Skip to content
This repository has been archived by the owner on Aug 12, 2024. It is now read-only.

Remove custom crypto library dependencies #683

Open
1 task
ncdc opened this issue Aug 11, 2023 · 1 comment
Open
1 task

Remove custom crypto library dependencies #683

ncdc opened this issue Aug 11, 2023 · 1 comment
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.

Comments

@ncdc
Copy link
Member

ncdc commented Aug 11, 2023

We currently indirectly depend on https://github.com/cloudflare/circl, which complicates ensuring FIPS compliance because it is outside of standard go crypto. We need to remove all custom crypto dependencies.

go mod why -m github.com/cloudflare/circl
# github.com/cloudflare/circl
github.com/operator-framework/rukpak/internal/source
github.com/go-git/go-git/v5
github.com/ProtonMail/go-crypto/openpgp
github.com/ProtonMail/go-crypto/openpgp/internal/ecc
github.com/cloudflare/circl/dh/x25519

We also need to remove golang.org/x/crypto usage:

go mod why -m golang.org/x/crypto
 # golang.org/x/crypto
github.com/operator-framework/rukpak/internal/source
golang.org/x/crypto/ssh

I believe both of these can be solved by:

@github-actions
Copy link

This issue has become stale because it has been open 60 days with no activity. The maintainers of this repo will remove this label during issue triage or it will be removed automatically after an update. Adding the lifecycle/frozen label will cause this issue to ignore lifecycle events.

@github-actions github-actions bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 11, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale.
Projects
None yet
Development

No branches or pull requests

1 participant