Skip to content

tools: restore FIPS testing with default OpenSSL - #67248

Open
panva wants to merge 1 commit into
nodejs:mainfrom
panva:fix-shared-openssl-fips
Open

tools: restore FIPS testing with default OpenSSL#67248
panva wants to merge 1 commit into
nodejs:mainfrom
panva:fix-shared-openssl-fips

Conversation

@panva

@panva panva commented Nov 4, 2026

Copy link
Copy Markdown
Member

OpenSSL 4.1 falls back to SHA-256 for the md5 command when MD5 is unavailable. Select MD5 explicitly through dgst to avoid a false failure in the negative install check.

Use the default shared OpenSSL version for FIPS again instead of pinning it to 3.5.

@panva
tools: restore FIPS testing with default OpenSSL
14ed57e 
OpenSSL 4.1 falls back to SHA-256 for the md5 command when MD5 is
unavailable. Select MD5 explicitly through dgst to avoid a false
failure in the negative install check.

Use the default shared OpenSSL version for FIPS again instead of
pinning it to 3.5.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
@panva
panva requested a review from aduh95 November 4, 2026 11:46
@nodejs-github-bot nodejs-github-bot added the tools Issues and PRs related to the tools directory. label Nov 4, 2026
@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor
Platform Number of requisites Proportion of new derivations
x86_64-linux 526 -> 526 => no changes 4 / 526 = 0.7%
aarch64-linux 527 -> 527 => no changes 4 / 527 = 0.7%
x86_64-darwin 442 -> 442 => no changes 3 / 442 = 0.6%
aarch64-darwin 455 -> 455 => no changes 3 / 455 = 0.6%
Total 1950 -> 1950 => no changes 14 / 1950 = 0.7%
Changelog 
@@ -1270,14 +1270,14 @@
-/nix/store/dzj8hnb7knc7vzlz8xrdyxzszyq4y6cr-openssl-fips-3.5.9 (aarch64-darwin)
-/nix/store/w6l20jpmbmf82gwl8jgh68qjfhk96g6q-openssl-fips-3.5.9 (aarch64-linux)
-/nix/store/3gdjbn9n6ian5mdsab4f7g2s7wmszyyi-openssl-fips-3.5.9 (x86_64-darwin)
-/nix/store/4j3472s1m4vijkwyjpnfdcmnizlbrrm8-openssl-fips-3.5.9 (x86_64-linux)
-/nix/store/y6hm20q4hn729d6rfj28k72789dmgwia-openssl-fips-3.5.9-bin (aarch64-darwin)
-/nix/store/iaabj8kmhwmmz991zhif7hz4jmnf6kpv-openssl-fips-3.5.9-bin (aarch64-linux)
-/nix/store/7gx71fgk8ag35a4p058rszc7adnsxlp1-openssl-fips-3.5.9-bin (x86_64-darwin)
-/nix/store/53rw9b68955qwp7al4sqlq9b16x6s78n-openssl-fips-3.5.9-bin (x86_64-linux)
-/nix/store/lvjbpfa1xk0x7gamqh3kmgm4fblcifgj-openssl-fips-3.5.9-debug (aarch64-linux)
-/nix/store/sjy3kb2xvm2mwnfqx813balngwlkvfyz-openssl-fips-3.5.9-debug (x86_64-linux)
-/nix/store/swhas9j48w7mdd0fsf7k7j6fb6nnfci5-openssl-fips-3.5.9-dev (aarch64-darwin)
-/nix/store/y4gg79a8zbhf86n7srin0wjbwwbgp8mk-openssl-fips-3.5.9-dev (aarch64-linux)
-/nix/store/pzlp6vcspp023f8293sn6gl0gj3945l1-openssl-fips-3.5.9-dev (x86_64-darwin)
-/nix/store/hhv54pfsb8q43kshzkk7f90b1h2w7wj3-openssl-fips-3.5.9-dev (x86_64-linux)
+/nix/store/qvnmz8mjqxq3bd87hlx512fd54ha9xc1-openssl-fips-4.1.0 (aarch64-darwin)
+/nix/store/h580k5701879czn5k9rp3imdcyj5pz2c-openssl-fips-4.1.0 (aarch64-linux)
+/nix/store/r96q912iwif1qnz8bh945qa3frspxbcj-openssl-fips-4.1.0 (x86_64-darwin)
+/nix/store/i5gvxk7h9g7g6sv3glph6d2548vmms18-openssl-fips-4.1.0 (x86_64-linux)
+/nix/store/mqjp4kc78nnvgfrfry2j4v9zz2jqdm53-openssl-fips-4.1.0-bin (aarch64-darwin)
+/nix/store/nzyppkzs4lgnin51kyjfnxzw9qvv2cr9-openssl-fips-4.1.0-bin (aarch64-linux)
+/nix/store/c59z7a6rqg4qw466qf8bjfw7g4ixpgnv-openssl-fips-4.1.0-bin (x86_64-darwin)
+/nix/store/2dn3nkzzxihrbnga8ww54340x5l5a41h-openssl-fips-4.1.0-bin (x86_64-linux)
+/nix/store/8qdxlf15g1ma6na38cc0h4vzgh7fzghy-openssl-fips-4.1.0-debug (aarch64-linux)
+/nix/store/mxj717clmp6hjif6gfiqmvpxpm96qlwx-openssl-fips-4.1.0-debug (x86_64-linux)
+/nix/store/78ywadi2raiq2mcygslckh6dgld3z60a-openssl-fips-4.1.0-dev (aarch64-darwin)
+/nix/store/3c55gw7hd4pymhmklz2q73firwhc9rc6-openssl-fips-4.1.0-dev (aarch64-linux)
+/nix/store/2w6bzizd8bfgimin61c3fylh0f48iv14-openssl-fips-4.1.0-dev (x86_64-darwin)
+/nix/store/0pj4b8n6j2pnl70871pqa7ixx9n9pih6-openssl-fips-4.1.0-dev (x86_64-linux)

