From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-hackers@lists.postgresql.org
cc: buildfarm@enterprisedb.com
Subject: New buildfarm animals with FIPS mode enabled
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3880578.1739556092.1@sss.pgh.pa.us>
Date: Fri, 14 Feb 2025 13:01:32 -0500
Message-ID: <3880579.1739556092@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/3880579.1739556092%40sss.pgh.pa.us>
Precedence: bulk

I see that somebody decided to crank up some animals running
RHEL8 and RHEL9 with FIPS mode turned on.  The RHEL9 animals
pass on v17 and master, but not older branches; the RHEL8
animals pass nowhere.  This is unsurprising given that the
v17-era commits that allowed our regression tests to pass
under FIPS mode (795592865 and a bunch of others) explicitly
targeted only OpenSSL 3:

    These new expected files currently cover the FIPS mode provided by
    OpenSSL 3.x as well as the modified OpenSSL 3.x from Red Hat (e.g.,
    Fedora 38), but not the modified OpenSSL 1.x from Red Hat (e.g.,
    Fedora 35).  (The latter will have some error message wording
    differences.)

I'm kind of disinclined to do all the work that'd be needed to turn
these animals completely green, especially when the reason to do it
seems to be that someone decided we should without any community
consultation.  Perhaps others have different opinions though.

Thoughts?

			regards, tom lane