[3.6.0] Build min and default distribution with -Pcrypto.standard=FIPS-140-3 for 3.6.0 release

[cwperks]

Opening this issue after discussion on opensearch-project/technical-steering#77.

Summary

For the OpenSearch 3.6.0 release, we should build both the default distribution and the minimal distribution with:

-Pcrypto.standard=FIPS-140-3

as part of the official release artifacts.

This issue is to track the work required to make this change, validate the resulting distributions, and resolve any build or runtime issues that arise from producing FIPS-140-3–configured artifacts by default for 3.6.0.

Background

There has been ongoing discussion in the TSC about OpenSearch’s FIPS posture and the long-term direction of FIPS support in the default distribution:
opensearch-project/technical-steering#77

Today, OpenSearch distributions are typically built in a non-FIPS configuration by default, with FIPS-enabled artifacts produced only when explicitly building with -Pcrypto.standard=FIPS-140-3 (e.g., ./gradlew localDistro -Pcrypto.standard=FIPS-140-3).

For 3.6.0, we propose that the release artifacts themselves (both default and minimal) be built with -Pcrypto.standard=FIPS-140-3.

Describe the solution you'd like

Always build with -Pcrypto.standard=FIPS-140-3

Describe alternatives you've considered

Status quo

Additional context

No response

---

PRs:

• Make security plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) security#5952
• Use env variable (OPENSEARCH_FIPS_MODE) to enable opensearch to run in FIPS enforced mode instead of checking for existence of bcFIPS jars OpenSearch#20625
• Toggle -Pcrypto.standard=FIPS-140-3 by default on all build scripts (Build) #5995
• Toggle -Pcrypto.standard=FIPS-140-3 by default on build script (security) security#5959
• Make sql plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) sql#5155
• Make performance-analyzer plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) performance-analyzer#915
• Fix ML build with 1) adapt to gradle shadow plugin v9 upgrade and 2) make ml-common fips build param aware ml-commons#4654
• Make Flow Framework aware of the FIPS build param (-Pcrypto.standard=FIPS-140-3) flow-framework#1322
• [RELEASE 3.6.0] Fail to install notifications plugin due to jarhell notifications#1139
  • Exclude transitive bouncycastle dependencies notifications#1141
• Fix typo in validFileNameExcludingAsterisk cross-cluster-replication#1639

[peterzhuamazon]

Hi @cwperks, regarding all OS plugins. Do they also need to update their build params?

Thanks.

[cwperks]

Hi @cwperks, regarding all OS plugins. Do they also need to update their build params?

Thanks.

Some plugins will need to become aware of the build param, yes.

One of the key differences with this build param is that when -Pcrypto.standard=FIPS-140-3 is provided then core will include bcFips dependencies under the lib/ folder. If the build param is absent then they are not there.

So for plugins that rely on these same dependencies:

1. If -Pcrypto.standard=FIPS-140-3 is present then treat bcFips as a provided dependency (i.e. treat as compileOnly because its available at runtime)
2. If -Pcrypto.standard=FIPS-140-3 is absent then bcFips deps are not provided. (i.e. treat as implementation because the plugin will need to include these in its assembly)