Re: [PR] [improve][pip] PIP-489: FIPS 140-3 compliance mode for Apache Pulsar [pulsar]

["david-streamlio (via GitHub)" <gi...@apache.org>]

david-streamlio commented on PR #26155:
URL: https://github.com/apache/pulsar/pull/26155#issuecomment-5587581494

   @lhotari picking this back up now that its dependency has landed.
   
   The sequencing question I left you in July — whether 489 could go through DISCUSS/VOTE in parallel
   with 478, gated on 478's implementation — answered itself when PIP-478 merged on 3 August. So
   there's nothing outstanding on you from that thread; I should have said so at the time rather than
   leaving it hanging.
   
   I have since reconciled the document against post-478 `master` rather than leaving it describing the
   tree as it was in July:
   
   - 1912da5dfa — reworks the gap list against what 478 actually landed. The substantive correction is
     that `SecurityUtility.isBCFIPS()` no longer exists: #26322 deleted it with the rest of the PIP-337
     TLS stack, and the equivalent is now `JcaProviders` returning a
     `ResolvedBouncyCastleProvider(provider, fips)`. The registration-first ordering there is the
     FIPS-relevant half — a provider an operator registered in `java.security` is preserved rather than
     shadowed by a classpath-constructed one — so the PIP now builds on that rather than on a class
     that has been removed.
   - 49900473b3 — reframes the packaging item as missing support rather than as regression from the
     Gradle migration, which is the framing you argued for and I think you were right.
   
   The scope split you proposed is intact: 489 takes the TLS transport from 478's `TlsPolicy` /
   `PulsarTlsFactory` / `PulsarHttpClient` and confines itself to what 478 left out — approved
   algorithms in message crypto and auth, the packaging story, and the fail-fast `fipsMode` validator.
   
   What it needs now is a review. It has none, and I have not opened a VOTE thread yet — starting one
   cold against a document nobody has read since July seemed like the way to get a thread with no
   replies in it. If you have the time to look at the reconciled version I will start the vote after
   that; if you would rather someone else take it, a steer on who would help just as much.
   
   No urgency on my side — it has waited a month, another week will not hurt it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org