Subject: Re: New buildfarm animals with FIPS mode enabled

From: Tom Lane <[email-masked]>
Date: Mon, 17 Feb 2025 14:23:55 -0500

Daniel Gustafsson <[email-masked]> writes:
> On 17 Feb 2025, at 17:26, Tom Lane <[email-masked]> wrote:
>> I believe the main concern is OpenSSL 1.x versus 3.x, not a specific
>> platform.

> Isn't it postgres version mostly?  We fixed so the testsuite passed on FIPS
> enabled machines by just not using anything that violates FIPS but I don't
> remember anything OpenSSL version specific.

No, there are two distinct problems:

1. We "support" FIPS in the regression tests by providing variant
expected-files that represent the error messages that you'll get in
FIPS mode.  Currently, there's only one such variant file per test
and it shows the error message spelling you get from OpenSSL 3.x.
1.x has a different spelling, cf [1].

2. None of this support existed before PG v17.

It'd be practical to crank up FIPS-mode BF animals on OpenSSL 3.x
platforms so long as you make them test only branches >= v17.
Such animals on OpenSSL 1.x will fail on all branches.

Obviously, we could talk about extending the regression tests'
support for these cases, but I'm really dubious that it's worth
the work.

			regards, tom lane

[1] https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=cixiid&dt=2025-02-13%2009%3A27%3A17

---

From: Daniel Gustafsson <[email-masked]>
Date: Mon, 17 Feb 2025 20:45:12 +0100

> On 17 Feb 2025, at 20:23, Tom Lane <[email-masked]> wrote:

Ah, right, thanks.

> support for these cases, but I'm really dubious that it's worth

Agreed.

--
Daniel Gustafsson

---

From: Álvaro Herrera <[email-masked]>
Date: Tue, 18 Feb 2025 14:41:18 +0100

> > support for these cases, but I'm really dubious that it's worth

This means that unless Mark is willing to install OpenSSL 3 from source,
these buildfarm animals are not viable.  I'll wait for Mark to confirm,
but given the number of animals he maintains, I think it's not really
feasible to have some which require individual patching work.

-- 
Álvaro Herrera        Breisgau, Deutschland  —  https://www.EnterpriseDB.com/