mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-05 20:48:22 +00:00
ee202a642f
This change changes the way to run our test suites in JVMs configured in FIPS 140 approved mode. It does so by: - Configuring any given runtime Java in FIPS mode with the bundled policy and security properties files, setting the system properties java.security.properties and java.security.policy with the == operator that overrides the default JVM properties and policy. - When runtime java is 11 and higher, using BouncyCastle FIPS Cryptographic provider and BCJSSE in FIPS mode. These are used as testRuntime dependencies for unit tests and internal clusters, and copied (relevant jars) explicitly to the lib directory for testclusters used in REST tests - When runtime java is 8, using BouncyCastle FIPS Cryptographic provider and SunJSSE in FIPS mode. Running the tests in FIPS 140 approved mode doesn't require an additional configuration either in CI workers or locally and is controlled by specifying -Dtests.fips.enabled=true
285 lines
9.8 KiB
Groovy
285 lines
9.8 KiB
Groovy
/*
|
|
* Licensed to Elasticsearch under one or more contributor
|
|
* license agreements. See the NOTICE file distributed with
|
|
* this work for additional information regarding copyright
|
|
* ownership. Elasticsearch licenses this file to you under
|
|
* the Apache License, Version 2.0 (the "License"); you may
|
|
* not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
|
|
import org.gradle.internal.jvm.Jvm
|
|
import org.gradle.util.GradleVersion
|
|
|
|
plugins {
|
|
id 'java-gradle-plugin'
|
|
id 'groovy'
|
|
}
|
|
|
|
group = 'org.elasticsearch.gradle'
|
|
|
|
String minimumGradleVersion = file('src/main/resources/minimumGradleVersion').text.trim()
|
|
if (GradleVersion.current() < GradleVersion.version(minimumGradleVersion)) {
|
|
throw new GradleException("Gradle ${minimumGradleVersion}+ is required to build elasticsearch")
|
|
}
|
|
|
|
if (project == rootProject) {
|
|
// change the build dir used during build init, so that doing a clean
|
|
// won't wipe out the buildscript jar
|
|
buildDir = 'build-bootstrap'
|
|
}
|
|
|
|
/*****************************************************************************
|
|
* Propagating version.properties to the rest of the build *
|
|
*****************************************************************************/
|
|
|
|
// we update the version property to reflect if we are building a snapshot or a release build
|
|
// we write this back out below to load it in the Build.java which will be shown in rest main action
|
|
// to indicate this being a snapshot build or a release build.
|
|
Properties props = VersionPropertiesLoader.loadBuildSrcVersion(project.file('version.properties'))
|
|
version = props.getProperty("elasticsearch")
|
|
|
|
task generateVersionProperties(type: WriteProperties) {
|
|
outputFile = "${buildDir}/version.properties"
|
|
comment = 'Generated version properties'
|
|
properties(props)
|
|
}
|
|
|
|
processResources {
|
|
from(generateVersionProperties)
|
|
}
|
|
|
|
/*****************************************************************************
|
|
* Java version *
|
|
*****************************************************************************/
|
|
|
|
if (JavaVersion.current() < JavaVersion.VERSION_11) {
|
|
throw new GradleException('At least Java 11 is required to build elasticsearch gradle tools')
|
|
}
|
|
|
|
sourceSets {
|
|
// We have a few classes that need to be compiled for older java versions
|
|
minimumRuntime {}
|
|
}
|
|
|
|
configurations {
|
|
reaper
|
|
}
|
|
|
|
compileMinimumRuntimeJava {
|
|
targetCompatibility = 8
|
|
sourceCompatibility = 8
|
|
}
|
|
|
|
jar {
|
|
from sourceSets.minimumRuntime.output
|
|
}
|
|
|
|
javadoc {
|
|
source sourceSets.minimumRuntime.allSource
|
|
}
|
|
|
|
/*****************************************************************************
|
|
* Dependencies used by the entire build *
|
|
*****************************************************************************/
|
|
|
|
repositories {
|
|
jcenter()
|
|
}
|
|
|
|
dependencies {
|
|
if (project.ext.has("isEclipse") == false || project.ext.isEclipse == false) {
|
|
// eclipse is confused if this is set explicitly
|
|
compile sourceSets.minimumRuntime.output
|
|
}
|
|
|
|
compile localGroovy()
|
|
|
|
compile 'commons-codec:commons-codec:1.12'
|
|
compile 'org.apache.commons:commons-compress:1.19'
|
|
|
|
compile 'com.netflix.nebula:gradle-extra-configurations-plugin:3.0.3'
|
|
compile 'com.netflix.nebula:nebula-publishing-plugin:4.4.4'
|
|
compile 'com.netflix.nebula:gradle-info-plugin:5.1.0'
|
|
compile 'org.eclipse.jgit:org.eclipse.jgit:5.5.0.201909110433-r'
|
|
compile 'com.netflix.nebula:gradle-info-plugin:3.0.3'
|
|
compile 'com.perforce:p4java:2012.3.551082' // THIS IS SUPPOSED TO BE OPTIONAL IN THE FUTURE....
