Configure the Apache™ Ant plugin for FIPS compliance

End-of-life announcement

CloudBees CI 2.516.3.29358 was the last version of CloudBees CI on modern cloud platforms to produce Federal Information Processing Standards (FIPS)-compliant images.

This end-of-life announcement allows CloudBees to focus on driving new technology and product innovation as well as maintaining existing products and standards that are actively used by customers.

After CloudBees CI 2.516.3.29358, FIPS support will be discontinued and will no longer be supported. CloudBees recommends removing any dependencies on FIPS support and discontinuing its use immediately.

For more information regarding this end-of-life announcement, please contact CloudBees Support.

To build Apache™ Ant projects as part of the CloudBees Assurance Program (CAP), CloudBees CI includes the Ant plugin that contains features and pre-default configuration settings to build Apache Ant projects.

By default, the Apache Ant build uses the default JDK provided by the agent. To enable FIPS mode on the JDK installation of the Jenkins agent executing the build along with jvmargs, run the following Java arguments:

-Xbootclasspath/a:/usr/share/jenkins/fips/bc-fips.jar:/usr/share/jenkins/fips/bctls-fips.jar:/usr/share/jenkins/fips/bcpkix-fips.jar:/usr/share/jenkins/fips/bcutil-fips.jar:/usr/share/jenkins/fips/fips-security-manager.jar
-Dorg.bouncycastle.fips.approved_only=true
-Dcom.redhat.fips=false
-Djavax.net.ssl.trustStoreType=PKCS12▼

jvmargs can be passed through as an ANT_OPT setting in the build.xml file, as a JAVA_OPT setting in the pipeline script if the job is a pipeline, or in the Invoke Ant build step if the job is a FreeStyle job.

CloudBees cannot guarantee FIPS 140-3 compliance of an external JDK, Apache Ant distribution, or any of the Ant plugins downloaded or used during the build.