Skip to content

Adjust FIPS integrity check

Zoltán Fridrich requested to merge ZoltanFridrich/gnutls:zfridric_devel into master
  • FIPS integrity check will no longer check whether paths returned from dynamic linker match paths from the hmac file. The library path check is being dropped as checking the HMAC of libraries should be sufficient. Checking the exact path where the library resides showed to be failure prone. The sonames of libraries are internally indirectly compared.

  • Changes behavior of fipshmac to always work with realpaths. This change is supposed to canonicalize the paths stored in fipshmac instead of storing symlinks.

Closes #1426 (closed)

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated / NEWS entry present (for non-trivial changes)
  • CI timeout is 2h or higher (see Settings/CICD/General pipelines/Timeout)

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTION.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code
Edited by Zoltán Fridrich

Merge request reports