|
|
compile 'org.apache.rat:apache-rat:0.11'
|
|
compile "org.elasticsearch:jna:4.5.1"
|
|
compile 'com.github.jengelman.gradle.plugins:shadow:5.1.0'
|
|
compile 'de.thetaphi:forbiddenapis:2.7'
|
|
compile 'com.avast.gradle:gradle-docker-compose-plugin:0.8.12'
|
|
testCompile "junit:junit:${props.getProperty('junit')}"
|
|
testCompile "com.carrotsearch.randomizedtesting:randomizedtesting-runner:${props.getProperty('randomizedrunner')}"
|
|
testCompile 'com.github.tomakehurst:wiremock-jre8-standalone:2.23.2'
|
|
testCompile 'org.mockito:mockito-core:1.9.5'
|
|
minimumRuntimeCompile "junit:junit:${props.getProperty('junit')}"
|
|
minimumRuntimeCompile localGroovy()
|
|
minimumRuntimeCompile gradleApi()
|
|
}
|
|
|
|
/*****************************************************************************
|
|
* Bootstrap repositories *
|
|
*****************************************************************************/
|
|
// this will only happen when buildSrc is built on its own during build init
|
|
if (project == rootProject) {
|
|
repositories {
|
|
if (System.getProperty("repos.mavenLocal") != null) {
|
|
mavenLocal()
|
|
}
|
|
}
|
|
dependencies {
|
|
// add this so the runtime classpath so Gradle will properly track it as a build runtime classpath input
|
|
runtimeOnly project('reaper')
|
|
}
|
|
// only run tests as build-tools
|
|
test.enabled = false
|
|
}
|
|
|
|
/*****************************************************************************
|
|
* Normal project checks *
|
|
*****************************************************************************/
|
|
|
|
// this happens when included as a normal project in the build, which we do
|
|
// to enforce precommit checks like forbidden apis, as well as setup publishing
|
|
if (project != rootProject) {
|
|
apply plugin: 'elasticsearch.build'
|
|
apply plugin: 'nebula.maven-base-publish'
|
|
apply plugin: 'nebula.maven-scm'
|
|
|
|
allprojects {
|
|
targetCompatibility = 10
|
|
sourceCompatibility = 10
|
|
}
|
|
|
|
// groovydoc succeeds, but has some weird internal exception...
|
|
groovydoc.enabled = false
|
|
|
|
// build-tools is not ready for primetime with these...
