-
Notifications
You must be signed in to change notification settings - Fork 24.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fips builds don't pass forbidden api tests #33179
Comments
Pinging @elastic/es-core-infra |
We already do not run tests in a FIPS JVM, elasticsearch/x-pack/plugin/security/cli/build.gradle Lines 23 to 25 in 71d5c66
so should we also disable forbiddenApi ? |
Forbidden APIs used to be ran with the JVM running Gradle and I switched to running it with run-time java, which in this case is FIPS. I would like to understand why the forbidden patterns are triggered, maybe we could selectively disable rules instead of disabling it all. |
- third party audit detects jar hell with JDK so we disable it - jdk non portable in forbiddenapis detects classes being used from the JDK ( for fips ) that are not portable, this is intended so we don't scan for it on fips. - different exclusion rules for third party audit on fips Closes elastic#33179
- third party audit detects jar hell with JDK so we disable it - jdk non portable in forbiddenapis detects classes being used from the JDK ( for fips ) that are not portable, this is intended so we don't scan for it on fips. - different exclusion rules for third party audit on fips Closes #33179
- third party audit detects jar hell with JDK so we disable it - jdk non portable in forbiddenapis detects classes being used from the JDK ( for fips ) that are not portable, this is intended so we don't scan for it on fips. - different exclusion rules for third party audit on fips Closes #33179
Ever since 82d10b4 the forbidden API checks have been failing on the fips builds. It isn't clear if this is a problem with the build or it is revealing a real problem with our fips compliance. I'm assigning to @atorok to investigate because he made the commit that broke the builds. If it turns out that this is a problem with our compliance he'll pass it off to someone who knows more about that stuff.
https://elasticsearch-ci.elastic.co/job/elastic+elasticsearch+master+matrix-java-periodic/ES_BUILD_JAVA=java10,ES_RUNTIME_JAVA=java8fips,nodes=virtual&&linux/263/console
The text was updated successfully, but these errors were encountered: