From 7aa824a8d92b912b30d8b85a7511601fb47d216d Mon Sep 17 00:00:00 2001 From: Charlie Sharpsteen Date: Thu, 13 Aug 2026 15:27:52 -0500 Subject: [PATCH] Depend on Java 21 for RedHat FIPS JRuby 10 requires Java 21 or newer, but the newest version of Java that BouncyCastle libraries are certified for use with is 21. This commit updates all RedHat FIPS platforms to depend on Java 21 when building OpenVox 9.x --- effectively moving RedHat FIPS 9 back from Java 25 to 21. See: https://www.bouncycastle.org/download/bouncy-castle-java-fips/ Signed-off-by: Charlie Sharpsteen --- .../lein-ezbake/template/global/ext/fpm.rb | 29 ++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/resources/puppetlabs/lein-ezbake/template/global/ext/fpm.rb b/resources/puppetlabs/lein-ezbake/template/global/ext/fpm.rb index b5504ec8..d26639e9 100755 --- a/resources/puppetlabs/lein-ezbake/template/global/ext/fpm.rb +++ b/resources/puppetlabs/lein-ezbake/template/global/ext/fpm.rb @@ -233,7 +233,7 @@ def create_sles_rpmbuild_wrapper options.java = 'java-25-amazon-corretto-headless' options.java_bin = '/usr/lib/jvm/java-25-amazon-corretto.x86_64/bin/java' end - elsif options.operating_system == :el || options.operating_system == :redhatfips + elsif options.operating_system == :el options.systemd_el = 1 case [options.os_version, options.platform_version] @@ -254,6 +254,33 @@ def create_sles_rpmbuild_wrapper else fail "Unrecognized el os version #{options.os_version} for platform #{options.platform_version}" end + elsif options.operating_system == :redhatfips + options.systemd_el = 1 + + case [options.platform_version] + # OpenVox 8.x + in [8] + # All RedHat FIPS versions must use Java 17 as BouncyCastle 1.x is not + # FIPS certified for any newer JVM versions: + # + # > The 1.0.2.4 release, BC-FJA 1.0.2.4, was certified for use on Java 7, + # Java 8, Java 11, and Java 17. + # https://www.bouncycastle.org/download/bouncy-castle-java-fips/ + options.java = 'jre-17-headless' + options.java_bin = '/usr/lib/jvm/jre-17/bin/java' + # OpenVox 9.x + in [9] + # All RedHat FIPS versions must use Java 21 as BouncyCastle 2.x is not + # FIPS certified for any newer JVM versions: + # + # > The 2.1.0 release, BC-FJA 2.1.0 (Certificate #4943) , is certified for + # > use on Java 8, Java 11, Java 17, and Java 21. + # https://www.bouncycastle.org/download/bouncy-castle-java-fips/ + options.java = 'jre-21-headless' + options.java_bin = '/usr/lib/jvm/jre-21/bin/java' + else + fail "Unrecognized el os version #{options.os_version} for platform #{options.platform_version}" + end elsif options.operating_system == :sles options.systemd_sles = 1 options.sles = 1