diff --git a/CHANGELOG.md b/CHANGELOG.md index e9c60178d6..fbb2a20c40 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Features ### Enhancements +- Make security plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) ([#5952](https://github.com/opensearch-project/security/pull/5952)) ### Bug Fixes diff --git a/build.gradle b/build.gradle index 4707aaa986..a738fb4535 100644 --- a/build.gradle +++ b/build.gradle @@ -11,6 +11,7 @@ import com.diffplug.gradle.spotless.JavaExtension +import org.opensearch.gradle.info.FipsBuildParams import org.opensearch.gradle.test.RestIntegTestTask import groovy.json.JsonBuilder @@ -677,9 +678,16 @@ dependencies { implementation "com.google.guava:guava:${guava_version}" implementation 'org.greenrobot:eventbus-java:3.3.1' implementation 'commons-cli:commons-cli:1.11.0' - implementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" - implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" - implementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + // When building with -Pcrypto.standard=FIPS-140-3, bcFips jars are provided by OpenSearch + if (FipsBuildParams.isInFipsMode()) { + compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" + compileOnly "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" + compileOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + } else { + implementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" + implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" + implementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + } implementation 'org.ldaptive:ldaptive:1.2.3' implementation 'com.nimbusds:nimbus-jose-jwt:10.7' implementation 'com.rfksystems:blake2b:2.0.0'