Hi Apache Doris community, The current Doris master branch appears to pin OpenSSL 1.1.1s in thirdparty/vars.sh. OpenSSL 1.1.1 has reached upstream end of life, and OpenSSL 1.1.1s is also not the final release of the 1.1.1 branch.
For regulated deployments, we are also looking for FIPS 140-3 validated cryptography. I would like to understand whether the Doris community has plans to: 1. Upgrade the bundled OpenSSL dependency from OpenSSL 1.1.1s to a currently supported OpenSSL 3.x release. 2. Provide a supported build and deployment configuration that can use an OpenSSL 3 FIPS Provider backed by a FIPS 140-3 validated cryptographic module. 3. Ensure that Doris cryptographic operations can be configured to use only the approved FIPS provider when running in a FIPS-required environment. 4. Document which Doris components and third-party dependencies use OpenSSL or other cryptographic libraries so operators can validate that cryptographic operations do not bypass the configured FIPS provider. 5. Add CI or automated testing for an OpenSSL 3.x build, ideally including a FIPS-enabled configuration. This is an important requirement for deploying Doris in regulated environments. It would also address the security lifecycle concern associated with continuing to bundle an end-of-life OpenSSL 1.1.1 dependency. Is an OpenSSL 3.x migration already planned or being worked on? If not, would the community be open to adding this to the Doris roadmap and creating a tracking issue for the required work? Thank you.
