CryptoPolicies: crypto-team -> fesco for exception approvals

decathorpe commented

2026-07-10 15:24:15 +00:00

Owner

see discussion and decision in
https://forge.fedoraproject.org/fesco/tickets/issues/3624#issuecomment-1060843

Note that with FESCo approval now needed, I dropped the separate step for FPC approval, since having both seems superfluous. If this is not desirable, I can drop this change from this PR.

see discussion and decision in <https://forge.fedoraproject.org/fesco/tickets/issues/3624#issuecomment-1060843> Note that with FESCo approval now needed, I dropped the separate step for FPC approval, since having both seems superfluous. If this is not desirable, I can drop this change from this PR.

decathorpe added 1 commit

2026-07-10 15:24:16 +00:00

CryptoPolicies: crypto-team -> fesco for exception approvals 37e2c3e9ec

gotmax23 commented

2026-07-10 16:10:23 +00:00

Owner

+1

ngompa commented

2026-07-10 16:12:10 +00:00

Owner

We should probably have a statement that exceptions need to be documented with the FPC?

carlwgeorge commented

2026-07-11 00:14:44 +00:00

Owner

+1

decathorpe commented

2026-07-11 17:44:53 +00:00

Author

Owner

@ngompa wrote in #1555 (comment):

We should probably have a statement that exceptions need to be documented with the FPC?

Where? A new (for now, empty?) section at the bottom of https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/?

@ngompa wrote in https://forge.fedoraproject.org/packaging/guidelines/pulls/1555#issuecomment-1060879: > We should probably have a statement that exceptions need to be documented with the FPC? Where? A new (for now, empty?) section at the bottom of <https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/>?

ngompa commented

2026-07-11 17:54:54 +00:00

Owner

Yes, I think that makes sense.

gotmax23 commented

2026-07-11 20:59:13 +00:00

Owner

crypto-policies(7) currently lists

   •   Go-language applications do not yet follow the system-wide policy.

   •   GnuPG-2 application does not follow the system-wide policy.

as exceptions. Do we want to list those in this new section in the Packaging Guidelines also?

`crypto-policies(7)` currently lists • Go-language applications do not yet follow the system-wide policy. • GnuPG-2 application does not follow the system-wide policy. as exceptions. Do we want to list those in this new section in the Packaging Guidelines also?

ngompa commented

2026-07-11 21:08:12 +00:00

Owner

We probably should, since those are currently active exceptions. I didn't even know that was true, especially since Fedora's Go compiler forces the use of OpenSSL-based crypto by default.

gotmax23 commented

2026-07-11 21:58:01 +00:00

Owner

AFAIK go uses openssl for FIPS mode on RHEL via a set of downstream patches, but I'm not sure Fedora's version ever does.

decathorpe force-pushed main from 37e2c3e9ec to 1a52b036d5

2026-07-12 15:05:58 +00:00

Compare

ngompa merged commit 1a52b036d5 into main

2026-07-12 15:07:12 +00:00

decathorpe commented

2026-07-12 15:08:16 +00:00

Author

Owner

I added a (currently empty) set of approved exceptions to my PR.

If we want to add any exemptions to that list, I would prefer to verify that they are actually exempt and add them to documentation independently of this PR.

I added a (currently empty) set of approved exceptions to my PR. If we want to add any exemptions to that list, I would prefer to verify that they are actually exempt and add them to documentation independently of this PR.

ngompa commented

2026-07-12 15:14:04 +00:00

Owner

Works for me!

decathorpe referenced this pull request from fesco/tickets

2026-07-12 17:53:12 +00:00

Stop requiring signoff from non-existent "Fedora crypto team" for new cryptography libraries #3624

Rows
Columns

CryptoPolicies: crypto-team -> fesco for exception approvals #1555