Skip to content

Don't specifically check for BoringSSL in FIPS builds

What does this MR do?

In go-fips, BoringSSL was always a passthrough to the system OpenSSL. This fact was not entirely clear from the documentation, but it could be proven by the fact that binaries had a dlopen() for OpenSSL and the openssl-fips module would present a boringcrypto interface but really pass the calls through to OpenSSL.

In go-fips 1.22, the openssl-fips module was replaced with a new one that no longer presents a boringcrypto API and instead just calls OpenSSL directly. As such, the check for boringcrypto to verify FIPS was not only never really correct, it is now causing failures.

We can instead verify FIPS just by searching for symbols containing "FIPS". That does the same thing the boringcrypto check did before.

Closes #1115 (closed)

TODO

Edited by Ryan Egesdahl

Merge request reports

Loading