ssh-util: drop FIPS path from openssh-static, keep non-FIPS build#36858
Merged
Conversation
5 tasks
jasonhernandez
force-pushed
the
jason/sec-236-openssh-static-no-fips
branch
from
a4f9f1b to
2ccbafc
Compare
Carves the FIPS work out of #35858 (moved to a separate SEC-236 draft that is gated on AWS-LC-FIPS 3.x completing NIST CMVP validation). The static OpenSSH image stays on main because it is the prerequisite for the distroless migration of environmentd/clusterd, independent of FIPS. - Remove the AWS_LC_FIPS build arg and the -DFIPS=1 cmake path; the image now builds only a non-FIPS static ssh against a regular AWS-LC release. - Bump OpenSSH to V_10_3_P1. 10.0+ natively stubs BN_set_flags() for AWS-LC (openssl-compat.h, under OPENSSL_IS_AWSLC), so the prior -DBN_FLG_CONSTTIME=0 shim is no longer needed and is dropped. That define was a footgun: a global value-define of a security-critical OpenSSL macro to 0, inert against AWS-LC but a latent timing-side-channel landmine if the backend ever changed. - Inject nothing at build time; run a plain `./configure && make ssh` so OpenSSH's hardening/optimization flags are preserved (a `make CFLAGS=...` override would replace them, producing an unhardened binary). - Remove the dormant MZ_FIPS SSH-config enforcement from tunnel.rs (fips_mode_enabled / write_fips_ssh_config and the call site). Verified: `docker build` produces a statically-linked OpenSSH_10.3p1 binary against AWS-LC 1.54.0 (3.9M, stripped). Part of SEC-236. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jasonhernandez
force-pushed
the
jason/sec-236-openssh-static-no-fips
branch
from
2ccbafc to
ce29a37
Compare
Contributor
Author
|
@def- per your feedback / review. I'm removing the incomplete scaffolding for FIPS support and just focusing on getting rid of the openssh dependency to unblock more use of distroless for now. |
def-
approved these changes
Jun 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Carves the FIPS work out of #35858 and back into a separate draft (#36859), which is gated on AWS-LC-FIPS 3.x completing NIST CMVP validation. The static OpenSSH image stays on main because it is the prerequisite for the distroless migration of environmentd/clusterd, independent of FIPS.
This addresses the post-merge QA review on #35858 (#35858 (comment)), which found the FIPS path could not actually produce a validated module yet.
Changes
AWS_LC_FIPSbuild arg and-DFIPS=1cmake path; the image now builds only a non-FIPS staticsshagainst a regular AWS-LC release. Bump OpenSSH toV_10_3_P1, which natively stubsBN_set_flags()for AWS-LC, so the prior-DBN_FLG_CONSTTIME=0shim is dropped (it was a footgun: a global value-define of a security-critical OpenSSL macro to0).-DBN_FLG_CONSTTIME=0at configure time so OpenSSH's hardening/optimization flags (-O2,-fstack-protector-strong,-fPIE,-ftrapv, ...) are preserved. Amake CFLAGS=...override silently replaced them, producing an unhardened binary.MZ_FIPSSSH-config enforcement (fips_mode_enabled/write_fips_ssh_configand the call site).Opened as a draft at the author's request.
Part of SEC-236.
Test plan
cargo check -p mz-ssh-utilpasses (rustc 1.96.0)cargo fmt -p mz-ssh-util --checkcleanmisc/images/openssh-static/produces a working static binary (verified: statically-linkedOpenSSH_10.3p1against AWS-LC 1.54.0, 3.9M)🤖 Generated with Claude Code