Port openssl package #1
Conversation
|
|
||
| OpenSSL is used for a given build only in limited circumstances: | ||
|
|
||
| - The platform must be GOOS=linux. |
There was a problem hiding this comment.
Hmm, do you know if this will probably work on arm64 etc.? Nothing comes to mind that would prevent it from working just like it does on amd64, but this made me curious.
There was a problem hiding this comment.
It should work on any platform that is supported by OpenSSL and that can use dlopen and pthreads. To the best of my knowledge almost any linux box, except Android (see this), fulfill those requirements.
Co-authored-by: Davis Goodin <dagood@users.noreply.github.com>
|
|
||
| > The status of FIPS 140 for Go itself remains "no plans, basically zero chance". | ||
|
|
||
| On the other hand, Google maintains a branch that uses cgo and BoringSSL to implement various crypto primitives: https://github.com/golang/go/blob/dev.boringcrypto/README.boringcrypto.md. As BoringSSL is FIPS 140-2 certified, an application using that branch is more likely to be FIPS 140-2 compliant, yet Google does not provide any liability about the suitability of this code in relation to the FIPS 140-2 standard. |
There was a problem hiding this comment.
The end of this sentence sort of implies that we do provide liability, but it's not explicitly called out. Should we clarify our stance?
There was a problem hiding this comment.
Or at least, OpenSSL does. Either way, as a consumer, it's a bit confusing as to what exactly the guarantees are here.
There was a problem hiding this comment.
Agree that we should be more explicit regarding the FIPS guarantees when using this package, but I'm afraid we don't have them clear yet. Meanwhile I've added a disclaimer into the README which should help on creating the right expectations.
@jaredpar do you have any insights here?
Co-authored-by: Davis Goodin <dagood@users.noreply.github.com>
Co-authored-by: Davis Goodin <dagood@users.noreply.github.com>
This PR copies the openssl package located at crypto/internal/backend/internal/openssl into this repo as a standalone module.
Additional changes:
openssl/internal/subtle, as it is a direct copy ofgolang.org/x/crypto/internal/subtle.