Subject: Re: New buildfarm animals with FIPS mode enabled

From: Álvaro Herrera <[email-masked]>
Date: Mon, 17 Feb 2025 11:36:29 +0100

Hello,

So in light of this conversation, what to do about the following pending
requests?

pgbfprod=> select format('%s %s', operating_system, os_version) as "OS" from pending();
                     OS                      
---------------------------------------------
 Ubuntu 20.04.6 LTS (Focal Fossa) FIPS-140
 Ubuntu 20.04.6 LTS (Focal Fossa) FIPS-140
 Ubuntu 18.04.6 LTS (Bionic Beaver) FIPS-140

As I understand, both of these Ubuntu versions ship with OpenSSL 1.1,
though of course OpenSSL 3 could be installed on them.  Should I just
delete these requests?

Thanks

-- 
Álvaro Herrera               48°01'N 7°57'E  —  https://www.EnterpriseDB.com/
"Los dioses no protegen a los insensatos.  Éstos reciben protección de
otros insensatos mejor dotados" (Luis Wu, Mundo Anillo)

---

From: Mark Wong <[email-masked]>
Date: Mon, 17 Feb 2025 08:10:32 -0800

> On Feb 17, 2025, at 2:36 AM, Álvaro Herrera <[email-masked]> wrote:
> Hello,
> 

I’m away from my desk until later this week so I don’t recall whether Ubuntu with FIPS is supposed to work.  If someone already knows I’m ok with deleting them. Otherwise I will double check soon…

Regards,
Mark

---

From: Tom Lane <[email-masked]>
Date: Mon, 17 Feb 2025 11:26:53 -0500

> I’m away from my desk until later this week so I don’t recall whether Ubuntu with FIPS is supposed to work.  If someone already knows I’m ok with deleting them. Otherwise I will double check soon…

I believe the main concern is OpenSSL 1.x versus 3.x, not a specific
platform.

			regards, tom lane

---

From: Daniel Gustafsson <[email-masked]>
Date: Mon, 17 Feb 2025 20:03:39 +0100

> On 17 Feb 2025, at 17:26, Tom Lane <[email-masked]> wrote:
> 

Isn't it postgres version mostly?  We fixed so the testsuite passed on FIPS
enabled machines by just not using anything that violates FIPS but I don't
remember anything OpenSSL version specific.

--
Daniel Gustafsson