Skip to content

tests: add fips.enable.https#4477

Open
HuijingHei wants to merge 1 commit intocoreos:mainfrom
HuijingHei:fips-nginx
Open

tests: add fips.enable.https#4477
HuijingHei wants to merge 1 commit intocoreos:mainfrom
HuijingHei:fips-nginx

Conversation

@HuijingHei
Copy link
Member

@HuijingHei HuijingHei commented Mar 9, 2026

To verify that using TLS works in FIPS mode by having Ignition
fetch a remote resource over HTTPS with FIPS compatible algorithms.

tests/containers: setup nginx only serves files over HTTPS with
FIPS compatible algorithms.

Fixes https://issues.redhat.com/browse/COS-3487

@openshift-ci
Copy link

openshift-ci bot commented Mar 9, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Copy link
Contributor

@gemini-code-assist gemini-code-assist bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds a test container fips-nginx to verify file downloads over HTTPS with FIPS-approved cryptography. A thorough security audit found no significant vulnerabilities, though a low-risk issue regarding input validation in build.sh was noted. However, a critical issue in the Containerfile will prevent the container from building, and several suggestions have been made to improve the build.sh script's robustness and cleanliness.

Comment on lines +8 to +9
echo "Error: Missing IP address argument"
echo "Usage: $0 <ip-address>"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

It is a best practice to redirect error and usage messages to stderr. This separates normal output from error messages and allows for better output redirection.

Suggested change
echo "Error: Missing IP address argument"
echo "Usage: $0 <ip-address>"
echo "Error: Missing IP address argument" >&2
echo "Usage: $0 <ip-address>" >&2

@HuijingHei HuijingHei changed the title tests/containers: setup nginx only serves files over HTTPS with tests: add fips.enable.https Mar 9, 2026
@HuijingHei HuijingHei force-pushed the fips-nginx branch 3 times, most recently from a9874f0 to 9c01bda Compare March 9, 2026 13:38
@HuijingHei HuijingHei marked this pull request as ready for review March 10, 2026 01:23
@HuijingHei HuijingHei force-pushed the fips-nginx branch 2 times, most recently from 16f1af3 to 485b749 Compare March 10, 2026 06:46
To verify that using TLS works in FIPS mode by having Ignition
fetch a remote resource over HTTPS with FIPS compatible algorithms.

tests/containers: setup nginx only serves files over HTTPS with
FIPS compatible algorithms.

Fixes https://issues.redhat.com/browse/COS-3487
@HuijingHei
Copy link
Member Author

Hold on, looks this can only test x86_64, as I just setup the env on x86_64. Do we want to run on all multiarch?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant