Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(fips): remove keystore subcommand and config handling #15545

Merged
merged 4 commits into from
Feb 7, 2025
Merged

feat(fips): remove keystore subcommand and config handling #15545

merged 4 commits into from
Feb 7, 2025

Conversation

kruskall
Copy link
Member

@kruskall kruskall commented Feb 4, 2025 •
edited
Loading

Motivation/summary

the keystore is providing obfuscation of data on disk by using an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one when loading the config.

Checklist

For functional changes, consider:

  • Is it observable through the addition of either logging or metrics?
  • Is its use being published in telemetry to enable product improvement?
  • Have system tests been added to avoid regression?

How to test these changes

  • download gotip/go1.24
  • build apm-server with the stdlib in fips only mode
  • run apm-server

Related issues

@kruskall
feat(fips): remove keystore subcommand and config handling
f7434ce 
the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.
@kruskall kruskall requested a review from a team as a code owner February 4, 2025 17:01
@mergify Mergify
Copy link
Contributor

mergify bot commented Feb 4, 2025

This pull request does not have a backport label. Could you fix it @kruskall? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-7.17 is the label to automatically backport to the 7.17 branch.
  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit.
  • backport-9./d is the label to automatically backport to the 9./d branch. /d is the digit.
  • backport-8.x is the label to automatically backport to the 8.x branch.

@kruskall kruskall added backport-8.x Automated backport to the 8.x branch with mergify backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch labels Feb 4, 2025
1pkg
1pkg previously approved these changes Feb 4, 2025
View reviewed changes
@kruskall kruskall requested a review from 1pkg February 5, 2025 13:07
@kruskall kruskall enabled auto-merge (squash) February 7, 2025 13:55
@kruskall kruskall merged commit 4a2a1dc into elastic:main Feb 7, 2025
12 checks passed
@kruskall kruskall deleted the feat/fips-remove-keystore branch February 7, 2025 14:05
mergify bot pushed a commit that referenced this pull request Feb 7, 2025
@kruskall @mergify
feat(fips): remove keystore subcommand and config handling (#15545)
1b98b6d 
* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)
mergify bot pushed a commit that referenced this pull request Feb 7, 2025
@kruskall @mergify
feat(fips): remove keystore subcommand and config handling (#15545)
da563bb 
* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)
mergify bot pushed a commit that referenced this pull request Feb 7, 2025
@kruskall @mergify
feat(fips): remove keystore subcommand and config handling (#15545)
ea4743f 
* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)
This was referenced Feb 7, 2025
Merged
Merged
Merged
mergify bot added a commit that referenced this pull request Feb 7, 2025
@mergify @kruskall
feat(fips): remove keystore subcommand and config handling (#15545) (#…
8be8005 
…15591)

* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)

Co-authored-by: kruskall <[email protected]>
mergify bot added a commit that referenced this pull request Feb 7, 2025
@mergify @kruskall
feat(fips): remove keystore subcommand and config handling (#15545) (#…
d244d09 
…15590)

* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)

Co-authored-by: kruskall <[email protected]>
mergify bot added a commit that referenced this pull request Feb 7, 2025
@mergify @kruskall
feat(fips): remove keystore subcommand and config handling (#15545) (#…
d08540d 
…15589)

* feat(fips): remove keystore subcommand and config handling

the keystore is providing obfuscation of data on disk by using
an empty password by default.
This fails in fips only mode with the following error:

crypto/hmac: use of keys shorter than 112 bits is not allowed in FIPS 140-only mode

Disable the keystore subcommand and do not try to create one
when loading the config.

* Update config_nofips_test.go

---------

Co-authored-by: Kostiantyn Masliuk <[email protected]>
(cherry picked from commit 4a2a1dc)

Co-authored-by: kruskall <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@1pkg 1pkg 1pkg approved these changes

Assignees
No one assigned
Labels
backport-8.x Automated backport to the 8.x branch with mergify backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@kruskall @1pkg