FIPS runtime image: drop OPENSSL_STATIC and build the fips feature
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Read docs/fips.md and inspect the runtime Containerfiles for operator and overlay-sync. Build with --no-default-features --features fips, remove OPENSSL_STATIC=1, and use a base image with a FIPS-capable system OpenSSL; done means the runtime image dynamically links system libssl and libcrypto and runs on a fips=1 host.
Written by the indexing model from the issue text.
Description
Follow-up to https://github.com/praxis-proxy/grid/pull/148#discussion_r4018203103.
The runtime Containerfiles build the default rustls feature set and set OPENSSL_STATIC=1, so they statically link OpenSSL. docs/fips.md requires the opposite: crypto through the dynamically linked system OpenSSL, with static OpenSSL outside the validated boundary. No deployable FIPS image exists yet.
A FIPS runtime image for operator and overlay-sync needs to:
- build with
--no-default-features --features fips, - drop
OPENSSL_STATIC=1so it dynamically links the system libssl and libcrypto, - base on an image whose system OpenSSL provides the FIPS provider, and run on a
fips=1host.
https://github.com/praxis-proxy/grid/pull/148 is source-level backend enablement until this lands.
- Dominant language
- Rust
- Stars
- 10
- Forks
- 24
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 133
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from praxis-proxy/grid
-
bug priority/high triage/accepted
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
praxis-proxy/grid#412 ·
Maintainers usually reply within 1 day
-
docs(gateway): memory sizing for prefix affinity capacityPossibly taken @valeriiashapoval claimed this 1 day ago. Opengood first issue priority/low triage/accepted
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
praxis-proxy/grid#406 · 1 assignee ·
Maintainers usually reply within 1 day
-
triage/accepted
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
praxis-proxy/grid#200 ·
Maintainers usually reply within 1 day
-
priority/high triage/accepted
Difficulty 5/5 Over a week Newbie friendliness 35/100
praxis-proxy/grid#419 ·
Maintainers usually reply within 1 day
-
grid-fleet-dashboard chart appVersion pins an image tag that was never publishedPossibly taken @valeriiashapoval claimed this 1 day ago. Openbug priority/medium triage/accepted
Difficulty 3/5 1-2 days Newbie friendliness 52/100
praxis-proxy/grid#409 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day
All issues in praxis-proxy/grid
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
farion1231/cc-switch#8829 · 1 comment ·
Maintainers usually reply within 1 day
-
Validate CI command vectors before indexing Cargo subcommandsPossibly taken @amandeavor claimed this today. Openbug ci good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
longbridge/gpui-kit#3677 ·
Maintainers usually reply within 1 day
-
E-pr-welcome
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
seanmonstar/reqwest#3121 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
ilya-zlobintsev/LACT#1235 ·
Maintainers usually reply within 1 day