gemstash
gemstash copied to clipboard
GEMSTASH-194 Support for FIPS Mode
This updates the digest usage from MD5 to SHA256 to support hosts that are configured in FIPS mode.
Fixes #194
If I understand this correctly, this change modifies the directory names for Storage's "Resources" (aka uploaded things).
That would be a breaking change, right?
Yes, it changes the hashing mechanism used in the storage structure to a FIPS-compliant cipher. It will break any cached resources from older versions. Upgraded systems would need to re-cache. A conversion really wouldn't be possible, because we'd be guessing at rolling back from safe_name
to name
with regards to casing.
Maybe add this as a flag at the moment and make it the default in a major version.
To suggest a flag name, I read a bit about the "FIPS mode" concept.
I like the MS registry key name best: FipsAlgorithmPolicy
.
It describes what we do to Gemstash when this new option is set. We choose crypto in FIPS-compliant ways.
As an option name --use-fips-algorithm-policy
(default: false
).
What are some better flag names?
@olleolleolle what about --fips
and have what it does in the description?
I added a PR on top of the @ayohrling one.