Skip to content

tools: restore FIPS testing with default OpenSSL - #67248

Merged
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
panva:fix-shared-openssl-fips
Nov 11, 2026
Merged

tools: restore FIPS testing with default OpenSSL#67248
nodejs-github-bot merged 1 commit into
nodejs:mainfrom
panva:fix-shared-openssl-fips

Conversation

@panva

@panva panva commented Nov 4, 2026

Copy link
Copy Markdown
Member

OpenSSL 4.1 falls back to SHA-256 for the md5 command when MD5 is unavailable. Select MD5 explicitly through dgst to avoid a false failure in the negative install check.

Use the default shared OpenSSL version for FIPS again instead of pinning it to 3.5.

@panva
tools: restore FIPS testing with default OpenSSL
14ed57e 
OpenSSL 4.1 falls back to SHA-256 for the md5 command when MD5 is
unavailable. Select MD5 explicitly through dgst to avoid a false
failure in the negative install check.

Use the default shared OpenSSL version for FIPS again instead of
pinning it to 3.5.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva
panva requested a review from aduh95 November 4, 2026 11:46
@nodejs-github-bot nodejs-github-bot added the tools Issues and PRs related to the tools directory. label Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor
Platform Number of requisites Proportion of new derivations
x86_64-linux 526 -> 526 => no changes 4 / 526 = 0.7%
aarch64-linux 527 -> 527 => no changes 4 / 527 = 0.7%
x86_64-darwin 442 -> 442 => no changes 3 / 442 = 0.6%
aarch64-darwin 455 -> 455 => no changes 3 / 455 = 0.6%
Total 1950 -> 1950 => no changes 14 / 1950 = 0.7%
Changelog 
@@ -1270,14 +1270,14 @@
-/nix/store/dzj8hnb7knc7vzlz8xrdyxzszyq4y6cr-openssl-fips-3.5.9 (aarch64-darwin)
-/nix/store/w6l20jpmbmf82gwl8jgh68qjfhk96g6q-openssl-fips-3.5.9 (aarch64-linux)
-/nix/store/3gdjbn9n6ian5mdsab4f7g2s7wmszyyi-openssl-fips-3.5.9 (x86_64-darwin)
-/nix/store/4j3472s1m4vijkwyjpnfdcmnizlbrrm8-openssl-fips-3.5.9 (x86_64-linux)
-/nix/store/y6hm20q4hn729d6rfj28k72789dmgwia-openssl-fips-3.5.9-bin (aarch64-darwin)
-/nix/store/iaabj8kmhwmmz991zhif7hz4jmnf6kpv-openssl-fips-3.5.9-bin (aarch64-linux)
-/nix/store/7gx71fgk8ag35a4p058rszc7adnsxlp1-openssl-fips-3.5.9-bin (x86_64-darwin)
-/nix/store/53rw9b68955qwp7al4sqlq9b16x6s78n-openssl-fips-3.5.9-bin (x86_64-linux)
-/nix/store/lvjbpfa1xk0x7gamqh3kmgm4fblcifgj-openssl-fips-3.5.9-debug (aarch64-linux)
-/nix/store/sjy3kb2xvm2mwnfqx813balngwlkvfyz-openssl-fips-3.5.9-debug (x86_64-linux)
-/nix/store/swhas9j48w7mdd0fsf7k7j6fb6nnfci5-openssl-fips-3.5.9-dev (aarch64-darwin)
-/nix/store/y4gg79a8zbhf86n7srin0wjbwwbgp8mk-openssl-fips-3.5.9-dev (aarch64-linux)
-/nix/store/pzlp6vcspp023f8293sn6gl0gj3945l1-openssl-fips-3.5.9-dev (x86_64-darwin)
-/nix/store/hhv54pfsb8q43kshzkk7f90b1h2w7wj3-openssl-fips-3.5.9-dev (x86_64-linux)
+/nix/store/qvnmz8mjqxq3bd87hlx512fd54ha9xc1-openssl-fips-4.1.0 (aarch64-darwin)
+/nix/store/h580k5701879czn5k9rp3imdcyj5pz2c-openssl-fips-4.1.0 (aarch64-linux)
+/nix/store/r96q912iwif1qnz8bh945qa3frspxbcj-openssl-fips-4.1.0 (x86_64-darwin)
+/nix/store/i5gvxk7h9g7g6sv3glph6d2548vmms18-openssl-fips-4.1.0 (x86_64-linux)
+/nix/store/mqjp4kc78nnvgfrfry2j4v9zz2jqdm53-openssl-fips-4.1.0-bin (aarch64-darwin)
+/nix/store/nzyppkzs4lgnin51kyjfnxzw9qvv2cr9-openssl-fips-4.1.0-bin (aarch64-linux)
+/nix/store/c59z7a6rqg4qw466qf8bjfw7g4ixpgnv-openssl-fips-4.1.0-bin (x86_64-darwin)
+/nix/store/2dn3nkzzxihrbnga8ww54340x5l5a41h-openssl-fips-4.1.0-bin (x86_64-linux)
+/nix/store/8qdxlf15g1ma6na38cc0h4vzgh7fzghy-openssl-fips-4.1.0-debug (aarch64-linux)
+/nix/store/mxj717clmp6hjif6gfiqmvpxpm96qlwx-openssl-fips-4.1.0-debug (x86_64-linux)
+/nix/store/78ywadi2raiq2mcygslckh6dgld3z60a-openssl-fips-4.1.0-dev (aarch64-darwin)
+/nix/store/3c55gw7hd4pymhmklz2q73firwhc9rc6-openssl-fips-4.1.0-dev (aarch64-linux)
+/nix/store/2w6bzizd8bfgimin61c3fylh0f48iv14-openssl-fips-4.1.0-dev (x86_64-darwin)
+/nix/store/0pj4b8n6j2pnl70871pqa7ixx9n9pih6-openssl-fips-4.1.0-dev (x86_64-linux)

