[openssl-users] FIPS compile issue with Perl on Windows

[Steve Marquess]

On 04/19/2016 09:16 AM, Jakob Bohm wrote:
> On 19/04/2016 13:44, Leaky wrote:
>>> The Security Policy is quite specific on the requirements, which make no
>>> allowance for the common sense (to a software engineer) fact that there
>>> are equivalent multiple ways to accomplish each step (such as unzipping
>>> the tarball). You are also specifically required to begin with the
>>> official tarball. Per the Security Policy, you *must* do:
>>>
>>>     gunzip -c openssl-fips-2.0.12.tar.gz | tar xf -
>>>
>>> and *not* any functionally equivalent alternative such as:
>>>
>>>     tar -zxf openssl-fips-2.0.12.tar.gz
>>>
>> Thanks, but I am still scratching my head as to if that is even
>> possible on
>> Windows, which would mean you can't actually compile the FIPS canister on
>> Windows and meet the security policy.
>>
> There are Windows ports of gzip, gunzip and tar.  For example in the CYGWIN
> distribution (from https://cygwin.com) or MingW32 (those 2 are free), there
> are also commercial versions such as MKS.
> 
> If you use the CYGWIN variant, but run under the Windows CMD shell, you
> will
> have to crate a .CMD equivalent of the gunzip shell script. Instead of the
> long winded code to output messages about what gunzip is, the following one
> line file should do the trick (there is no lf or crlf at the end of the
> line!), save this as gunzip.cmd somewhere on your PATH.
> 
> @x:\SOMEPATH\CYGWIN\bin\gzip.exe -d %*
> 
> (x:\DOMEPATH\CYGWIN is obviously whereever you installed CYGWIN)
> 
> Similarly create tar.cmd

Good catch, Jakob. I missed the Windows part.

As documented in Appendix A of the Security Policy, for Windows the
required canonical build commands are:

  ms\do_fips no-asm

or

  ms\do_fips

instead of the "./config ...; make" used for *nix style platforms. The

  gunzip -c openssl-fips-2.0.N.tar.gz | tar xf -
  cd openssl-fips-2.0.N

is still required, which as you noted can be done with a third party
"gunzip", e.g. from Cygwin.

Note that from a software engineering viewpoint it doesn't make much
sense to require that a "gunzip" command be installed and used when
another equivalent method of expanding the tarball is available, but the
CMVP required the specification of fixed build commands from the very
first validation.

No requirement that a specific version of "gunzip" be used, so the use
of a script would appear to be permitted.

Confusing, for sure...

-Steve M.

-- 
Steve Marquess
OpenSSL Validation Services, Inc.
1829 Mount Ephraim Road
Adamstown, MD  21710
USA
+1 877 673 6775 s/b
+1 301 874 2571 direct
marquess at openssl.com
gpg/pgp key: http://openssl.com/docs/0x6D1892F5.asc