GeezerVison

API keys are secrets, so FIPS builds must take them from the validated module's DRBG rather than from rand's ChaCha generator. The key format stays: the apikey: prefix and 128 alphanumeric characters, each drawn by rejection sampling so all are equally likely.

rand is now test-only, and static_assertions had no other user.

Signed-off-by: Gerd Zellweger <[email protected]>

The integrity checksums of pipeline binaries and program info came from RustCrypto's sha2. They now come from the aws-lc-rs digest the rest of the manager uses, so FIPS builds verify binaries with the validated module. The output is unchanged.

Signed-off-by: Gerd Zellweger <[email protected]>

The ad hoc result hash and the Kafka PEM file name were the last direct users of sha2. Both now use aws-lc-rs with the same hex output, and the workspace no longer declares sha2.

Signed-off-by: Gerd Zellweger <[email protected]>

aws-lc-rs 1.18 pulls AWS-LC 4, which is still in comment resolution at the CMVP. aws-lc-rs 1.17.1 ships aws-lc-fips-sys 0.13.11, the crate that bundles AWS-LC FIPS 3.1.0 (certificates #5314 static, #5298 dynamic), so the lock pins both.

rustls 0.23.46, rustls-webpki 0.103.16 and async-nats 0.51.0 require aws-lc-rs 1.18 only for ML-DSA, which 1.17.1 exposes only as unstable. The patch section takes them from feldera's forks, which keep every upstream fix and gate ML-DSA behind a feature that stays off. rustls-webpki moves from 0.103.15 to 0.103.16, which rejects certificate paths through the distrusted emSign intermediates (RUSTSEC-2026-0382).

Signed-off-by: Gerd Zellweger <[email protected]>

The feldera-enterprise feature of pipeline-manager and of the connectors turns on fips, so an Enterprise pipeline-manager and the pipelines it builds link the validated module without a separate switch. Every generated workspace carries the dependency overrides of this workspace so the copied Cargo.lock resolves the same sources. install-librdkafka.sh builds AWS-LC-FIPS-3.1.0 into librdkafka when AWS_LC_FIPS=1, which deploy/Dockerfile exposes as a build argument, and it learns the AWS-LC release that aws-lc-sys 0.42.0 vendors. The open source builds and images stay on the non-FIPS AWS-LC.

Signed-off-by: Gerd Zellweger <[email protected]>

…ilds.

The cargo environment of a pipeline build is cleared, so the variable that makes aws-lc-fips-sys produce the FIPS module as a shared object never reached it and pipelines linked the module statically. The compiler server sets it for the module the pipeline executor ships.

Signed-off-by: Gerd Zellweger <[email protected]>

The API server, compiler server and runner take --fips through CommonConfig, and the pipeline takes it through ServerArgs; the local runner passes it on. With the flag a process panics unless its rustls provider and each TLS config it builds are in FIPS mode. Without the flag a build on the FIPS module runs on it all the same and checks nothing.

Signed-off-by: Gerd Zellweger <[email protected]>

The page lists the validated cryptographic modules and their certificates, the fips.enabled Helm setting, the connectors that FIPS mode allows, and what the operator must review.

Signed-off-by: Gerd Zellweger <[email protected]>

mihaibudiu left a comment