@panva panva added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. labels Nov 4, 2026
@panva panva mentioned this pull request Nov 4, 2026
Merged
@panva

panva commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

blocked on #67250

@panva panva added the blocked PRs that are blocked by other issues or PRs. label Nov 4, 2026
@panva panva closed this Nov 6, 2026
@panva panva reopened this Nov 6, 2026
@panva panva removed the blocked PRs that are blocked by other issues or PRs. label Nov 6, 2026
@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor
Platform Number of requisites Proportion of new derivations
x86_64-linux 526 -> 526 => no changes 4 / 526 = 0.7%
aarch64-linux 527 -> 527 => no changes 4 / 527 = 0.7%
x86_64-darwin 442 -> 442 => no changes 3 / 442 = 0.6%
aarch64-darwin 455 -> 455 => no changes 3 / 455 = 0.6%
Total 1950 -> 1950 => no changes 14 / 1950 = 0.7%
Changelog 
@@ -1270,14 +1270,14 @@
-/nix/store/dzj8hnb7knc7vzlz8xrdyxzszyq4y6cr-openssl-fips-3.5.9 (aarch64-darwin)
-/nix/store/w6l20jpmbmf82gwl8jgh68qjfhk96g6q-openssl-fips-3.5.9 (aarch64-linux)
-/nix/store/3gdjbn9n6ian5mdsab4f7g2s7wmszyyi-openssl-fips-3.5.9 (x86_64-darwin)
-/nix/store/4j3472s1m4vijkwyjpnfdcmnizlbrrm8-openssl-fips-3.5.9 (x86_64-linux)
-/nix/store/y6hm20q4hn729d6rfj28k72789dmgwia-openssl-fips-3.5.9-bin (aarch64-darwin)
-/nix/store/iaabj8kmhwmmz991zhif7hz4jmnf6kpv-openssl-fips-3.5.9-bin (aarch64-linux)
-/nix/store/7gx71fgk8ag35a4p058rszc7adnsxlp1-openssl-fips-3.5.9-bin (x86_64-darwin)
-/nix/store/53rw9b68955qwp7al4sqlq9b16x6s78n-openssl-fips-3.5.9-bin (x86_64-linux)
-/nix/store/lvjbpfa1xk0x7gamqh3kmgm4fblcifgj-openssl-fips-3.5.9-debug (aarch64-linux)
-/nix/store/sjy3kb2xvm2mwnfqx813balngwlkvfyz-openssl-fips-3.5.9-debug (x86_64-linux)
-/nix/store/swhas9j48w7mdd0fsf7k7j6fb6nnfci5-openssl-fips-3.5.9-dev (aarch64-darwin)
-/nix/store/y4gg79a8zbhf86n7srin0wjbwwbgp8mk-openssl-fips-3.5.9-dev (aarch64-linux)
-/nix/store/pzlp6vcspp023f8293sn6gl0gj3945l1-openssl-fips-3.5.9-dev (x86_64-darwin)
-/nix/store/hhv54pfsb8q43kshzkk7f90b1h2w7wj3-openssl-fips-3.5.9-dev (x86_64-linux)
+/nix/store/qvnmz8mjqxq3bd87hlx512fd54ha9xc1-openssl-fips-4.1.0 (aarch64-darwin)
+/nix/store/h580k5701879czn5k9rp3imdcyj5pz2c-openssl-fips-4.1.0 (aarch64-linux)
+/nix/store/r96q912iwif1qnz8bh945qa3frspxbcj-openssl-fips-4.1.0 (x86_64-darwin)
+/nix/store/i5gvxk7h9g7g6sv3glph6d2548vmms18-openssl-fips-4.1.0 (x86_64-linux)
+/nix/store/mqjp4kc78nnvgfrfry2j4v9zz2jqdm53-openssl-fips-4.1.0-bin (aarch64-darwin)
