Repository navigation
Slice 003: FIPS build leg in CI, from source - #34
Merged
Merged
Conversation
…pens ROADMAP row 003 to in_progress. NOTES.md records that the UBI9 container enters FIPS mode by Red Hat's OPENSSL_FORCE_FIPS_MODE on a host that is not in FIPS mode (Ed25519 refused, P-384 signs), that UBI 9.8 ships OpenSSL 3.5.8 with the 3.0.7 FIPS provider, then the eight-line build plan, the empty manual queue, and two deviations stated before any code. plan_check: PASS. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…he supports record ci/fips/Containerfile builds OTP 28.5.0.5 from source with --enable-fips against UBI9's OpenSSL (both archives pinned by SHA-256, the base by digest); fips-image.yml pushes it under the tag scripts/fips_image_tag.sh derives from the two files that define it; the gate gains the fips-tag and fips jobs, which enter the mode with OTP's own fips_mode setting through ERL_AFLAGS (the crypto application loaded first, measured as the condition). test/fips/mode_test.exs binds TRINITY_FIPS_LEG to crypto:info_fips/0 everywhere and carries AC1 to AC3 under the :fips tag; scripts/crypto_supports.exs prints the listing and docs/fips-leg/ holds both listings and their diff (51 entries removed). The gate's hex.audit step clears ERL_AFLAGS: Hex 2.5.1 offers TLS 1.0 and 1.1 and ssl in the mode refuses the set (docs/fips-leg.md, finding 1). Measured in the image on this machine: mix gate exit 0 in the mode, 268 passed, 12 excluded; on this machine, 265 passed, 15 excluded. Signed-off-by: Ayla Croft <aylacroft@proton.me>
The final RUN matched ok where crypto:enable_fips_mode/1 returns true, so the first fips-image run (35536968071) failed at the check after a complete build. Measured locally: the image now builds through the check. Signed-off-by: Ayla Croft <aylacroft@proton.me>
The leg's supports step failed on run 35537134655 with 'diff: command not found': UBI9's base carries no diffutils. Added to the package list; the tag rolls with the file. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Run 35537462271: plan_check rule 4 named every slice as missing its SLICE.md, because git ls-files inside the container read an empty tree; the checkout action's safe.directory entry lives under a HOME it removes afterwards. One git config line before anything reads the tree. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…ir whole input Under set -o pipefail, printf | grep -q exits at the first match and printf can take SIGPIPE on the rest; the pipeline then reports 141 and the rule a miss. Measured on a clean tree: 1 spurious FAIL in 30 runs (the ADR-0005 citation in slices/001), 0 in 60 after the change. Found at slice 003 when a local run failed and the next three passed. Signed-off-by: Ayla Croft <aylacroft@proton.me>
After the gate, the fips job repeats test/fips with --trace so AC2 and AC3 read by test name against a run id, and runs the suite under the coverage tool once for AC5's line. Signed-off-by: Ayla Croft <aylacroft@proton.me>
PROOF.md with every criterion's evidence against run 35538136447 (the gate in the mode: 268 passed, 12 excluded, exit 0; the four FIPS tests by name; both legs' coverage at 75.39 %). NOTES.md: ten findings, the runner minutes so far, follow-ups for 002 and 024. docs/fips-leg.md records that no test in the tree reaches a removed algorithm on this date. The standards register row for FIPS names what 003 established and what stays unknown. ROADMAP row 003 to done; coverage.tsv row added. Gate exit 0 here: 265 passed, 15 excluded, plan_check PASS. Signed-off-by: Ayla Croft <aylacroft@proton.me>
…se's run and a flake for 021 The closing correction names 567507d. The minutes table gains run 35538464458 (fips 3m46s). Finding 11 records the default leg's one red on that run, session_flow_test.exs:108 after a Gate crash on a sandbox ownership error, passed on rerun; owned by slice 021, listed as a fix(s021) follow-up. Signed-off-by: Ayla Croft <aylacroft@proton.me>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A
fipsjob in the gate runs the whole gate on an OTP 28.5.0.5 built from source with--enable-fips, in FIPS mode, against the FIPS provider of a UBI9 container. The image is built byfips-image.ymland pulled by a tag derived from the files that define it. PROOF.md atslices/003-fips-build-leg/PROOF.md; the record atdocs/fips-leg.md.Measured: the mode is entered by OTP's own
fips_modesetting with the crypto application loaded first (ERL_AFLAGS);ERL_FLAGSalone leaves it off. FIPS mode removes 51crypto:supports/0entries on this build (committed diff). No test in the tree reaches a removed algorithm: 268 passed on the leg, exit 0.Two findings reach past the leg (docs/fips-leg.md): Hex 2.5.1 offers TLS 1.0 and 1.1 and cannot reach hex.pm in the mode, so the gate's
hex.auditstep clearsERL_AFLAGS; OTP's TLS 1.3 client fails HelloRetryRequests (erlang/otp#8470), which the mode makes common, and slice 002 owns the client-side fix. Also carried:fix(s000)for aplan_check.shflake underpipefail(1 in 30 runs).Signed-off-by: Ayla Croft aylacroft@proton.me