Skip to content

feat(fips): allow key generation and loading in FIPS 140-3 mode#809

Merged
JasonPowr merged 1 commit into
mainfrom
fips-work
Jul 20, 2026
Merged

feat(fips): allow key generation and loading in FIPS 140-3 mode#809
JasonPowr merged 1 commit into
mainfrom
fips-work

Conversation

@JasonPowr

Copy link
Copy Markdown
Member

Summary

  • Allow cosign key generation and loading in FIPS mode by storing keys as unencrypted PKCS#8 PEM, bypassing non-FIPS scrypt/NaCl encryption
  • Password-protected keys remain blocked in FIPS mode
  • Unencrypted keys rejected in non-FIPS mode to prevent password bypass

@JasonPowr
JasonPowr requested a review from osmman July 15, 2026 10:22
@osmman

osmman commented Jul 20, 2026

Copy link
Copy Markdown

@JasonPowr Please use rebase rather than merge of main to dev branch

@JasonPowr

Copy link
Copy Markdown
Member Author

/retest

@JasonPowr

Copy link
Copy Markdown
Member Author

All current EC failures are related to fetch-tsa-certs, not related to my PR, merging

@JasonPowr
JasonPowr merged commit b011ccc into main Jul 20, 2026
33 of 37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants