influxdata / influxdata/influxdb
Eliminate use of `golang.org/x/crypto/ssh/terminal` package
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Proposal:__
Eliminate use of `golang.org/x/crypto/ssh/terminal` package in influxdb. The only function used is `terminal.IsTerminal`, which is just a wrapper around `term.IsTerminal`. Eliminating `golang.org/x/crypto/ssh/terminal` will ease auditing of the enterprise FIPS build.
__Current behavior:__
Non-FIPS (BoringCrypto) crypto libraries get pulled in, which creates potential issues with FIPS auditing due to pulling non-FIPS crypto functions.
__Desired behavior:__
The entire `golang.org/x/crypto/ssh` package is eliminated from the build.
__Alternatives considered:__
Using a Go workspace to substitute an alternate `golang.org/x/crypto` module. This requires a lot of code to replicate functionality in `golang.org/x/crypto`, as there are portions of `golang.org/x/crypto` that will call to the BoringCrypto library when used and can be linked into the final binary. This also requires a large chunk of code that isn't actually relevant to InfluxDB OSS.
__Use case:__
FIPS
Contributor guide
Assessment
This issue has not been assessed yet.