switch openssl->aws-lc
This switch moves to a full AWS stack and a core ssl library with smaller security attack surface. It increases final binary size by 3MB which may be largely avoided by tweaking the aws-lc build commands at the expense of some performance. Note aws-lc will likely be the primarily supported ssl library by the AWS c runtime libs moving forward, and thus this also allows us to move to more recent versions of the dependant libraries. We still require a custom fork of aws-c-cal until PR 89 is merged
This commit is contained in:
parent
d3efa21a41
commit
e0b3c4f0b3
42
Dockerfile
42
Dockerfile
|
@ -1,3 +1,9 @@
|
|||
# We are looking for a static build, so we need to be on a musl system
|
||||
# Zig uses clang, so for best compatibility, everything should be built
|
||||
# using that compiler
|
||||
|
||||
|
||||
# Establish a base container with build tools common to most projects
|
||||
FROM alpine:3.13 AS base
|
||||
# gcc gets us libgcc.a, even though the build should be using clang
|
||||
RUN apk add --no-cache clang git cmake make lld musl-dev gcc && \
|
||||
|
@ -5,8 +11,6 @@ RUN apk add --no-cache clang git cmake make lld musl-dev gcc && \
|
|||
ln -s /usr/bin/ld.lld /usr/bin/ld && rm /usr/bin/gcc # just to be sure
|
||||
|
||||
FROM base AS common
|
||||
# d5f9398d48d9c318563db08100e2e87b24ea3656
|
||||
# RUN git clone --depth 1 -b pthread-np https://github.com/r-burns/aws-c-common && \
|
||||
RUN git clone --depth 1 -b v0.5.2 https://github.com/awslabs/aws-c-common && \
|
||||
mkdir aws-c-common-build && cd aws-c-common-build && \
|
||||
cmake ../aws-c-common && \
|
||||
|
@ -14,33 +18,35 @@ RUN git clone --depth 1 -b v0.5.2 https://github.com/awslabs/aws-c-common && \
|
|||
|
||||
RUN tar -czf aws-c-common-clang.tgz /usr/local/*
|
||||
|
||||
FROM base AS openssl
|
||||
RUN apk add --no-cache perl linux-headers && \
|
||||
git clone --depth 1 -b OpenSSL_1_1_1i https://github.com/openssl/openssl && \
|
||||
cd openssl && ./Configure linux-x86_64-clang && make && make install
|
||||
# The only tags currently on the repo are from 9/2020 and don't install
|
||||
# anything, so we'll use current head of main branch (d60b60e)
|
||||
FROM base AS awslc
|
||||
RUN apk add --no-cache perl go g++ linux-headers && rm /usr/bin/g++ && rm /usr/bin/c++ && \
|
||||
git clone --depth 1000 https://github.com/awslabs/aws-lc && cd aws-lc && \
|
||||
git reset d60b60e --hard && cd .. && \
|
||||
cmake -S aws-lc -B aws-lc/build -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_PREFIX_PATH=/usr/local -DCMAKE_INSTALL_PREFIX=/usr/local && \
|
||||
cmake --build aws-lc/build --config RelWithDebInfo --target install
|
||||
|
||||
RUN tar -czf openssl-clang.tgz /usr/local/*
|
||||
RUN tar -czf aws-lc-clang.tgz /usr/local/*
|
||||
|
||||
FROM base AS s2n
|
||||
ENV S2N_LIBCRYPTO=openssl-1.1.1
|
||||
COPY --from=openssl /openssl-clang.tgz /
|
||||
RUN git clone --depth 1 -b v0.10.26 https://github.com/awslabs/s2n && \
|
||||
tar -xzf openssl-clang.tgz && \
|
||||
ENV S2N_LIBCRYPTO=awslc
|
||||
COPY --from=awslc /aws-lc-clang.tgz /
|
||||
RUN git clone --depth 1 -b v1.0.5 https://github.com/aws/s2n-tls && \
|
||||
tar -xzf aws-lc-clang.tgz && \
|
||||
mkdir s2n-build && cd s2n-build && \
|
||||
cmake ../s2n && \
|
||||
cmake ../s2n-tls && \
|
||||
make -j12 && make install
|
||||
|
||||
RUN tar -czf s2n-clang.tgz /usr/local/*
|
||||
|
||||
FROM base AS cal
|
||||
COPY --from=openssl /openssl-clang.tgz /
|
||||
COPY --from=awslc /aws-lc-clang.tgz /
|
||||
COPY --from=common /aws-c-common-clang.tgz /
|
||||
# environment not used - just busting docker's cache
|
||||
ENV COMMIT=d1a4d
|
||||
# RUN git clone --depth 1 -b v0.4.5 https://github.com/awslabs/aws-c-cal && \
|
||||
RUN git clone --depth 1 https://github.com/elerch/aws-c-cal && \
|
||||
# RUN git clone --depth 1 -b v0.5.5 https://github.com/awslabs/aws-c-cal && \
|
||||
RUN git clone --depth 1 -b static-musl-builds https://github.com/elerch/aws-c-cal && \
|
||||
tar -xzf aws-c-common-clang.tgz && \
|
||||
tar -xzf openssl-clang.tgz && \
|
||||
tar -xzf aws-lc-clang.tgz && \
|
||||
mkdir cal-build && cd cal-build && \
|
||||
cmake -DCMAKE_MODULE_PATH=/usr/local/lib64/cmake ../aws-c-cal && \
|
||||
make -j12 && make install
|
||||
|
|
|
@ -17,8 +17,8 @@ pub fn build(b: *Builder) void {
|
|||
exe.addIncludeDir("./src/");
|
||||
exe.addIncludeDir("/usr/local/include");
|
||||
exe.addObjectFile("/usr/local/lib64/libs2n.a");
|
||||
exe.addObjectFile("/usr/local/lib/libcrypto.a");
|
||||
exe.addObjectFile("/usr/local/lib/libssl.a");
|
||||
exe.addObjectFile("/usr/local/lib64/libcrypto.a");
|
||||
exe.addObjectFile("/usr/local/lib64/libssl.a");
|
||||
exe.addObjectFile("/usr/local/lib64/libaws-c-auth.a");
|
||||
exe.addObjectFile("/usr/local/lib64/libaws-c-cal.a");
|
||||
exe.addObjectFile("/usr/local/lib64/libaws-c-common.a");
|
||||
|
|
Loading…
Reference in New Issue
Block a user