Skip to content

Conversation

@stevegaossou
Copy link
Contributor

@stevegaossou stevegaossou commented Dec 6, 2025

Description

This pull request removes the tests tied to the crypto folder which were focused on testing FIPS compliance.

Since we no longer officially support FIPS compliance, we don't need these tests anymore. See this GitHub issue discussion for some context.

Note: This pull request does not include completely cleaning out references to FIPS throughout the repo.

Related issues/PRs

Todos

  • Tests
  • Documentation
  • Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

  • docs-pr-required: This change requires a change to the documentation that has not been completed yet.
  • docs-completed: This change has all necessary documentation completed.
  • docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

  • release-note-required: This PR has user-facing changes. Most PRs should have this label.
  • release-note-not-required: This PR has no user-facing changes.

Other optional labels:

  • cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
  • needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

Copilot AI review requested due to automatic review settings December 6, 2025 01:28
@stevegaossou stevegaossou requested a review from a team as a code owner December 6, 2025 01:28
@marvin-tigera marvin-tigera added this to the Calico v3.32.0 milestone Dec 6, 2025
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Dec 6, 2025
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR removes FV (Functional Verification) tests and related infrastructure for the crypto package that were specifically tied to FIPS validation. The changes simplify the crypto package by removing test-only build artifacts while preserving the core TLS functionality.

Key Changes

  • Removes the crypto FV test server and expected output files used for FIPS cipher validation
  • Eliminates build tag files (fipstls.go, nonfipstls.go) and the BuiltWithBoringCrypto constant that were used only for testing
  • Cleans up unnecessary logging that was specific to FIPS test debugging
  • Removes the crypto CI block template from Semaphore configuration

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated no comments.

Show a summary per file
File Description
crypto/pkg/tls/tls.go Removed logrus import and debug log statement that logged the BuiltWithBoringCrypto flag during TLS config creation
crypto/pkg/tls/nonfipstls.go Deleted build tag file that defined BuiltWithBoringCrypto constant as false for non-FIPS builds
crypto/pkg/tls/fipstls.go Deleted build tag file that enabled FIPS strict mode and defined BuiltWithBoringCrypto constant as true
crypto/fv/main/main.go Removed FV test server that validated FIPS TLS configuration by serving HTTPS and reporting crypto mode
crypto/fv/expected-nmap.log Deleted expected nmap output file used to validate TLS cipher suites in FV tests
crypto/deps.txt Removed auto-generated dependency tracking file for the crypto package
crypto/Makefile Deleted Makefile containing FV test targets and FIPS binary build commands
.semaphore/semaphore.yml.d/blocks/20-crypto.yml Removed CI block template that ran crypto FV tests in the CI pipeline
Comments suppressed due to low confidence (1)

.semaphore/semaphore.yml.d/blocks/20-crypto.yml:1

  • The crypto CI block template has been removed, but the generated CI configuration files need to be regenerated. After removing .semaphore/semaphore.yml.d/blocks/20-crypto.yml, you should run make gen-semaphore-yaml to regenerate .semaphore/semaphore.yml (which still contains the crypto block at lines 315-327) and check it in. Additionally, .semaphore/semaphore-scheduled-builds.yml also needs to be updated as it still contains the Crypto block at lines 315-327.

@stevegaossou stevegaossou force-pushed the stevegaossou-remove-crypto-tests-fips branch from 4c8066b to 8a112b0 Compare December 6, 2025 01:43
@stevegaossou stevegaossou changed the title Remove FV tests for crypto package tied to FIPS. Remove FV tests for crypto package tied to FIPS Dec 6, 2025
@stevegaossou stevegaossou force-pushed the stevegaossou-remove-crypto-tests-fips branch from 8a112b0 to 6daefeb Compare December 6, 2025 02:31
@stevegaossou stevegaossou removed release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Dec 6, 2025
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Dec 6, 2025
@stevegaossou stevegaossou added docs-not-required Docs not required for this change release-note-not-required Change has no user-facing impact and removed release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Dec 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

docs-not-required Docs not required for this change release-note-not-required Change has no user-facing impact

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants