Ma300 impl#428
Draft
alexsander-souza wants to merge 10 commits into
Draft
Conversation
Collaborator
|
Check where you would like a Mattermost message to be sent to when CI completes and this PR is merged
|
alexsander-souza
force-pushed
the
ma300_impl
branch
5 times, most recently
from
5314a78 to
7fae419
Compare
alexsander-souza
commented
Jul 8, 2026
| - type: apt | ||
| ppa: maas/3.7-next | ||
|
|
||
| ppa: alexsander-souza/maas-3.7-fips |
Contributor
Author
There was a problem hiding this comment.
must revert this once the packages land in the PPA
alexsander-souza
force-pushed
the
ma300_impl
branch
from
834ef9e to
fa5ac69
Compare
Deliver a single base-agnostic snap that applies unconditional crypto improvements on every host and activates FIPS-conditional controls plus operational hardening automatically when the host kernel is in FIPS mode. Crypto: OMAPI/rndc HMAC-SHA256, AES-256-GCM RPC, TLS 1.2 minimum, X.509 serial CSPRNG, BMC index hash SHA-256 (with reversible migration 0005), SSH algorithm allow-lists shared across v2/v3 host- and user-key paths, IPMI cipher suite 17. FIPS detection in Python (maascommon.fips) and Go (internal/fips), wired into agent startup via GODEBUG=fips140 and the bind `-F` flag in run-named. Hardening: fail-fast startup validation, database_sslmode restricted to verify-ca/verify-full, password-complexity enforcement, NGINX/SIEM and audit logging, system/info FIPS state behind authentication. API: v3 system/info + ssh-host-keys handlers and services; v2 power parameter FIPS validation for machines and pods.
alexsander-souza
force-pushed
the
ma300_impl
branch
from
fa5ac69 to
06ce4b1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.