Code

Support for FIPS compliance mode#14912

Code

Open

beanuwave wants to merge 16 commits intoopensearch-project:mainopensearch-project/OpenSearch:mainfrom sternadsoftware:fips_compliance2sternadsoftware/OpenSearch:fips_compliance2Copy head branch name to clipboard

+3,070-2,285

Commits

Commits on Jan 27, 2025

• Draft to allow run in FIPS compliace mode

  Show description for 344324d
  iigonin

  committed
  344324d

  Copy full SHA for 344324d

• make tests run without BC (not BCFIPS) libraries.

  Show description for 5548f7f
  iigonin

  committed
  5548f7f

  Copy full SHA for 5548f7f

• disable approved-only mode for launch configuration of testcluster

  Show description for d593e10
  iigonin

  committed
  d593e10

  Copy full SHA for d593e10

• update all BC libraries to support JAVA 21

  Show description for 3b6c586
  iigonin

  committed
  3b6c586

  Copy full SHA for 3b6c586

• try to pass bwc staged build by adding expected version

  Show description for 5699a70
  iigonin

  committed
  5699a70

  Copy full SHA for 5699a70

• ensure FIPS-mode can be enabled by fixing existent and creating additional tests.

  Show description for 8c7ae62
  iigonin

  committed
  8c7ae62

  Copy full SHA for 8c7ae62

• fixing additional tests.

  Show description for 896d031
  iigonin

  committed
  896d031

  Copy full SHA for 896d031

• Configure FIPS mode through global ENV VAR instead of thread-based.

  Show description for 16ed91b
  iigonin

  committed
  16ed91b

  Copy full SHA for 16ed91b

• write some additional unit tests.

  Show description for 50fac9a
  iigonin

  committed
  50fac9a

  Copy full SHA for 50fac9a

• test SystemJvmOptions.java & replace FIPS-140-2 by FIPS-140-3

  Show description for 1a45b62
  iigonin

  committed
  1a45b62

  Copy full SHA for 1a45b62

• categorize JKS keystore as untrusted

  Show description for daa9bb6
  iigonin

  committed
  daa9bb6

  Copy full SHA for daa9bb6

• general exclusion of keystore binaries and certificates from fobiddenPattern

  Show description for 6fefb4a
  iigonin

  committed
  6fefb4a

  Copy full SHA for 6fefb4a

• Kerberos, forbiddenApis, SecureRandom, SunJCE, AzureTests

  Show description for 6b3cf21
  iigonin

  committed
  6b3cf21

  Copy full SHA for 6b3cf21

• remove BC libs from 'libs:common'; revert SecureRandomHolder

  Show description for 7594a65
  iigonin

  committed
  7594a65

  Copy full SHA for 7594a65

• loosen some direct BC dependencies

  Show description for a267053
  iigonin

  committed
  a267053

  Copy full SHA for a267053

• set default testcluster password for all project modules

  iigonin

  committed
  20a3362

  Copy full SHA for 20a3362