/srv/irclogs.ubuntu.com/2021/12/17/#ubuntu-devel.txt

=== genii is now known as genii-core
=== doko__ is now known as doko
=== alan_g_ is now known as alan_g
juliankhallyn, jmbl it's just not super ready yet to actually revoke stuff via sbat10:26
=== Guest45 is now known as wilkmar
hallynjuliank: is there a list of things that aren't ready yet, and a forum where the stuff's happening?13:24
juliankhallyn: there have not been any SBAT revocations yet, once there are things should be clearer14:27
juliankas in we have a broad understanding of how it should work, but we'll see if it *really* works that way once it happens14:32
hallynjuliank: but are there any documents right now htat actually clearly outline how it's *meant* to work?  Or is SBAT.md in rhboot/shim it?14:38
juliankSBAT.md is the only public resource I am aware of14:38
hallynI'm a tinge surprised there aren't more people out there talking about (a) how to use a self-signed shim on your laptop to (b) run  your own .efi and then (c) self-sign an SbatVersion variable for it.14:39
hallyns/aren't more/aren't any/14:39
hallynbut thanks, juliank .  Good to know.14:40
beisner⭐🎄🎁 Cheers, Ubufriends!14:46
hallynbeisner: \o  may your tree also be rich with presents :)14:54
ahasenackschopin: hi, do you know something about FIPS_mode() and openssl3?15:02
ahasenacki.e., is it a known drop in the 3 version?15:02
ahasenackin 1.1.1l we have /usr/include/openssl/crypto.h:int FIPS_mode(void);15:03
ahasenackok, looks like it was removed15:07
schopinahasenack: yes, it is. there's a straightforward replacement, though.15:19
schopinEVP_default_properties_enable_fips(3) and  EVP_default_properties_is_fips_enabled(3) (15:20
schopinFIPS_mode() should be replaced by EVP_default_properties_is_fips_enabled(NULL) IIRC15:22
=== genii-core is now known as genii
brycehahasenack, having some firefox trouble be at standup in a min hopefully16:01
ahasenackbryceh: ok16:02
ahasenackschopin: yeah, found this in a commit16:06
ahasenack+#if OPENSSL_VERSION_NUMBER >= 0x30000000L16:06
ahasenack+               if (!EVP_default_properties_is_fips_enabled(NULL)) {16:06
ahasenack+#else16:06
ahasenack                if (FIPS_mode() == 0) {16:06
ahasenack+#endif16:06
* schopin has written lots of variations on this one in the past few weeks :)16:07
schopinNote that if you have an explicit ctx object, you might want to pass it to EVP_default...() (assuming said context is used to query the algorithms)16:08
ahasenackinstead of null, ok16:11
=== genii is now known as genii-core

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!