> On 21 Jan 2025, at 21:59, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> (If we end up inventing a FIPS-mode flag, I would fully expect
> interested vendors to patch our code to force it on when the
> OS-level flag is set, which is exactly what they will have done
> to OpenSSL. We should design our behavior with that in mind.)
This patch is essentially a FIPS-mode flag as it's designed to block the
built-in non-certified code in pgcrypto which ensures that OpenSSL is used for
all crypto operations. When setting this GUC to "fips" it will match the
OpenSSL setting, disable built-in crypto when OpenSSL has FIPS enabled and
allow it when OpenSSL has FIPS disabled. Setting it to off will disable
built-in crypto regardless of FIPS mode in OpenSSL.
--
Daniel Gustafsson