|
|
dependencyLicenses.enabled = false
|
|
dependenciesInfo.enabled = false
|
|
forbiddenApisMain.enabled = false
|
|
forbiddenApisMinimumRuntime.enabled = false
|
|
forbiddenApisTest.enabled = false
|
|
jarHell.enabled = false
|
|
thirdPartyAudit.enabled = false
|
|
if (Boolean.parseBoolean(System.getProperty("tests.fips.enabled"))){
|
|
test.enabled = false
|
|
}
|
|
|
|
configurations {
|
|
distribution
|
|
reaper
|
|
}
|
|
|
|
dependencies {
|
|
reaper project('reaper')
|
|
distribution project(':distribution:archives:windows-zip')
|
|
distribution project(':distribution:archives:oss-windows-zip')
|
|
distribution project(':distribution:archives:darwin-tar')
|
|
distribution project(':distribution:archives:oss-darwin-tar')
|
|
distribution project(':distribution:archives:linux-tar')
|
|
distribution project(':distribution:archives:oss-linux-tar')
|
|
}
|
|
|
|
// for external projects we want to remove the marker file indicating we are running the Elasticsearch project
|
|
processResources {
|
|
exclude 'buildSrc.marker'
|
|
into('META-INF') {
|
|
from configurations.reaper
|
|
}
|
|
}
|
|
|
|
// TODO: re-enable once randomizedtesting gradle code is published and removed from here
|
|
licenseHeaders.enabled = false
|
|
|
|
forbiddenPatterns {
|
|
exclude '**/*.wav'
|
|
exclude '**/*.p12'
|
|
// the file that actually defines nocommit
|
|
exclude '**/ForbiddenPatternsTask.java'
|
|
exclude '**/*.bcfks'
|
|
}
|
|
|
|
testingConventions {
|
|
naming.clear()
|
|
naming {
|
|
Tests {
|
|
baseClass 'org.elasticsearch.gradle.test.GradleUnitTestCase'
|
|
}
|
|
IT {
|
|
baseClass 'org.elasticsearch.gradle.test.GradleIntegrationTestCase'
|
|
}
|
|
}
|
|
}
|
|
|
|
task integTest(type: Test) {
|
|
inputs.dir(file("src/testKit")).withPropertyName("testkit dir").withPathSensitivity(PathSensitivity.RELATIVE)
|
|
systemProperty 'test.version_under_test', version
|
|
onlyIf { org.elasticsearch.gradle.info.BuildParams.inFipsJvm == false }
|
|
maxParallelForks = System.getProperty('tests.jvms', org.elasticsearch.gradle.info.BuildParams.defaultParallel.toString()) as Integer
|
|
}
|
|
check.dependsOn(integTest)
|
|
|
|
// for now we hardcode the tests for our build to use the gradle jvm.
|
|
tasks.withType(Test).configureEach {
|
|
it.executable = Jvm.current().getJavaExecutable()
|
|
}
|
|
|
|
/*
|
|
* We already configure publication and we don't need or want this one that
|
|
* comes from the java-gradle-plugin.
|
|
*/
|
|
afterEvaluate {
|
|
generatePomFileForPluginMavenPublication.enabled = false
|
|
}
|
|
}
|
|
|
|
// Define this here because we need it early.
|
|
class VersionPropertiesLoader {
|
|
static Properties loadBuildSrcVersion(File input) throws IOException {
|
|
Properties props = new Properties();
|
|
InputStream is = new FileInputStream(input)
|
|
try {
|
|
props.load(is)
|
|
} finally {
|
|
is.close()
|
|
}
|
|
loadBuildSrcVersion(props, System.getProperties())
|
|
return props
|
|
}
|
|
|
|
protected static void loadBuildSrcVersion(Properties loadedProps, Properties systemProperties) {
|
|
String elasticsearch = loadedProps.getProperty("elasticsearch")
|
|
if (elasticsearch == null) {
|
|
throw new IllegalStateException("Elasticsearch version is missing from properties.")
|
|
}
|
|
if (elasticsearch.matches("[0-9]+\\.[0-9]+\\.[0-9]+") == false) {
|
|
throw new IllegalStateException(
|
|
"Expected elasticsearch version to be numbers only of the form X.Y.Z but it was: " +
|
|
elasticsearch
|
|
)
|
|
}
|
|
String qualifier = systemProperties.getProperty("build.version_qualifier", "");
|
|
if (qualifier.isEmpty() == false) {
|
|
if (qualifier.matches("(alpha|beta|rc)\\d+") == false) {
|
|
throw new IllegalStateException("Invalid qualifier: " + qualifier)
|
|
}
|
|
elasticsearch += "-" + qualifier
|
|
}
|
|
if ("true".equals(systemProperties.getProperty("build.snapshot", "true"))) {
|
|
elasticsearch += "-SNAPSHOT"
|
|
}
|
|
loadedProps.put("elasticsearch", elasticsearch)
|
|
}
|
|
}
|