release: do not install openssl in FIPS mode #157197
Merged
+17
−38
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rail
added
C-enhancement
Member
|
This change is |
rail
force-pushed
the
rail/pr-umswuwyxmkzl
branch
from
addd152 to
d37491a
Compare
Potential Bug(s) DetectedThe three-stage Claude Code analysis has identified potential bug(s) in this PR that may warrant investigation. Next Steps: Note: When viewing the workflow output, scroll to the bottom to find the Final Analysis Summary. After you review the findings, please tag the issue as follows:
|
github-actions
bot
added
the
o-AI-Review-Potential-Issue-Detected
Previously, our Dockerfile for deployment would install the `openssl` package when FIPS mode was enabled. However, this is unnecessary because the current implementation of FIPS mode does not rely on the system's OpenSSL library. This allows us to unify the Dockerfile for both variants. Additionally, install `ca-certificates` to ensure that TLS certificates can be properly validated, without implicitly using `x509.SetFallbackRoots`. Epic: none Release note: none
rail
force-pushed
the
rail/pr-umswuwyxmkzl
branch
from
d37491a to
1ae578e
Compare
rickystewart
approved these changes
Nov 13, 2025
| gzip \ | ||
| xz \ | ||
| && rm -rf /var/cache/yum | ||
| # FIPS mode requires the `openssl` package installed. Also we need to temporarily |
Collaborator
There was a problem hiding this comment.
Very nice to see all this code go away.
Member
Author
|
bors r=rickystewart |
Contributor
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously, our Dockerfile for deployment would install the
opensslpackage when FIPS mode was enabled. However, this is unnecessary because the current implementation of FIPS mode does not rely on the system's OpenSSL library. This allows us to unify the Dockerfile for both variants.Additionally, install
ca-certificatesto ensure that TLS certificates can be properly validated, without implicitly usingx509.SetFallbackRoots.Epic: none
Release note: none