fix: add RHEL9 support for ppc64le and s390x MONGOSH-1680 (#2504)

* patch the openssl included in node to ignore redhat's rh-allow-sha1-signatures config

* add rhel9 e2e and smoke tests for ppc64le/s390x

* remove disable_openssl_shared_config_for_bundled_openssl and disableOpenSslSharedConfig

Author: lerouxb

.evergreen.yml

@@ -6,7 +6,6 @@ export type E2ETestsBuildVariant = {
   executableOsId: string;
   mVersion: string;
   tags?: string[];
-  disableOpenSslSharedConfig?: boolean;
   fips?: boolean;
   additionalTasks?: string[];
 };

.evergreen/build-variants/e2e-tests-build-variants.d.ts

@@ -28,15 +28,13 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
     displayName: 'RHEL 9.0 x64',
     runOn: 'rhel90-small',
     tags: ['nightly-driver'],
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-x64',
     mVersion: '7.0.x',
   },
   {
     displayName: 'RHEL 9.3 x64',
     runOn: 'rhel93-small',
     tags: ['nightly-driver'],
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-x64',
     mVersion: 'stable',
   },
@@ -181,7 +179,6 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
     displayName: 'Amazon Linux 2023 x64',
     runOn: 'amazon2023.0-small',
     tags: ['nightly-driver'],
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-x64',
     mVersion: 'stable',
   },
@@ -253,7 +250,6 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
   {
     displayName: 'Amazon Linux 2023 arm64',
     runOn: 'amazon2023.0-arm64-small',
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-arm64',
     mVersion: 'stable',
   },
@@ -266,29 +262,25 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
   {
     displayName: 'RHEL 9.0 arm64',
     runOn: 'rhel90-arm64-small',
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-arm64',
     mVersion: '7.0.x',
   },
   {
     displayName: 'RHEL 9.0 arm64',
     runOn: 'rhel90-arm64-small',
-    disableOpenSslSharedConfig: true,
     sharedOpenSsl: 'openssl3',
     executableOsId: 'linux-arm64-openssl3',
     mVersion: '7.0.x',
   },
   {
     displayName: 'RHEL 9.3 arm64',
     runOn: 'rhel93-arm64-small',
-    disableOpenSslSharedConfig: true,
     executableOsId: 'linux-arm64',
     mVersion: 'stable',
   },
   {
     displayName: 'RHEL 9.3 arm64',
     runOn: 'rhel93-arm64-small',
-    disableOpenSslSharedConfig: true,
     sharedOpenSsl: 'openssl3',
     executableOsId: 'linux-arm64-openssl3',
     mVersion: 'stable',
@@ -299,6 +291,12 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
     executableOsId: 'linux-ppc64le',
     mVersion: 'stable',
   },
+  {
+    displayName: 'RHEL 9 PPC',
+    runOn: 'rhel9-power-small',
+    executableOsId: 'linux-ppc64le',
+    mVersion: 'stable',
+  },
   {
     displayName: 'RHEL 7 s390x',
     runOn: 'rhel7-zseries-large',
@@ -311,6 +309,12 @@ exports.E2E_TESTS_BUILD_VARIANTS = [
     executableOsId: 'linux-s390x',
     mVersion: 'stable',
   },
+  {
+    displayName: 'RHEL 9 s390x',
+    runOn: 'rhel9-zseries-small',
+    executableOsId: 'linux-s390x',
+    mVersion: 'stable',
+  },
   {
     displayName: 'MacOS 14 x64',
     runOn: 'macos-14',

.evergreen/build-variants/e2e-tests-build-variants.js

@@ -487,7 +487,6 @@ functions:
           NODE_JS_VERSION: ${node_js_version}
           AWS_AUTH_IAM_ACCESS_KEY_ID: ${devtools_ci_aws_key}
           AWS_AUTH_IAM_SECRET_ACCESS_KEY: ${devtools_ci_aws_secret}
-          DISABLE_OPENSSL_SHARED_CONFIG_FOR_BUNDLED_OPENSSL: ${disable_openssl_shared_config_for_bundled_openssl}
           TASK_NAME: ${task_name}
 
