From bcfc7cc6bb3efd0fb88cec60c23726c3d41fdc7f Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Wed, 11 Feb 2026 16:37:00 -0500 Subject: [PATCH 1/3] Make security plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) Signed-off-by: Craig Perkins --- build.gradle | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/build.gradle b/build.gradle index 4707aaa986..14aa2a6e26 100644 --- a/build.gradle +++ b/build.gradle @@ -19,6 +19,7 @@ buildscript { opensearch_version = System.getProperty("opensearch.version", "3.6.0-SNAPSHOT") isSnapshot = "true" == System.getProperty("build.snapshot", "true") buildVersionQualifier = System.getProperty("build.version_qualifier", "") + isFips = "FIPS-140-3" == findProperty("crypto.standard") // 2.0.0-rc1-SNAPSHOT -> 2.0.0.0-rc1-SNAPSHOT version_tokens = opensearch_version.tokenize('-') @@ -677,9 +678,16 @@ dependencies { implementation "com.google.guava:guava:${guava_version}" implementation 'org.greenrobot:eventbus-java:3.3.1' implementation 'commons-cli:commons-cli:1.11.0' - implementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" - implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" - implementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + // When building with -Pcrypto.standard=FIPS-140-3, bcFips jars are provided by OpenSearch + if (isFips) { + compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" + compileOnly "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" + compileOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + } else { + implementation "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" + implementation "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" + implementation "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}" + } implementation 'org.ldaptive:ldaptive:1.2.3' implementation 'com.nimbusds:nimbus-jose-jwt:10.7' implementation 'com.rfksystems:blake2b:2.0.0' From 9bd6bc877cd7f0f427e369528acbc017347a6cda Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Wed, 11 Feb 2026 16:42:45 -0500 Subject: [PATCH 2/3] Add to CHANGELOG Signed-off-by: Craig Perkins --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e9c60178d6..fbb2a20c40 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), ### Features ### Enhancements +- Make security plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) ([#5952](https://github.com/opensearch-project/security/pull/5952)) ### Bug Fixes From 75acfa7d514e792eab58a71c5883a5b61de8fd01 Mon Sep 17 00:00:00 2001 From: Craig Perkins Date: Thu, 12 Feb 2026 09:48:04 -0500 Subject: [PATCH 3/3] Address review comments Signed-off-by: Craig Perkins --- build.gradle | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/build.gradle b/build.gradle index 14aa2a6e26..a738fb4535 100644 --- a/build.gradle +++ b/build.gradle @@ -11,6 +11,7 @@ import com.diffplug.gradle.spotless.JavaExtension +import org.opensearch.gradle.info.FipsBuildParams import org.opensearch.gradle.test.RestIntegTestTask import groovy.json.JsonBuilder @@ -19,7 +20,6 @@ buildscript { opensearch_version = System.getProperty("opensearch.version", "3.6.0-SNAPSHOT") isSnapshot = "true" == System.getProperty("build.snapshot", "true") buildVersionQualifier = System.getProperty("build.version_qualifier", "") - isFips = "FIPS-140-3" == findProperty("crypto.standard") // 2.0.0-rc1-SNAPSHOT -> 2.0.0.0-rc1-SNAPSHOT version_tokens = opensearch_version.tokenize('-') @@ -679,7 +679,7 @@ dependencies { implementation 'org.greenrobot:eventbus-java:3.3.1' implementation 'commons-cli:commons-cli:1.11.0' // When building with -Pcrypto.standard=FIPS-140-3, bcFips jars are provided by OpenSearch - if (isFips) { + if (FipsBuildParams.isInFipsMode()) { compileOnly "org.bouncycastle:bc-fips:${versions.bouncycastle_jce}" compileOnly "org.bouncycastle:bcpkix-fips:${versions.bouncycastle_pkix}" compileOnly "org.bouncycastle:bcutil-fips:${versions.bouncycastle_util}"