+/nix/store/nzyppkzs4lgnin51kyjfnxzw9qvv2cr9-openssl-fips-4.1.0-bin (aarch64-linux)
+/nix/store/c59z7a6rqg4qw466qf8bjfw7g4ixpgnv-openssl-fips-4.1.0-bin (x86_64-darwin)
+/nix/store/2dn3nkzzxihrbnga8ww54340x5l5a41h-openssl-fips-4.1.0-bin (x86_64-linux)
+/nix/store/8qdxlf15g1ma6na38cc0h4vzgh7fzghy-openssl-fips-4.1.0-debug (aarch64-linux)
+/nix/store/mxj717clmp6hjif6gfiqmvpxpm96qlwx-openssl-fips-4.1.0-debug (x86_64-linux)
+/nix/store/78ywadi2raiq2mcygslckh6dgld3z60a-openssl-fips-4.1.0-dev (aarch64-darwin)
+/nix/store/3c55gw7hd4pymhmklz2q73firwhc9rc6-openssl-fips-4.1.0-dev (aarch64-linux)
+/nix/store/2w6bzizd8bfgimin61c3fylh0f48iv14-openssl-fips-4.1.0-dev (x86_64-darwin)
+/nix/store/0pj4b8n6j2pnl70871pqa7ixx9n9pih6-openssl-fips-4.1.0-dev (x86_64-linux)

@panva
panva requested a review from cjihrig November 6, 2026 13:15
@panva panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Nov 6, 2026
@nodejs-github-bot nodejs-github-bot added the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Nov 6, 2026
@nodejs-github-bot
nodejs-github-bot merged commit f15ec18 into nodejs:main Nov 11, 2026
88 of 89 checks passed
@nodejs-github-bot

nodejs-github-bot commented Nov 11, 2026

Copy link
Copy Markdown
Collaborator

Landed in f15ec18

@nodejs-github-bot nodejs-github-bot removed commit-queue PRs queued for automated landing through the Commit Queue. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. labels Nov 11, 2026
@panva
panva deleted the fix-shared-openssl-fips branch November 11, 2026 11:56
@panva panva mentioned this pull request Nov 11, 2026
Closed
aduh95 pushed a commit that referenced this pull request Nov 11, 2026
@panva @aduh95
tools: restore FIPS testing with default OpenSSL
524341e 
OpenSSL 4.1 falls back to SHA-256 for the md5 command when MD5 is
unavailable. Select MD5 explicitly through dgst to avoid a false
failure in the negative install check.

Use the default shared OpenSSL version for FIPS again instead of
pinning it to 3.5.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #67248
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
@github-actions github-actions Bot mentioned this pull request Nov 11, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aduh95 aduh95 aduh95 approved these changes
@cjihrig cjihrig Awaiting requested review from cjihrig

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. tools Issues and PRs related to the tools directory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@panva @nodejs-github-bot @aduh95