> On 7 Sep 2026, at 07:49, Koshi Shibagaki (Fujitsu) > <[email protected]> wrote:
> Do you think it's a good idea to port the fips_mode() to core? The reason for it being useful in pgcrypto is that pgcrypto always contains built-in crypto which isn't FIPS certified. The builtin_crypto_enabled GUC and fips_mode() were added to help users remain FIPS compliant. When PostgreSQL is compiled with a TLS library (OpenSSL or LibreSSL) it doesn't compile any built-in crypto at all, so all crypto operations will use OpenSSL and thus be subject to FIPS compliance. Due to this I'm not convinced there is a usecase for moving this to core. I also don't want set a precedent of PostgreSQL exposing details about libraries since there is an endless amount of similar functions which could be advocated for. -- Daniel Gustafsson
