Skip to content
Snippets Groups Projects
user avatar
Stan Hu authored
In the Ubuntu 18.04 FIPS builds, currently `OpenSSL.fips_mode` is
`false`, which prevents GitLab from entering FIPS mode.

Even though these builds properly link against the FIPS-enabled system
OpenSSL, this flag is `false` because Ruby compiles out the dynamic
`FIPS_mode()` checks (https://wiki.openssl.org/index.php/FIPS_mode())
unless the `OPENSSL_FIPS` macro is defined. In RedHat, `OPENSSL_FIPS`
is always defined in `/usr/include/openssl/opensslconf-x86_64.h`, but
this is not the case for Ubuntu. On non FIPS-systems, `FIPS_mode()`
should return 0 (not available), so this compile-time guard should not
be necessary. For now, we only enable it for builds that link
against the system SSL.

Relates to https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6775

Changelog: fixed
7f6ff530
History
Name Last commit Last update