From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Mark Wong <markwkm@gmail.com>,
        =?utf-8?Q?=C3=81lvaro_Herrera?= <alvherre@alvh.no-ip.org>,
        pgsql-hackers <pgsql-hackers@lists.postgresql.org>,
        buildfarm@enterprisedb.com
Subject: Re: New buildfarm animals with FIPS mode enabled
In-reply-to: <1CB7E685-9D71-4690-860F-5533119C0997@yesql.se>
References: <202502171036.e333mhga2262@alvherre.pgsql> <8DBA7EE1-1B9A-4F22-A53F-1C6FB99C2F8D@gmail.com> <830661.1739809613@sss.pgh.pa.us> <1CB7E685-9D71-4690-860F-5533119C0997@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Mon, 17 Feb 2025 20:03:39 +0100"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <862709.1739820235.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 17 Feb 2025 14:23:55 -0500
Message-ID: <862710.1739820235@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/862710.1739820235%40sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
> On 17 Feb 2025, at 17:26, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> I believe the main concern is OpenSSL 1.x versus 3.x, not a specific
>> platform.

> Isn't it postgres version mostly?  We fixed so the testsuite passed on F=
IPS
> enabled machines by just not using anything that violates FIPS but I don=
't
> remember anything OpenSSL version specific.

No, there are two distinct problems:

1. We "support" FIPS in the regression tests by providing variant
expected-files that represent the error messages that you'll get in
FIPS mode.  Currently, there's only one such variant file per test
and it shows the error message spelling you get from OpenSSL 3.x.
1.x has a different spelling, cf [1].

2. None of this support existed before PG v17.

It'd be practical to crank up FIPS-mode BF animals on OpenSSL 3.x
platforms so long as you make them test only branches >=3D v17.
Such animals on OpenSSL 1.x will fail on all branches.

Obviously, we could talk about extending the regression tests'
support for these cases, but I'm really dubious that it's worth
the work.

			regards, tom lane

[1] https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=3Dcixiid&dt=3D=
2025-02-13%2009%3A27%3A17