FIPS: Add pom profile to build fips compliant boringSSL netty-tcnative

[k-raina]

Motivation:

As discussed in issue, considering the growing demand for FIPS compliance in security-sensitive environments, an official netty-tcnative release supporting FIPS validation would greatly benefit the open-source community. This would simplify integration and provide a reliable, community-supported solution.

Setup Configurations:

Tools: cmake 3.20, ninja build 1.10.0, clang-12, golang, java 11, maven 3.6.3, libapr1, automake, autoconf, libtool, libunwind-dev, pkg-config

Fips validated BoringSSL commit used is 853ca1ea1168dff08011e5d42d94609cc0ca2e27

Build Steps:

• Run Maven

 mvn clean install -f boringssl-static/pom.xml -Pfips-boringssl-static

• While build is running you should see in logs:

...
Boringssl is fips compliant
...

• After build steps are completed you should see Jars eg.

.m2/repository/io/netty/netty-tcnative-boringssl-static/2.0.61.Final/netty-tcnative-boringssl-static-2.0.61.Final.jar
.m2/repository/io/netty/netty-tcnative-boringssl-static/2.0.61.Final/netty-tcnative-boringssl-static-2.0.61.Final-linux-x86_64.jar

Modifications:

• Added pom profile fips-boringssl-static for fips compliant

Tested on:

Tested on linux AMD and ARM machine, which are supported as per FIPS security document attached in reference.
Output: https://drive.google.com/file/d/1eAFUIrHLbB7xiTpxHPs__N3Ha_Ltli76/view?usp=sharing

Reference:

Guidance on how to build FIPS validated modules: https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp4407.pdf

[normanmaurer]

I think we could pull this in to make things easier for people. I am not sure yet about including this in our release process. But thats a different discussion

[k-raina]

Thanks @normanmaurer ,
I have added sample output and build details in the description.
Please let me know if anything else is needed to merge this branch to master? Thanks in Advance

[normanmaurer]

How would we keep track of the right tar ball to download ?

[k-raina]

Updated in commit: d1e16ba

tar ball uses same booringssl comit set in environment https://github.com/netty/netty-tcnative/pull/821/files#diff-9f1aa030fe8568dc7f081010d6f14b6d2c26ea2170502365e8f1ebe3f3e58607R86

[normanmaurer]

@k-raina can you please sign our icla: https://netty.io/s/icla and let me know once done ?

[k-raina]

@normanmaurer I have signed icla. Can i go ahead and merge?

[normanmaurer]

@k-raina thanks a lot!