Skip to content

Conversation

naveedjamil
Copy link

@naveedjamil naveedjamil commented May 15, 2017

Unit test coverge was increased to cover the usages of crypto. This helps to ensure that everything is working fine with fips mode enabled.
Also updated sha1 to sha256 in registry/storage/driver/testsuites/testsuites.go because sha1 is not supported in fips mode.

Signed-off-by: Naveed Jamil naveed.jamil@tenpearls.com

// first make sure that the default transport gives x509 untrusted cert error
events := []Event{}
err := sink.Write(events...)
if !strings.Contains(err.Error(), "x509") {
if !strings.Contains(err.Error(), "x509") && !strings.Contains(err.Error(), "OpenSSL error") {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What configuration is this seen under? Is this when using a modified version of Go which uses openssl?

Copy link
Author

@naveedjamil naveedjamil May 16, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes that is the error which is returned in case of modified version of Go which uses open ssl.

When using the unmodified version of go the error that is returned is
"x509: certificate signed by unknown authority"
and while using the modified version the error that is returned is
"SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca"

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this test should really look for "unknown authority" or "unknown ca" then.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed. Will change this check to that.

@codecov
Copy link

codecov bot commented May 16, 2017

Codecov Report

Merging #2272 into master will decrease coverage by 11.33%.
The diff coverage is n/a.

Impacted file tree graph

@@             Coverage Diff             @@
##           master    #2272       +/-   ##
===========================================
- Coverage   61.57%   50.24%   -11.34%     
===========================================
  Files         125      128        +3     
  Lines       11397    11817      +420     
===========================================
- Hits         7018     5937     -1081     
- Misses       3493     5114     +1621     
+ Partials      886      766      -120
Impacted Files Coverage Δ
registry/storage/driver/gcs/gcs.go 0.4% <0%> (-68.94%) ⬇️
registry/storage/driver/oss/oss.go 0.56% <0%> (-57.23%) ⬇️
registry/storage/driver/s3-aws/s3.go 4.57% <0%> (-56.23%) ⬇️
registry/storage/driver/s3-goamz/s3.go 0.5% <0%> (-51.4%) ⬇️
registry/client/transport/transport.go 69.69% <0%> (-9.1%) ⬇️
...storage/driver/middleware/cloudfront/middleware.go 42.85% <0%> (ø)
contrib/token-server/token.go 33.89% <0%> (ø)
contrib/token-server/main.go 0% <0%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1e2f10e...5ff972c. Read the comment docs.

@dmp42
Copy link
Contributor

dmp42 commented Aug 23, 2018

@naveedjamil could you rebase this?

Unit test coverge was increased to cover the usages of crypto. This helps to ensure that everything is working fine with fips mode enabled.
Also updated sha1 to sha256 in registry/storage/driver/testsuites/testsuites.go because sha1 is not supported in fips mode.

Signed-off-by: Naveed Jamil <naveed.jamil@tenpearl.com>
Signed-off-by: Derek McGowan <derek@mcgstyle.net>
@codecov
Copy link

codecov bot commented Feb 23, 2020

Codecov Report

Merging #2272 into master will decrease coverage by 2.06%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #2272      +/-   ##
==========================================
- Coverage   60.74%   58.67%   -2.07%     
==========================================
  Files         102      104       +2     
  Lines        8077     8434     +357     
==========================================
+ Hits         4906     4949      +43     
- Misses       2519     2823     +304     
- Partials      652      662      +10     
Flag Coverage Δ
#linux 58.67% <ø> (-2.07%) ⬇️
Impacted Files Coverage Δ
contrib/token-server/main.go 0.00% <0.00%> (ø)
contrib/token-server/token.go 33.89% <0.00%> (ø)
configuration/parser.go 86.36% <0.00%> (+2.27%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 244d524...e65b3f1. Read the comment docs.

Copy link
Collaborator

@dmcgowan dmcgowan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@dmcgowan dmcgowan merged commit 6b972e5 into distribution:master Feb 23, 2020
@navinag1989
Copy link

Hi @naveedjamil ,
I can see SHA1 and MD5 still being used at following locations:
https://github.com/distribution/distribution/search?q=sha1
https://github.com/distribution/distribution/search?q=md5

Will this create issue in FIPS compliance?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants