Request 1087087: Submit crypto-policies

Overview

Request 1087087 revoked

No description set

Created by pluskalm about 1 year ago
In state revoked
Open review for opensuse-review-team

Submit crypto-policies

Comments for request 1087087 5

Dominique Leuenberger (dimstar) - about 1 year ago

reviewer

Pleanty of things broken in Staging:N - this SR is the only one staged there, so all failures are consequences of this submission

https://build.opensuse.org/project/monitor/openSUSE:Factory:Staging:N?blocked=0&building=0&dispatching=0&finished=0&scheduled=0&signing=0&succeeded=0

Pedro Monreal Gonzalez (pmonrealgonzalez) - about 1 year ago

source maintainer

Ouch! Most of the failures should be related to OpenSSL SHA1 stuff deprecation. Can we keep this staging project for some time to analyze it properly? TIA

Dominique Leuenberger (dimstar) - about 1 year ago

reviewer

[  141s] + openssl dgst -sha256 -binary -hmac HMAC_KEY:OpenSSH-FIPS@SLE
[  141s] FATAL: Startup failure (dev note: apps_startup()) for openssl
[  141s] 40872AF4157F0000:error:030000A9:digital envelope routines:alg_module_init:unknown option:crypto/evp/evp_cnf.c:61:name=rh-allow-sha1-signatures, value=yes
[  141s] 40872AF4157F0000:error:0700006D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:270:module=alg_section, value=evp_properties retcode=-1

Pedro Monreal Gonzalez (pmonrealgonzalez) - about 1 year ago

source maintainer

So, this 'unknown option' was introduced by RH in crypto-policies in this commit: * https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/110/diffs

And openssl now expects it, IMHO it should have been introduced as a patch from RH to keep upstream compatible with any openssl. We are considering enabling this option in OpenSSL 3.1 that brings SHA-1 enablement/disablement for seclevels...

Pedro Monreal Gonzalez (pmonrealgonzalez) - about 1 year ago

source maintainer

New version submitted here: https://build.opensuse.org/request/show/1089055