wip boringssl

[fffonion]

add an option to start gojira with boringssl build

[mikefero]

Looks good so far; I understand this is a WIP so providing initial feedback.

[aboudreault]

@fffonion should we finalize this one? I think boringssl will be ready to be tested soon, am I right?

[fffonion]

Hi @aboudreault @mikefero thanks for the review, this is no longer in priority, I managed to run the matrix in travis instead. I will address the comments shortly however.

[aboudreault]

the var name will probably be modified in kong-ee? https://github.com/Kong/kong-ee/blob/master/.requirements#L13

[fffonion]

not sure i get this one, are you suggesting to rename this variable to name BORINGSSL_VERSION that aligns to .requirements?

[aboudreault]

.requirements uses BORINGSSL_VERSION and the gojira PR is trying to read RESTY_BORINGSSL_VERSION. so just asking which one is correct.

[aboudreault]

@fffonion I got some issues locally while building. I couldn't fix in your fork so I pushed an up-to-date branch here: https://github.com/Kong/gojira/tree/boringssl

The build succeed using that branch. However, when I try a make dev in my gojira env, I got the following error:

ldoc 1.4.6-2 is now installed in /build/luarocks (license: MIT/X11)

Error: ssl_dhparam: no such file at ffdhe2048
  Run with --v (verbose) or --vv (debug) for more details
Error: ssl_dhparam: no such file at ffdhe2048
  Run with --v (verbose) or --vv (debug) for more details

[aboudreault]

@fffonion do you know what is the ssl_dhparam error?

[fffonion]

@aboudreault yes that's because boringssl doesn't implement those pre-defined groups. In fact, we should always set ssl_ciphers=fips for the boringssl build (or even better fips=on as this flags turns on ssl_ciphers=on), those will be default turned on in the released FIPS build in the future. We will need the boringssl-matrix branch on kong-ee.

[aboudreault]

closing in favor of #48