14609 2021-10-21 20:16:35 +0000 Unable to build on a host with FIPS mode enabled 2022-06-03 21:47:11 +0000 1 1 7 Build System, Metadata & Runtime OE-Core oe-core other 3.2.5 x86 Multiple RESOLVED FIXED Medium+ minor 4.1 M2 1 mark.hatle mark.hatle randy.macleod --- --- No (bug/feature does not impact docs) oldest_to_newest 91817 0 mark.hatle 2021-10-21 20:16:35 +0000 When trying to build on a host system with FIPS mode enabled, various points in the build will fail with error messages similar to: Command: ... returned non-zero exit status 1. Subprocess output:error: Failed to initialize NSS library. Note, the above mentions the NSS library, but similar messages have come from other components including OpenSSL, and even tools like md5sum, sha256sum, etc. 91818 1 mark.hatle 2021-10-21 20:21:36 +0000 I've done basic investigation of the issue (on gatesgarth / 3.2) and the cause seems to be based on two different items: 1) Host libraries/host tools * A number of native components use host libraries for basic functionality. These components would be restricted, by the FIPS enablement, from doing certain non-FIPS hash and cryptographic operations. * Some host system applications are disabled in FIPS mode, or have limits to various functionality. This MAY include md5sum, sha256sum, openssl, and even python modules. 2) Built (native) recipes that have cryptographic resources may check the host's FIPS enablement and act accordingly. The item #2 above is "easy" to fix, remove all of the checks in native components for host FIPS functionality. (But it will be like 'peeling an onion' as the checks are both compile and runtime. Item #1 the items need to be identified, and suitable "native" alternatives found. My original resource estimate was for one person it would take 2+ weeks of development, plus coordinating with the community, as well as additional time to generate appropriate test (host) configurations and create the tests. 91838 2 randy.macleod 2021-10-28 14:35:56 +0000 Mark, Is this also affecting master? Do you have anyone to work on it? 91848 3 mark.hatle 2021-10-28 15:56:47 +0000 I bricked my test system, so I've not been able to verify it on master. The key is that it's not just NSS, it's any host system cryptographic libraries, and some of the ones we build (native) when executed check the FIPS flag and go into a reduced functionality mode causing these types of failures. So I expect master (honister) is also broken. I had tried to fix this in gatesgarth and failed, since fixing one thing triggered then next and so on. I don't have any resources to work on it at this point, but I do intend to try to reproduce it on master for confirmation it's still an issue. 93397 4 mark.hatle 2022-06-03 21:47:11 +0000 I've tested this recently and other then a few recipes, everything appears to be working as of Kirkstone. Resolving. Fixes involved in this are: (yocto commit IDs) d895863af12e15bebd9fa0640290d9a649ece82b e9cc9772f277cbb270f52916b21d94abdaa1467f