Jira (PUP-9930) Do not necessarily load OpenSSL in JRuby

Justin Stoller (JIRA)

unread,

Jul 30, 2019, 6:17:02 PM7/30/19

to puppe...@googlegroups.com

Justin Stoller created an issue

Puppet /

PUP-9930

Do not necessarily load OpenSSL in JRuby

Issue Type:	Task
Assignee:	Unassigned
Created:	2019/07/30 3:16 PM
Priority:	Normal
Reporter:	Justin Stoller

OpenSSL in JRuby is implemented via JRuby's custom jopenssl project which is based on bouncycastle. This implementation is however hardcoded to FOSS bouncycastle and will not work in a FIPS environment. Before we can operate Puppet Server in FIPS mode we must be able to load Puppet and execute the portions of Puppet's code within JRuby with OpenSSL disabled.

(Alternatives for community extensions that require OpenSSL will be evaluated once we pass this milestone)