Change crypto policy requirement for Hummingbird images#14683
Open
jan-cerny wants to merge 1 commit intoComplianceAsCode:masterfrom
Open
Change crypto policy requirement for Hummingbird images#14683jan-cerny wants to merge 1 commit intoComplianceAsCode:masterfrom
jan-cerny wants to merge 1 commit intoComplianceAsCode:masterfrom
Conversation
Mab879
reviewed
Apr 29, 2026
Member
Mab879
left a comment
Mab879
left a comment
There was a problem hiding this comment.
One concern I have that is that in order to use default_or_fips you have go modifiy the OVAL. Some non-obvious coupling. This feels like a common source of bugs in the future. Should just make this regex for everyone?
This commit changes the expected crypto policy settings in the CIS profile for Hummingbird container images. Hummingbird provides images in 2 basic variants: 1. normal (eg. `:latest`) - has the crypto policy set to `DEFAULT` 2. FIPS (eg. `:latest-fips`) - has the crypto policy set to `FIPS`. CIS Benchmarks typically require that the crypto policy isn't set to `LEGACY`. Following these requirements, both variants of Hummingbird images are compliant with CIS. Both `DEFAULT` and `FIPS` crypto policy satisfy the requirement. This commit make both variants of images passing the CIS profile by selecting new rule `crypto_policy_not_legacy` in the profile instead of the usual rule `configure_crypto_policy`. The new rule is created in this commit as well.
jan-cerny
force-pushed
the
fips_cis_hummingbird
branch
from
ced08c9 to
b4c041e
Compare
Collaborator
Author
|
Good point. I have decided to do it differently. I have created a new rule and used it in CIS profile in Hummingbird instead of modifying the existing rule. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit changes the expected crypto policy settings in the CIS profile for Hummingbird container images.
Hummingbird provides images in 2 basic variants:
:latest) - has the crypto policy set toDEFAULT:latest-fips) - has the crypto policy set toFIPS.CIS Benchmarks typically require that the crypto policy isn't set to
LEGACY. Following these requirements, both variants of Hummingbird images are compliant with CIS. BothDEFAULTandFIPScrypto policy satisfy the requirement.This commit make both variants of images passing the CIS profile by selecting new rule
crypto_policy_not_legacyin the profile instead of the usual ruleconfigure_crypto_policy. The new rule is created in this commit as well.Review Hints:
./build_product -d hummingbirdmkdir -p /tmp/ssg/cp build/ssg-hummingbird-ds.xml /tmp/ssgpodman run --rm --cap-add SYS_CHROOT --mount type=image,source=quay.io/hummingbird/nginx:latest,destination=/target -e OSCAP_PROBE_ROOT=/target -v /tmp/ssg:/ssg:z,U quay.io/hummingbird/openscap:latest xccdf eval --profile cis --results-arf /ssg/results.xml --report /ssg/report.html /ssg/ssg-hummingbird-ds.xmlpodman run --rm --cap-add SYS_CHROOT --mount type=image,source=quay.io/hummingbird/nginx:latest-fips,destination=/target -e OSCAP_PROBE_ROOT=/target -v /tmp/ssg:/ssg:z,U quay.io/hummingbird/openscap:latest xccdf eval --profile cis --results-arf /ssg/results-fips.xml --report /ssg/report-fips.html /ssg/ssg-hummingbird-ds.xml