zak-krider opened a new issue, #68149: URL: https://github.com/apache/doris/issues/68149
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues. ### Description Background Apache Doris currently pins OpenSSL 1.1.1s in thirdparty/vars.sh. OpenSSL 1.1.1 has reached upstream end of life. Organizations operating in regulated environments also increasingly require cryptographic operations to use FIPS 140-3 validated cryptographic modules. Requested Changes 1. Upgrade the Doris OpenSSL dependency from OpenSSL 1.1.1s to a supported OpenSSL 3.x release. 2. Support building and running Doris with an OpenSSL 3 FIPS Provider. 3. Provide a configuration allowing operators to require FIPS-approved cryptographic implementations. 4. Identify and document Doris components and third-party libraries that perform cryptographic operations. 5. Ensure dependencies do not silently bypass the configured FIPS provider. 8. Document the process for deploying Doris in an operating system configured for FIPS operation. Motivation This is required for organizations deploying Apache Doris in regulated environments. Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch. Current Dependency The current master branch contains: OPENSSL_DOWNLOAD="https://github.com/openssl/openssl/archive/OpenSSL_1_1_1s.tar.gz"; Proposed Architecture A supported configuration should allow: Apache Doris → OpenSSL 3.x → FIPS Provider → FIPS 140-3 validated cryptographic module Doris should either load only the appropriate providers or support OpenSSL configuration that enforces use of FIPS-approved algorithms. Acceptance Criteria - Doris successfully builds against supported OpenSSL 3.x. - Existing TLS functionality passes regression testing. - FE-to-BE and BE-to-BE TLS operates correctly. - External HTTPS/TLS integrations operate correctly. - Doris can operate using an OpenSSL FIPS Provider. - Non-FIPS algorithms can be prevented from being selected in FIPS mode. - Relevant third-party dependencies are tested for OpenSSL 3.x compatibility. - Documentation describes configuration and verification of the FIPS deployment. - CI continuously tests OpenSSL 3 compatibility. ### Use case This is required for organizations deploying Apache Doris in regulated environments. Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch. ### Related issues Supporting OpenSSL 3.x would also remove dependency on the upstream EOL OpenSSL 1.1.1 branch. The current master branch contains: OPENSSL_DOWNLOAD="https://github.com/openssl/openssl/archive/OpenSSL_1_1_1s.tar.gz"; ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
