crypto: switch rdkafka from vendored OpenSSL to AWS-LC

Cargo.toml

@@ -331,8 +331,9 @@ serde-value = { git = "https://github.com/MaterializeInc/serde-value.git" }
 launchdarkly-server-sdk = { git = "https://github.com/MaterializeInc/rust-server-sdk", rev = "3e0a0b98b09a2970f292577a07e1c9382b65b5da" }
 
 # Waiting on https://github.com/edenhill/librdkafka/pull/4051.
-rdkafka = { git = "https://github.com/MaterializeInc/rust-rdkafka.git" }
-rdkafka-sys = { git = "https://github.com/MaterializeInc/rust-rdkafka.git" }
+# Also: jasonhernandez/ssl-awslc branch adds ssl-awslc feature for FIPS.
+rdkafka = { git = "https://github.com/MaterializeInc/rust-rdkafka.git", branch = "jasonhernandez/ssl-awslc" }
+rdkafka-sys = { git = "https://github.com/MaterializeInc/rust-rdkafka.git", branch = "jasonhernandez/ssl-awslc" }
 
 # Need to upstream a few PRs related to test builders.
 #

ci/builder/Dockerfile

@@ -138,6 +138,7 @@ RUN apt-get update --fix-missing && TZ=UTC DEBIAN_FRONTEND=noninteractive apt-ge
     gdb \
     git \
     gnupg2 \
+    golang \
     jq \
     lcov \
     libc6-dbg \
@@ -149,6 +150,7 @@ RUN apt-get update --fix-missing && TZ=UTC DEBIAN_FRONTEND=noninteractive apt-ge
     lld \
     llvm \
     make \
+    ninja-build \
     npm \
     openssh-client \
     pkg-config \
@@ -256,6 +258,22 @@ RUN mkdir rust \
     && cargo install --root /usr/local --version "=0.13.1" --locked wasm-pack \
     && rm -rf /cargo/registry /cargo/git
 
+# Build AWS-LC as a static library for FIPS-compliant Kafka TLS.
+# librdkafka links against this instead of vendored OpenSSL when the
+# ssl-awslc feature is enabled.
+ARG AWS_LC_VERSION=v1.54.0
+RUN git clone --depth 1 --branch ${AWS_LC_VERSION} https://github.com/aws/aws-lc.git /tmp/aws-lc \
+    && cmake -GNinja -S /tmp/aws-lc -B /tmp/aws-lc/build \
+        -DBUILD_SHARED_LIBS=0 \
+        -DBUILD_TESTING=OFF \
+        -DBUILD_TOOL=OFF \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/opt/aws-lc \
+        -DCMAKE_INSTALL_LIBDIR=lib \
+    && ninja -C /tmp/aws-lc/build \
+    && ninja -C /tmp/aws-lc/build install \
+    && rm -rf /tmp/aws-lc
+
 # Shims for sanitizers
 COPY sanshim/$ARCH_GCC /sanshim
 

ci/test/pipeline.template.yml

@@ -195,8 +195,24 @@ steps:
 
       - id: lint-macos
         label: ":rust: macOS Clippy"
-        # Running on a manually installed macOS agent, so make sure we don't go out of disk
-        command: "cargo clippy --all-targets -- -D warnings; if [ $(du -sg target | cut -f1) -gt 50 ]; then rm -rf target; fi"
+        # Running on a manually installed macOS agent, so make sure we don't go out of disk.
+        # Build AWS-LC to /opt/aws-lc if not cached (needed by rdkafka ssl-awslc feature).
+        command: |
+          if [ ! -f /opt/aws-lc/lib/libcrypto.a ]; then
+            echo "Building AWS-LC..."
+            if ! command -v go >/dev/null 2>&1; then
+              curl -fsSL https://go.dev/dl/go1.22.5.darwin-arm64.tar.gz | sudo tar -C /usr/local -xzf -
+              export PATH=$$PATH:/usr/local/go/bin
+            fi
+            tmpdir=$$(mktemp -d)
+            git clone --depth 1 --branch v1.54.0 https://github.com/aws/aws-lc.git $$tmpdir/aws-lc
+            cmake -S $$tmpdir/aws-lc -B $$tmpdir/aws-lc/build -DBUILD_SHARED_LIBS=0 -DBUILD_TESTING=OFF -DBUILD_TOOL=OFF -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/opt/aws-lc -DCMAKE_INSTALL_LIBDIR=lib -DCMAKE_INSTALL_INCLUDEDIR=include
+            make -C $$tmpdir/aws-lc/build -j$$(sysctl -n hw.ncpu)
+            sudo make -C $$tmpdir/aws-lc/build install
+            rm -rf $$tmpdir
+          fi
+          cargo clippy --all-targets -- -D warnings
+          if [ $$(du -sg target | cut -f1) -gt 50 ]; then rm -rf target; fi
         env:
           CARGO_INCREMENTAL: "0"
           RUSTUP_TOOLCHAIN: $RUST_VERSION