From 25a1933e012c867d9165d275b35c7d40eb0e9115 Mon Sep 17 00:00:00 2001 From: Will Greenberg Date: Thu, 19 Dec 2024 10:55:53 -0800 Subject: [PATCH] snap: disable FIPS detection (#10067) This is needed because the Python + OpenSSL bundled in core24 don't include an OpenSSL FIPS provider, which causes crashes on host systems with OpenSSL 1.1.1f (e.g. Ubuntu Pro 20.04). For some reason, core24's OpenSSL also looks in a non-standard location for the provider, which also causes crashes on systems with OpenSSL 3.x (e.g. RHEL 9). If you need FIPS functionality in certbot, install via pip. --- snap/snapcraft.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml index b8c89870f..d2793865c 100644 --- a/snap/snapcraft.yaml +++ b/snap/snapcraft.yaml @@ -27,6 +27,18 @@ environment: OPENSSL_MODULES: "$SNAP/usr/lib/$CRAFT_ARCH_TRIPLET_BUILD_FOR/ossl-modules" PATH: "$SNAP/bin:$SNAP/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games" PYTHONPATH: "$SNAP/lib/python3.12/site-packages:${PYTHONPATH}" + # Disable FIPS mode detection. See + # https://git.launchpad.net/ubuntu/+source/openssl/tree/debian/patches/fips/crypto-Add-kernel-FIPS-mode-detection.patch?h=applied/ubuntu/noble + # for more on this flag, and https://github.com/certbot/certbot/issues/10044 + # for more on the issue. + # + # This is needed because the Python + OpenSSL bundled in core24 don't include + # an OpenSSL FIPS provider, which causes crashes on host systems with OpenSSL + # 1.1.1f (e.g. Ubuntu Pro 20.04). For some reason, core24's OpenSSL also looks + # in a non-standard location for the provider, which also causes crashes on + # systems with OpenSSL 3.x (e.g. RHEL 9). If you need FIPS functionality in + # certbot, install via pip. + OPENSSL_FORCE_FIPS_MODE: "0" apps: certbot: