[artifacts] Remove default --openssl-legacy-provider (#213123)

# Release note

Legacy OpenSSL algorithms have been disabled by default. Further
information on which algorithms can be found at
https://docs.openssl.org/3.0/man7/OSSL_PROVIDER-legacy. These can be
re-enabled by adding `--openssl-legacy-provider` to
`$KBN_PATH_CONF/node.options`

config/node.options

@@ -10,6 +10,3 @@
 
 ## restore < Node 16 default DNS lookup behavior
 --dns-result-order=ipv4first
-
-## enable OpenSSL 3 legacy provider
---openssl-legacy-provider

src/dev/build/tasks/os_packages/docker_generator/templates/base/Dockerfile

@@ -155,9 +155,6 @@ COPY --chown=1000:0 config/kibana.yml /usr/share/kibana/config/kibana.yml
 {{#serverless}}
 ENV PROFILER_SIGNAL=SIGUSR1
 {{/serverless}}
-{{^opensslLegacyProvider}}
-RUN sed 's/\(--openssl-legacy-provider\)/#\1/' -i config/node.options
-{{/opensslLegacyProvider}}
 
 # Add the launcher/wrapper script. It knows how to interpret environment
 # variables and translate them to Kibana CLI options.

src/dev/build/tasks/os_packages/docker_generator/templates/dockerfile.template.ts

@@ -19,7 +19,6 @@ function generator(options: TemplateContext) {
   return Mustache.render(template.toString(), {
     wolfi: options.baseImage === 'wolfi',
     ubi: options.baseImage === 'ubi',
-    opensslLegacyProvider: !(options.cloud || options.serverless || options.fips),
     ...options,
   });
 }

src/setup_node_env/openssl_legacy_provider/index.js

@@ -1,20 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-var branch = require('../../../package.json').branch;
-var docsBranch = branch.match(/^\d\.\d\d?$/) || 'current';
-var openSSLLegacyProviderEnabled = require('./openssl_legacy_provider_enabled')();
-
-if (openSSLLegacyProviderEnabled) {
-  console.log(
-    'Kibana is currently running with legacy OpenSSL providers enabled! For details and instructions on how to disable see https://www.elastic.co/guide/en/kibana/' +
-      docsBranch +
-      '/production.html#openssl-legacy-provider'
-  );
-}

src/setup_node_env/openssl_legacy_provider/openssl_legacy_provider_enabled.js

@@ -1,15 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-var crypto = require('crypto');
-
-// The blowfish cipher is only available when node is running with the --openssl-legacy-provider flag
-module.exports = function () {
-  return crypto.getCiphers().includes('blowfish');
-};

src/setup_node_env/openssl_legacy_provider/openssl_legacy_provider_enabled.test.js

@@ -1,79 +0,0 @@
-/*
- * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
- * or more contributor license agreements. Licensed under the "Elastic License
- * 2.0", the "GNU Affero General Public License v3.0 only", and the "Server Side
- * Public License v 1"; you may not use this file except in compliance with, at
- * your election, the "Elastic License 2.0", the "GNU Affero General Public
- * License v3.0 only", or the "Server Side Public License, v 1".
- */
-
-var spawnSync = require('child_process').spawnSync;
-
-describe('openSSLLegacyProviderEnabled', function () {
-  function runLegacyProviderCheck(execOptions, nodeOptions) {
-    var result = spawnSync(
-      process.execPath,
-      (execOptions ? execOptions.split(' ') : []).concat([
-        '-p',
-        "require('./openssl_legacy_provider_enabled')()",
-      ]),
-      {
-        env: {
-          NODE_OPTIONS: nodeOptions || '',
-        },
-        encoding: 'utf-8',
-        cwd: __dirname,
-      }
-    );
-    var stdout = result.stdout.trim();
-    return stdout === 'true';
-  }
-
-  it('should be disabled by default', function () {
-    expect(runLegacyProviderCheck()).toBe(false);
-  });
-
-  describe('using NODE_OPTIONS', function () {
-    it('should be enabled when --openssl-legacy-provider is set', function () {
-      expect(runLegacyProviderCheck(null, '--openssl-legacy-provider')).toBe(true);
-    });
-
-    it('should be enabled when --openssl-legacy-provider is set after --no-openssl-legacy-provider', function () {
-      expect(
-        runLegacyProviderCheck(null, '--no-openssl-legacy-provider --openssl-legacy-provider')
-      ).toBe(true);
-    });
-
-    it('should be disabled when --no-openssl-legacy-provider is set', function () {
-      expect(runLegacyProviderCheck(null, '--no-openssl-legacy-provider')).toBe(false);
-    });
-
-    it('should be disabled when --no-openssl-legacy-provider is set after --openssl-legacy-provider', function () {
-      expect(
-        runLegacyProviderCheck(null, '--openssl-legacy-provider --no-openssl-legacy-provider')
-      ).toBe(false);
-    });
-  });
-
-  describe('using exec arguments', function () {
-    it('should be enabled when --openssl-legacy-provider is set', function () {
-      expect(runLegacyProviderCheck('--openssl-legacy-provider')).toBe(true);
-    });
-
-    it('should be enabled when --openssl-legacy-provider is set after --no-openssl-legacy-provider', function () {
-      expect(runLegacyProviderCheck('--no-openssl-legacy-provider --openssl-legacy-provider')).toBe(
-        true
-      );
-    });
-
-    it('should be disabled when --no-openssl-legacy-provider is set', function () {
-      expect(runLegacyProviderCheck('--no-openssl-legacy-provider')).toBe(false);
-    });
-
-    it('should be disabled when --no-openssl-legacy-provider is set after --openssl-legacy-provider', function () {
-      expect(runLegacyProviderCheck('--openssl-legacy-provider --no-openssl-legacy-provider')).toBe(
-        false
-      );
-    });
-  });
-});

src/setup_node_env/setup_env.js

@@ -15,4 +15,3 @@ require('./harden');
 require('symbol-observable');
 require('source-map-support').install();
 require('./node_version_validator');
-require('./openssl_legacy_provider');

src/setup_node_env/tsconfig.json

@@ -6,7 +6,6 @@
   "include": [
     "harden/**/*",
     "root/**/*",
-    "openssl_legacy_provider/**/*",
     "*.js",
     "*.ts",
   ],