docs(gateway): prove the gateway on a FIPS host and document operating it
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Documentation
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- cryptography, docker, linux, rust
- Domain
- documentation, networking, security
Research direction
Build or obtain the FIPS gateway image and run it on a RHEL 9 host with FIPS mode enabled and PRAXIS_REQUIRE_FIPS set. Exercise the full grid path (enrollment, peer mTLS, cross-site completion, metrics listener) using a non-approved input such as an RSA 1536 certificate. Record the run and result in the FIPS operating doc, following praxis's own documentation style. Done means the validation evidence and operating steps are written up.
Written by the indexing model from the issue text.
Description
What happens now
No grid build has run under FIPS mode. A pass that was never tried on a FIPS host is not a claim.
What should happen
Run the FIPS gateway image on a RHEL 9 host with FIPS mode enabled and PRAXIS_REQUIRE_FIPS set. Exercise the full grid path: enrollment, peer mTLS, a cross-site completion and the metrics listener. Use a non-approved input as the discriminator, such as a TLS 1.2 peer without extended master secret, an RSA 1536 certificate, or a SHA-1 signed certificate. If any of them succeeds, the path runs outside the validated module. Record the run and the result in an operating doc for the FIPS build, the way praxis documents its own.
Scope
Validation run and the operating doc. Last step of the epic.
- Dominant language
- Rust
- Stars
- 10
- Forks
- 24
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 155
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from praxis-proxy/grid
-
area/security triage/accepted
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
praxis-proxy/grid#504 · 1 comment ·
Maintainers usually reply within 1 day
-
triage/needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
praxis-proxy/grid#496 ·
Maintainers usually reply within 1 day
-
area/security epic triage/accepted
Difficulty 5/5 Over a week Newbie friendliness 10/100
praxis-proxy/grid#508 ·
Maintainers usually reply within 1 day
-
area/security triage/accepted
Difficulty 4/5 3-5 days Newbie friendliness 45/100
praxis-proxy/grid#506 · 1 comment ·
Maintainers usually reply within 1 day
-
area/security triage/accepted
Difficulty 3/5 1-2 days Newbie friendliness 70/100
praxis-proxy/grid#505 · 1 comment ·
Maintainers usually reply within 1 day
All issues in praxis-proxy/grid
Similar issues
-
Published SDL drops input-field default values: a non-null field with a default renders as requiredOpen
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
色変記事を追加Openpriority middle
Difficulty 1/5 Under an hour Newbie friendliness 62/100
KATO-Hiro/AtCoderClans#12955 ·
Maintainers usually reply within 1 day
-
auto:doc-drift auto:producer
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
fritzprix/libr-agent#2458 ·
Maintainers usually reply within 1 day
-
Flaky test: terminal parity an_exited_shell_says_how reads status before the exit is seenPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
yantrikos/yantrik-os#1048 ·
Maintainers usually reply within 1 day
-
rust
Difficulty 2/5 1-3 hours Newbie friendliness 80/100
vllm-project/vllm#64939 ·
Maintainers usually reply within 1 day