Hi, I'd like to get feedback on moving pgcrypto's fips_mode() function to core.
fips_mode() reports whether OpenSSL is running with FIPS mode. This information is not specific to pgcrypto. OpenSSL is also used by cryptographic operations in core, such as server-side TLS and the hash and HMAC operations used by SCRAM authentication. Making this information available in core would allow users to check the OpenSSL configuration without installing the pgcrypto extension. The attached patch adds pg_catalog.fips_mode() and moves the OpenSSL-specific detection code to a common helper. It returns false when PostgreSQL is built without OpenSSL. For backward compatibility, pgcrypto.fips_mode() remains available as a wrapper around the core function. This follows an existing manner, see gen_random_uuid(). The documentation clarifies that this function reports the OpenSSL configuration only and does not establish that the PostgreSQL server as a whole is FIPS compliant. Do you think it's a good idea to port the fips_mode() to core? Also, what should the function return if the build disables OpenSSL? For now, it always returns false. Best regards, Koshi Shibagaki FUJITSU LIMITED https://www.fujitsu.com/
v1-0001-Move-fips_mode-from-pgcrypto-to-core.patch
Description: v1-0001-Move-fips_mode-from-pgcrypto-to-core.patch
