Ubuntu noble - FIPS - #693
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. WalkthroughThe change updates Ubuntu FIPS package inventories from kernel version 5.15 to 6.8. It removes Merge Risk: ⚪ Minimal · up to This updates Noble FIPS package and kernel handling, including 6.8 static-library behavior. No current merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Description checkExplanation The description clearly explains the Noble FIPS package and kernel updates, the removal of libgcrypt20-hmac, build testing, and current deployment limitations. It does not document the merge-forward steps, but the main change and validation details are complete.
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
cf-foundation-community-automation
Bot
moved this to Inbox
in Foundational Infrastructure Working Group
|
@coderabbitai review |
✅ Action performedReview finished.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@stemcell_builder/lib/prelude_apply.bash`:
- Around line 62-64: Update the condition in the FIPS rewrite block to extract
and numerically compare the kernel’s major component against 6, rather than
comparing dotted version strings lexically. Preserve the existing rewrite
behavior only for FIPS kernels with a numeric major version below 6.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: c463db26-48c1-4972-a4a2-9432c8701aba
📒 Files selected for processing (6)
bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txtbosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txtbosh-stemcell/spec/assets/dpkg-list-ubuntu.txtstemcell_builder/lib/prelude_apply.bashstemcell_builder/stages/base_fips_apt/apply.shstemcell_builder/stages/static_libraries_config/apply.sh
github-project-automation
Bot
moved this from Inbox
to Waiting for Changes | Open for Contribution
in Foundational Infrastructure Working Group
1ed694c to
618f0f7
Compare
The noble fips-updates pocket does not ship libgcrypt20-hmac.
618f0f7 to
d2b920f
Compare
Noble FIPS uses kernel 6.8, not 5.15. The hardcoded major_kernel_version caused the find for linux-headers-5.15.*-fips to return nothing and fail the build. Also guard the objtool path rewrite so it only applies to pre-6.0 kernels, since noble FIPS (6.8) uses the new objtool/libsubcmd path.
Update dpkg-list-ubuntu-aws-fips.txt and dpkg-list-ubuntu-fips.txt to expect 6.8 kernel packages instead of 5.15. Fix arch suffixes on libgcrypt20-dev and libgpg-error-dev in dpkg-list-ubuntu.txt to match dpkg --get-selections output on noble.
d2b920f to
72755b0
Compare
|
@stackunderfl0w - as a first pass we ask that folks address (either by making changes or dismissing) the AI comments. Based on your comments above it sounds like coderabbit's suggestion is probably fine to dismiss - as long as we don't end up with a kernel major version 10 on ubuntu-noble (?). It may be worthwhile though as any changes to |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Suppressed comments (1)
stemcell_builder/lib/prelude_apply.bash:65
- The path migration is documented as occurring at kernel 6.5, but this comparison only checks the major component. A FIPS kernel in the 6.0–6.4 range would therefore retain the new
objtool/libsubcmd/libsubcmd.apath even though it still needs the old path, leaving a nonexistent entry instatic_libraries_list. Compare both major and minor components against 6.5.
if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then
|
I added |
|
I could have been a bit more clear with my comment. The suggestion was already added at the time. |
github-project-automation
Bot
moved this from Waiting for Changes | Open for Contribution
to Pending Merge | Prioritized
in Foundational Infrastructure Working Group
Update package lists and kernel versions to match release Ubuntu Noble Fips images.
The current specs hardcode the packages and kernel verions used by Jammy Fips, including the now entirely removed libgcrypt20-hmac.
Current config has been tested to build working Noble FIPS images, though full BOSH deployments currently require pending, out-of-tree changes to credhub-release and uaa-release. Their pre-start keystore generation is incompatible with the stricter PKCS#12 requirements enforced by OpenSSL 3.0’s FIPS provider.