david-streamlio opened a new pull request, #26155: URL: https://github.com/apache/pulsar/pull/26155
PIP: this PR ### Motivation Pulsar has no supported FIPS 140-3 deployment path today, despite being most of the way there at the JCA layer (`SecurityUtility` already resolves BC vs. BC-FIPS reflectively). A full audit of `master` found the gaps documented in the proposal: the BC/BC-FIPS swap lost its packaging story in the Gradle migration; the broker binary listener cannot be steered off BoringSSL (`tlsProvider` is declared but never wired); Conscrypt is the shipped web-TLS default; several security paths use non-approved algorithms (SHA-1 OAEP and ECIES in `MessageCryptoBc`, MD5-crypt/DES-crypt in Basic auth, a non-HMAC construction in `SaslRoleTokenSigner`); and there is no FIPS documentation or meaningful FIPS test coverage. ### Modifications Adds `pip/pip-489.md`, proposing a supported, tested, documented **FIPS mode** deployment profile: TLS provider wiring for every listener (matching the proxy's existing pattern), a FIPS distribution variant / documented jar swap, a `fipsMode` fail-fast startup validator, metadata-negotiated migration to `RSA_OAEP_SHA256` key wrapping (with `ECDH_AES_KW` replacing ECIES in a later phase), SHA-2-crypt Basic auth, a dual-verify HMAC migration for the SASL role-token signer, a name-stable fix for the SHA-1-derived Kubernetes resource names, and a real FIPS TLS integration test group. Companion quick-win PRs already open (intentionally outside the PIP): #26152, #26153, #26154. A `[DISCUSS]` thread will be started on [email protected] referencing this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
