influxdata / influxdata/influxdb

Eliminate use of `golang.org/x/crypto/ssh/terminal` package

Open
#24,035 1 comment 0 reactions 1 assignee Claimed by @gwossum View on GitHub
security security/misc
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

__Proposal:__
Eliminate use of `golang.org/x/crypto/ssh/terminal` package in influxdb. The only function used is `terminal.IsTerminal`, which is just a wrapper around `term.IsTerminal`. Eliminating `golang.org/x/crypto/ssh/terminal` will ease auditing of the enterprise FIPS build.

__Current behavior:__
Non-FIPS (BoringCrypto) crypto libraries get pulled in, which creates potential issues with FIPS auditing due to pulling non-FIPS crypto functions.

__Desired behavior:__
The entire `golang.org/x/crypto/ssh` package is eliminated from the build.

__Alternatives considered:__
Using a Go workspace to substitute an alternate `golang.org/x/crypto` module. This requires a lot of code to replicate functionality in `golang.org/x/crypto`, as there are portions of `golang.org/x/crypto` that will call to the BoringCrypto library when used and can be linked into the final binary. This also requires a large chunk of code that isn't actually relevant to InfluxDB OSS.

__Use case:__
FIPS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.