gpdb icon indicating copy to clipboard operation
gpdb copied to clipboard

6X pgcrypto: allow enable FIPS in FIPS not enabled OS

Open Sasasu opened this issue 3 years ago • 0 comments

old pgcrypto use FIPS_mode() == 0 to check if can enable FIPS or not. but FIPS_mode() return none zero means FIPS already initialized by the OS or env OPENSSL_FIPS=1

this PR removes the check, allow to enable FIPS on a none FIPS OS

7X: #13905

ci test case:

for 7X we have

  • rhel8 with OpenSSL 1.1.1k FIPS 25 Mar 2021: FIPS_mode() support at application level, not certified
  • centos7 with OpenSSL 1.0.2k-fips 26 Jan 2017: FIPS_mode() support at application level, not certified
  • ubuntu 18.04 with OpenSSL 1.1.1 11 Sep 2018: FIPS_mode not enabled

for 6X we have

  • sles12 with OpenSSL 1.0.2p-fips 14 Aug 2018: FIPS_mode() support at application level, not certified
  • photon3 with OpenSSL 1.0.2zc-fips 22 Feb 2022: FIPS_mode() support at application level, not certified
  • rhel8 with OpenSSL 1.1.1k FIPS 25 Mar 2021: FIPS_mode() support at application level, not certified
  • centos6 with OpenSSL 1.0.1e-fips 11 Feb 2013: FIPS_mode() support at application level, not certified
  • centos7 with OpenSSL 1.0.2k-fips 26 Jan 2017: FIPS_mode() support at application level, not certified
  • ubuntu 18.04 with OpenSSL 1.1.1 11 Sep 2018: FIPS_mode not enabled

no user behavior change, no need to modify document

Sasasu avatar Sep 07 '22 05:09 Sasasu