Consider a FIPS category for cryptography smoke tests
- Dominant language
- C#
- Stars
- 18.3k
- Forks
- 5.6k
- PR merge metrics
- PR metrics pending
Description
The folks at Azure Linux would like to be able to validate SCOSSL on a FIPS-enforced configuration. The .NET test suite right now assumes that the test environment is not FIPS-enforced, and as discussed in https://github.com/dotnet/runtime/issues/110625 updating every single unit test to correctly handle being in a FIPS enforced environment is a significant undertaking. Thousands of tests fail in a FIPS-enforced environment, making it difficult to sift through the results meaningfully.
As an alternative, we could create a suite of tests that should pass in a FIPS constrained environment. For example, we could decorate tests with an xunit category like:
```C#
[Trait(XunitConstants.Category, "FIPS")]
```
And put that on tests and classes that should pass under FIPS, then can be run like so:
```shell
./dotnet.sh test src/libraries/System.Security.Cryptography/tests --filter category=FIPS /p:FullAssemblySigningSupported=false
```
The idea would not be to decorate every single thing that is FIPS compatible with the attribute, but to create a reasonable enough smoke test suite to exercise certain things.
Contributor guide
Assessment
This issue has not been assessed yet.