   ###
@@ -1044,8 +1043,6 @@ functions:
         script: |
           set -e
           set -x
-          # fix rh-allow-sha1-signatures error, see run-e2e-tests.sh
-          export OPENSSL_CONF=""
           npx -y mongodb-runner exec -t standalone --version=7.0.x-enterprise -- \
             sh -c 'MONGOSH_SMOKE_TEST_SERVER="$MONGODB_URI" ./dist/mongosh --perfTests > perf_results.json'
         env:
@@ -1241,7 +1238,6 @@ tasks:
           node_js_version: ${node_js_version}
           mongosh_server_test_version: ${mongosh_server_test_version}
           mongosh_test_e2e_force_fips: ${mongosh_test_e2e_force_fips}
-          disable_openssl_shared_config_for_bundled_openssl: ${disable_openssl_shared_config_for_bundled_openssl|false}
   <% } %>
   - name: perf_tests_linux_x64
     tags: ["perf-test"]
@@ -1550,7 +1546,6 @@ buildvariants:
     tags: <% out([...(variant.tags ?? [])]) %>
     expansions:
       executable_os_id: "<% out(variant.executableOsId) %>"
-      disable_openssl_shared_config_for_bundled_openssl: <% out(variant.disableOpenSslSharedConfig || false) %>
       node_js_version: "<% out(NODE_JS_VERSION_20) %>"
       mongosh_server_test_version: "<% out(variant.mVersion) %>-enterprise"
       mongosh_test_e2e_force_fips: "<% out(variant.fips ? '1' : '') %>"
@@ -1718,12 +1713,21 @@ buildvariants:
     run_on: rhel8-zseries-small
     tasks:
       - name: pkg_test_rpmextract_rpm_s390x
+  - name: pkg_smoke_tests_rhel9_s390x
+    display_name: "package smoke tests (RHEL 9 s390x)"
+    run_on: rhel9-zseries-small
+    tasks:
+      - name: pkg_test_rpmextract_rpm_s390x
   - name: pkg_smoke_tests_rhel8_ppc64le
     display_name: "package smoke tests (RHEL 8 ppc64le)"
     run_on: rhel8-power-small
     tasks:
       - name: pkg_test_rpmextract_rpm_ppc64le
-
+  - name: pkg_smoke_tests_rhel9_ppc64le
+    display_name: "package smoke tests (RHEL 9 ppc64le)"
+    run_on: rhel9-power-small
+    tasks:
+      - name: pkg_test_rpmextract_rpm_ppc64le
   - name: draft_publish_release
     display_name: "Draft/Publish Release"
     run_on: ubuntu2004-small

.evergreen/evergreen.yml.in

@@ -3,15 +3,6 @@ set -e
 export NODE_JS_VERSION=${NODE_JS_VERSION}
 export TASK_NAME=${TASK_NAME}
 
-if [[ "$DISABLE_OPENSSL_SHARED_CONFIG_FOR_BUNDLED_OPENSSL" == "true" ]] && [[ ! "$TASK_NAME" =~ openssl(3|11) ]]; then
-  # On RHEL9 and based-distros, an additional configuration option
-  # `rh-allow-sha1-signatures` is present which is not recognizable to the
-  # OpenSSL version bundled with Node.js and hence the mongosh binary fails to
-  # run. Explicitly on those hosts we disable effect of --openssl-shared-config
-  # flag which is pushed by boxednode when bundling Node.js
-  export OPENSSL_CONF=""
-fi
-
 source .evergreen/setup-env.sh
 dist/mongosh --version
 

.evergreen/run-e2e-tests.sh

@@ -1,12 +1,5 @@
 FROM amazonlinux:2023
 
-# On RHEL9 and based-distros, an additional configuration option
-  # `rh-allow-sha1-signatures` is present which is not recognizable to the
-  # OpenSSL version bundled with Node.js and hence the mongosh binary fails to
-  # run. Explicitly on those hosts we disable effect of --openssl-shared-config
-  # flag which is pushed by boxednode when bundling Node.js
-ENV OPENSSL_CONF=""
-
 ARG artifact_url=""
 ADD ${artifact_url} /tmp
 ADD node_modules /usr/share/mongodb-crypt-library-version/node_modules

scripts/docker/amazonlinux2023-rpm.Dockerfile

@@ -0,0 +1,14 @@
+diff --git a/deps/openssl/openssl/crypto/evp/evp_cnf.c b/deps/openssl/openssl/crypto/evp/evp_cnf.c
+index 0e7fe64cf9..bdba3638ee 100644
+--- a/deps/openssl/openssl/crypto/evp/evp_cnf.c
++++ b/deps/openssl/openssl/crypto/evp/evp_cnf.c
+@@ -57,6 +57,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)
+                 ERR_raise(ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE);
+                 return 0;
+             }
++        } else if (strcmp(oval->name, "rh-allow-sha1-signatures") == 0) {
++            /* allow and then ignore this option */
++
+         } else {
+             ERR_raise_data(ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION,
+                            "name=%s, value=%s", oval->name, oval->value);