@panva panva added dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. labels Nov 4, 2026
@panva panva mentioned this pull request Nov 4, 2026
Merged
@panva

panva commented Nov 4, 2026

Copy link
Copy Markdown
Member Author

blocked on #67250

@panva panva added the blocked PRs that are blocked by other issues or PRs. label Nov 4, 2026
@panva panva closed this Nov 6, 2026
@panva panva reopened this Nov 6, 2026
@panva panva removed the blocked PRs that are blocked by other issues or PRs. label Nov 6, 2026
@github-actions

github-actions Bot commented Nov 6, 2026

Copy link
Copy Markdown
Contributor
Platform Number of requisites Proportion of new derivations
x86_64-linux 526 -> 526 => no changes 4 / 526 = 0.7%
aarch64-linux 527 -> 527 => no changes 4 / 527 = 0.7%
x86_64-darwin 442 -> 442 => no changes 3 / 442 = 0.6%
aarch64-darwin 455 -> 455 => no changes 3 / 455 = 0.6%
Total 1950 -> 1950 => no changes 14 / 1950 = 0.7%
Changelog 
@@ -1270,14 +1270,14 @@
-/nix/store/dzj8hnb7knc7vzlz8xrdyxzszyq4y6cr-openssl-fips-3.5.9 (aarch64-darwin)
-/nix/store/w6l20jpmbmf82gwl8jgh68qjfhk96g6q-openssl-fips-3.5.9 (aarch64-linux)
-/nix/store/3gdjbn9n6ian5mdsab4f7g2s7wmszyyi-openssl-fips-3.5.9 (x86_64-darwin)
-/nix/store/4j3472s1m4vijkwyjpnfdcmnizlbrrm8-openssl-fips-3.5.9 (x86_64-linux)
-/nix/store/y6hm20q4hn729d6rfj28k72789dmgwia-openssl-fips-3.5.9-bin (aarch64-darwin)
-/nix/store/iaabj8kmhwmmz991zhif7hz4jmnf6kpv-openssl-fips-3.5.9-bin (aarch64-linux)
-/nix/store/7gx71fgk8ag35a4p058rszc7adnsxlp1-openssl-fips-3.5.9-bin (x86_64-darwin)
-/nix/store/53rw9b68955qwp7al4sqlq9b16x6s78n-openssl-fips-3.5.9-bin (x86_64-linux)
-/nix/store/lvjbpfa1xk0x7gamqh3kmgm4fblcifgj-openssl-fips-3.5.9-debug (aarch64-linux)
-/nix/store/sjy3kb2xvm2mwnfqx813balngwlkvfyz-openssl-fips-3.5.9-debug (x86_64-linux)
-/nix/store/swhas9j48w7mdd0fsf7k7j6fb6nnfci5-openssl-fips-3.5.9-dev (aarch64-darwin)
-/nix/store/y4gg79a8zbhf86n7srin0wjbwwbgp8mk-openssl-fips-3.5.9-dev (aarch64-linux)
-/nix/store/pzlp6vcspp023f8293sn6gl0gj3945l1-openssl-fips-3.5.9-dev (x86_64-darwin)
-/nix/store/hhv54pfsb8q43kshzkk7f90b1h2w7wj3-openssl-fips-3.5.9-dev (x86_64-linux)
+/nix/store/qvnmz8mjqxq3bd87hlx512fd54ha9xc1-openssl-fips-4.1.0 (aarch64-darwin)
+/nix/store/h580k5701879czn5k9rp3imdcyj5pz2c-openssl-fips-4.1.0 (aarch64-linux)
+/nix/store/r96q912iwif1qnz8bh945qa3frspxbcj-openssl-fips-4.1.0 (x86_64-darwin)
+/nix/store/i5gvxk7h9g7g6sv3glph6d2548vmms18-openssl-fips-4.1.0 (x86_64-linux)
+/nix/store/mqjp4kc78nnvgfrfry2j4v9zz2jqdm53-openssl-fips-4.1.0-bin (aarch64-darwin)
+/nix/store/nzyppkzs4lgnin51kyjfnxzw9qvv2cr9-openssl-fips-4.1.0-bin (aarch64-linux)
+/nix/store/c59z7a6rqg4qw466qf8bjfw7g4ixpgnv-openssl-fips-4.1.0-bin (x86_64-darwin)
+/nix/store/2dn3nkzzxihrbnga8ww54340x5l5a41h-openssl-fips-4.1.0-bin (x86_64-linux)
+/nix/store/8qdxlf15g1ma6na38cc0h4vzgh7fzghy-openssl-fips-4.1.0-debug (aarch64-linux)
+/nix/store/mxj717clmp6hjif6gfiqmvpxpm96qlwx-openssl-fips-4.1.0-debug (x86_64-linux)
+/nix/store/78ywadi2raiq2mcygslckh6dgld3z60a-openssl-fips-4.1.0-dev (aarch64-darwin)
+/nix/store/3c55gw7hd4pymhmklz2q73firwhc9rc6-openssl-fips-4.1.0-dev (aarch64-linux)
+/nix/store/2w6bzizd8bfgimin61c3fylh0f48iv14-openssl-fips-4.1.0-dev (x86_64-darwin)
+/nix/store/0pj4b8n6j2pnl70871pqa7ixx9n9pih6-openssl-fips-4.1.0-dev (x86_64-linux)

@panva
panva requested a review from cjihrig November 6, 2026 13:15
@panva panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. labels Nov 6, 2026
@nodejs-github-bot nodejs-github-bot added the lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. label Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aduh95 aduh95 aduh95 approved these changes
@cjihrig cjihrig Awaiting requested review from cjihrig

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. commit-queue PRs queued for automated landing through the Commit Queue. dont-land-on-v22.x PRs that should not land on the v22.x-staging branch and should not be released in v22.x. dont-land-on-v24.x PRs that should not land on the v24.x-staging branch and should not be released in v24.x. dont-land-on-v26.x PRs that should not land on the v26.x-staging branch and should not be released in v26.x. lacks-second-approval Commit Queue PRs awaiting a second collaborator approval or completion of the required wait. tools Issues and PRs related to the tools directory.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@panva @aduh95 @nodejs-github-bot