-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Remove FV tests for crypto package tied to FIPS #11507
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Remove FV tests for crypto package tied to FIPS #11507
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR removes FV (Functional Verification) tests and related infrastructure for the crypto package that were specifically tied to FIPS validation. The changes simplify the crypto package by removing test-only build artifacts while preserving the core TLS functionality.
Key Changes
- Removes the crypto FV test server and expected output files used for FIPS cipher validation
- Eliminates build tag files (
fipstls.go,nonfipstls.go) and theBuiltWithBoringCryptoconstant that were used only for testing - Cleans up unnecessary logging that was specific to FIPS test debugging
- Removes the crypto CI block template from Semaphore configuration
Reviewed changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| crypto/pkg/tls/tls.go | Removed logrus import and debug log statement that logged the BuiltWithBoringCrypto flag during TLS config creation |
| crypto/pkg/tls/nonfipstls.go | Deleted build tag file that defined BuiltWithBoringCrypto constant as false for non-FIPS builds |
| crypto/pkg/tls/fipstls.go | Deleted build tag file that enabled FIPS strict mode and defined BuiltWithBoringCrypto constant as true |
| crypto/fv/main/main.go | Removed FV test server that validated FIPS TLS configuration by serving HTTPS and reporting crypto mode |
| crypto/fv/expected-nmap.log | Deleted expected nmap output file used to validate TLS cipher suites in FV tests |
| crypto/deps.txt | Removed auto-generated dependency tracking file for the crypto package |
| crypto/Makefile | Deleted Makefile containing FV test targets and FIPS binary build commands |
| .semaphore/semaphore.yml.d/blocks/20-crypto.yml | Removed CI block template that ran crypto FV tests in the CI pipeline |
Comments suppressed due to low confidence (1)
.semaphore/semaphore.yml.d/blocks/20-crypto.yml:1
- The crypto CI block template has been removed, but the generated CI configuration files need to be regenerated. After removing
.semaphore/semaphore.yml.d/blocks/20-crypto.yml, you should runmake gen-semaphore-yamlto regenerate.semaphore/semaphore.yml(which still contains the crypto block at lines 315-327) and check it in. Additionally,.semaphore/semaphore-scheduled-builds.ymlalso needs to be updated as it still contains the Crypto block at lines 315-327.
4c8066b to
8a112b0
Compare
8a112b0 to
6daefeb
Compare
Description
This pull request removes the tests tied to the
cryptofolder which were focused on testing FIPS compliance.Since we no longer officially support FIPS compliance, we don't need these tests anymore. See this GitHub issue discussion for some context.
Note: This pull request does not include completely cleaning out references to FIPS throughout the repo.
Related issues/PRs
Todos
Release Note
Reminder for the reviewer
Make sure that this PR has the correct labels and milestone set.
Every PR needs one
docs-*label.docs-pr-required: This change requires a change to the documentation that has not been completed yet.docs-completed: This change has all necessary documentation completed.docs-not-required: This change has no user-facing impact and requires no docs.Every PR needs one
release-note-*label.release-note-required: This PR has user-facing changes. Most PRs should have this label.release-note-not-required: This PR has no user-facing changes.Other optional labels:
cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.