对于FIPS强制模式，Oreo 8.1 boringssl构建失败

Question

我正在尝试为FIPS强制模式构建boringssl，但是构建失败了。到目前为止，我已经在cmake命令中启用了两个标志"FIPS“和"FIPS_DELOCATE”，然后是忍者构建。

我使用的是Oreo 8.1。codebase和我已经在这个问题上挣扎了很长一段时间。以下是我遵循的步骤。

external/boringssl/src$ cmake -DANDROID_ABI=arm64-v8a -DCMAKE_TOOLCHAIN_FILE=${ANDROID_NDK}/build/cmake/android.toolchain.cmake -DANDROID_NATIVE_API_LEVEL=27  -DFIPS=1 -DFIPS_DELOCATE=1
// This command executes successfully, and all config files are generated 

external/boringssl/src$ ninja 

// This command giving below error

siyachin@pcz-siyachin:/u/siyachin/Project_O3/external/boringssl/src$ ninja
[244/388] Building C object crypto/fipsmodule/CMakeFiles/bcm_c_generated_asm.dir/bcm.c.o
clang: warning: argument unused during compilation: '-Wa,--noexecstack' [-Wunused-command-line-argument]
[252/388] Generating bcm-delocated.S
FAILED: cd /u/siyachin/Project_O3/external/boringssl/src && go run util/fipstools/delocate.go util/fipstools/delocate.peg.go util/fipstools/ar.go util/fipstools/const.go -a /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/libbcm_c_generated_asm.a -o /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/bcm-delocated.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/aesv8-armx.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/armv8-mont.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/ghashv8-armx.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha1-armv8.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha256-armv8.S /u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/sha512-armv8.S
error while parsing "/u/siyachin/Project_O3/external/boringssl/src/crypto/fipsmodule/libbcm_c_generated_asm.a":
parse error near WS (line 57 symbol 29 - line 57 symbol 34):
"     "

exit status 1
ninja: build stopped: subcommand failed.

我认为，使用util/fipstools/delocate.go构建失败。我尝试放置一些调试日志，但在尝试从delocate.go解析libbcm_c_generated_asm.a时失败。

还有，有没有办法，我可以运行从Android.bp的go文件？，因为FIPS轻松模式是正确地建立在我的Android.bp？

Answer 1

我遇到了同样的问题。我试图在fips模式下为x86 ( x86_64 works )编译boringssl。我能够通过修改"delocate.peg"，重新生成"delocate.peg.go“(使用https://github.com/pointlander/peg )来解决”解析“问题，但最终被卡住了。如果您查看文件https://boringssl.googlesource.com/boringssl/+/refs/tags/fips-20180730/util/fipstools/delocate.go中的第141行，您将看到FIPS模式仅支持x86_64和ppc64le，目前不支持ARM或x86。

请参阅https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2964.pdf上的支承拱门