Horton

Re: Replace current implementations in crypt() and gen_salt() to OpenSSL

Daniel Gustafsson <daniel@yesql.se>

View thread View on postgr.es
From: Daniel Gustafsson <daniel@yesql.se>
To: "Koshi Shibagaki (Fujitsu)" <shibagaki.koshi@fujitsu.com>
Cc: Joe Conway <mail@joeconway.com>, "Hayato Kuroda (Fujitsu)" <kuroda.hayato@fujitsu.com>, Peter Eisentraut <peter@eisentraut.org>, Robert Haas <robertmhaas@gmail.com>, "pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Date: 2025-01-20T07:54:04Z
Lists: pgsql-hackers 
> On 20 Jan 2025, at 01:26, Koshi Shibagaki (Fujitsu) <shibagaki.koshi@fujitsu.com> wrote:
> 
> Thank you for moving this discussion forward.
> 
>> Maybe we could document that the test should fail if fips is enabled?
>> 
>> FWIW I have not tested at all on a fips enabled machine. I will see about doing
>> that...
> I tested all on a fips enabled machine and test failed.
> Since all tests have been made to run even with FIPS enabled in PostgreSQL 17, 
> it would be ideal for this test to follow suit.
> Following the modification that made the citext tests compatible with FIPS mode[1], 
> how about make multiple expected output?

Agreed, I'll roll that into the next version of the patch.

--
Daniel Gustafsson

Commits

  1. pgcrypto: Make it possible to disable built-in crypto

  2. pgcrypto: Add function to check FIPS mode

  3. citext: Allow tests to pass in OpenSSL FIPS mode

  4. pgcrypto: Remove non-OpenSSL support