build.zig @@ -17,8 +17,8 @@ pub fn build(b: *Builder) void { exe.addIncludeDir("./src/"); exe.addIncludeDir("/usr/local/include"); exe.addObjectFile("/usr/local/lib64/libs2n.a"); - exe.addObjectFile("/usr/local/lib/libcrypto.a"); - exe.addObjectFile("/usr/local/lib/libssl.a"); + exe.addObjectFile("/usr/local/lib64/libcrypto.a"); + exe.addObjectFile("/usr/local/lib64/libssl.a"); exe.addObjectFile("/usr/local/lib64/libaws-c-auth.a"); exe.addObjectFile("/usr/local/lib64/libaws-c-cal.a"); exe.addObjectFile("/usr/local/lib64/libaws-c-common.a");