[FIPS] Use compliant algorithms in Optimizer #190642
Conversation
Ikuni17
added
Team:Operations
|
Pinging @elastic/kibana-operations (Team:Operations) |
💚 Build Succeeded
Metrics [docs]
To update your PR or re-run it, just comment with: cc @Ikuni17 |
| @@ -50,6 +50,7 @@ export function getWebpackConfig( | |||
| profile: worker.profileWebpack, | |||
|
|
|||
| output: { | |||
| hashFunction: 'sha1', | |||
There was a problem hiding this comment.
Do other webpack configs need to be updated? storybooks / kbn-ui-shared-deps-{src,npm}?
There was a problem hiding this comment.
Unsure about the other configs. During discussions with the Security team, we wanted to avoid as many changes as possible to build/tooling under FIPS mode because it is generally for development. Example NODE_OPTIONS='' yarn kbn bootstrap disables FIPS because some modules use non-compliant algorithms during their own build process , like sharp, and error the whole bootstrap.
So, I think we can leave it for now unless needed. Security will be triaging non-compliant algorithm usage throughout the code base with relevant teams and it will arise then. The other aspect is whenever we get on Webpack 5, it already uses FIPS compliant algorithms.
There was a problem hiding this comment.
Were there issues with this config? IIRC it should be development only too.
There was a problem hiding this comment.
It blocks Kibana from starting in development mode, therefore blocking other teams from fixing FIPS issues in their code.
Summary
Updates the Optimizer to user FIPS compliant algorithms, otherwise Kibana will crash during startup in development mode. This was originally part of #188887.