Skip to content

Make performance-analyzer plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) - #915

Merged
peterzhuamazon merged 2 commits into
opensearch-project:mainfrom
cwperks:fips-build-param
Feb 18, 2026
Merged

Make performance-analyzer plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3)#915
peterzhuamazon merged 2 commits into
opensearch-project:mainfrom
cwperks:fips-build-param

Conversation

@cwperks

@cwperks cwperks commented Feb 18, 2026

Copy link
Copy Markdown
Member

Description

This PR makes the PA plugin aware of the -Pcrypto.standard=FIPS-140-3 build param. When present, it means that any bc (bouncycastle) FIPS jars are provided from the core and available at runtime. When absent, the PA plugin needs to include them in its assembly (i.e. difference between compileOnly and implementation for dependency scope.

Testing:

  1. When core built with ./gradlew localDistro -Pcrypto.standard=FIPS-140-3 but PA plugin is not
➜  ./bin/opensearch-plugin install file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Installing file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Downloading file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
[=================================================] 100%
-> Failed installing file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Rolling back file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Rolled back file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
Exception in thread "main" java.lang.IllegalStateException: failed to load plugin opensearch-performance-analyzer due to jar hell
	at org.opensearch.plugins.PluginsService.checkBundleJarHell(PluginsService.java:779)
	at org.opensearch.plugins.PluginsService.checkJarHellForPlugin(PluginsService.java:404)
	at org.opensearch.tools.cli.plugin.InstallPluginCommand.jarHellCheck(InstallPluginCommand.java:834)
	at org.opensearch.tools.cli.plugin.InstallPluginCommand.loadPluginInfo(InstallPluginCommand.java:811)
	at org.opensearch.tools.cli.plugin.InstallPluginCommand.installPlugin(InstallPluginCommand.java:846)
	at org.opensearch.tools.cli.plugin.InstallPluginCommand.execute(InstallPluginCommand.java:277)
	at org.opensearch.tools.cli.plugin.InstallPluginCommand.execute(InstallPluginCommand.java:251)
	at org.opensearch.common.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:110)
	at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
	at org.opensearch.cli.MultiCommand.execute(MultiCommand.java:104)
	at org.opensearch.cli.Command.mainWithoutErrorHandling(Command.java:138)
	at org.opensearch.cli.Command.main(Command.java:101)
	at org.opensearch.tools.cli.plugin.PluginCli.main(PluginCli.java:66)
Caused by: java.lang.IllegalStateException: jar hell!
class: META-INF.versions.11.org.bouncycastle.crypto.fips.FipsSecureRandom$Random11Spi
jar1: /Users/cwperx/Projects/opensearch/OpenSearch/build/distribution/local/opensearch-3.6.0-SNAPSHOT/lib/bc-fips-2.1.2.jar
jar2: /Users/cwperx/Projects/opensearch/OpenSearch/build/distribution/local/opensearch-3.6.0-SNAPSHOT/plugins/.installing-5712889179040586613/bc-fips-2.1.2.jar
	at org.opensearch.common.bootstrap.JarHell.checkClass(JarHell.java:316)
	at org.opensearch.common.bootstrap.JarHell.checkJarHell(JarHell.java:215)
	at org.opensearch.plugins.PluginsService.checkBundleJarHell(PluginsService.java:777)
	... 12 more
  1. When both core and PA are built with -Pcrypto.standard=FIPS-140-3
➜  ./bin/opensearch-plugin install file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Installing file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
-> Downloading file:/Users/cwperx/Projects/opensearch/performance-analyzer/build/distributions/opensearch-performance-analyzer-3.6.0.0-SNAPSHOT.zip
[=================================================] 100%
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@     WARNING: plugin requires additional permissions     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
* java.io.FilePermission /- read,write,execute,delete,readlink
* java.io.FilePermission build/tmp/junit_metrics read
* java.lang.RuntimePermission accessClassInPackage.jdk.internal.misc
* java.lang.RuntimePermission accessClassInPackage.sun.tools.attach
* java.lang.RuntimePermission accessDeclaredMembers
* java.lang.RuntimePermission createClassLoader
* java.lang.RuntimePermission defineClass
* java.lang.RuntimePermission getClassLoader
* java.lang.RuntimePermission loadLibrary.attach
* java.lang.RuntimePermission manageProcess
See http://docs.oracle.com/javase/8/docs/technotes/guides/security/permissions.html
for descriptions of what these permissions allow and the associated risks.

Continue with installation? [y/N]y
-> Installed opensearch-performance-analyzer with folder name opensearch-performance-analyzer

Continue with installation? [y/N]y
-> Installed opensearch-sql with folder name opensearch-sql
  • Category (Enhancement, New feature, Bug fix, Test fix, Refactoring, Maintenance, Documentation)

Enhancement

Issues Resolved

opensearch-project/opensearch-build#5979

Check List

  • New functionality includes testing
  • New functionality has been documented
  • New Roles/Permissions have a corresponding security dashboards plugin PR
  • API changes companion pull request created
  • Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

…standard=FIPS-140-3)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@codecov

codecov Bot commented Feb 18, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.43%. Comparing base (9cb092f) to head (9f4d271).
⚠️ Report is 54 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff              @@
##               main     #915      +/-   ##
============================================
- Coverage     70.88%   70.43%   -0.45%     
- Complexity      421      524     +103     
============================================
  Files            49       56       +7     
  Lines          3125     3663     +538     
  Branches        194      244      +50     
============================================
+ Hits           2215     2580     +365     
- Misses          785      920     +135     
- Partials        125      163      +38     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Added FIPS-140-3 standard to build and publish commands.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants