JiriOndrusek opened a new issue, #9434:
URL: https://github.com/apache/camel-quarkus/issues/9434
Running the tests with `-Dfips` on a FIPS-enabled RHEL 10 with Red Hat JDK
25 fails in several places.
1. **TLS handshake fails.** JDK 25 offers the hybrid `X25519MLKEM768` group,
and NSS FIPS has no ML-KEM (`ML-KEM-768 KeyPairGenerator not available`). This
hits Maven's own artifact downloads, the test JVMs, the app under test and the
native image builder.
2. **crypto:**
- The provider is called `SunPKCS11-FIPS` on JDK 25 (was
`SunPKCS11-NSS-FIPS`), so the `fips` profile fails with `Security provider
'SunPKCS11-NSS-FIPS' is not available`.
- The test uses a 1024-bit DSA key with `SHA1withDSA` and a DES data
format. NSS FIPS has neither.
3. **cxf-soap-grouped:** WSS4J needs `-Dfips.enabled=true` to detect FIPS
(otherwise `SHA1PRNG SecureRandom not available`). With it, `cxf-parent`'s
`fips` profile adds `bc-fips` (until CXF 4.2.5, CXF-9261), which clashes with
`quarkus-cxf-bc-stub`.
**Proposed fix**
- `fips` profile: limit `jdk.tls.namedGroups` to FIPS-approved groups (as in
quarkus-cxf, quarkiverse/quarkus-cxf#2392); document `MAVEN_OPTS` for Maven
itself.
- crypto: pick the provider name by JDK version; use RSA (keystore from
`@TestCertificates`) and AES.
- cxf-soap-grouped: exclude `bc-fips` in the `fips` profile.
Verified on RHEL 10 FIPS: crypto, cxf-soap-grouped, http-grouped,
lumberjack, as2.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
