keylime / keylime/rust-keylime
Use system-wide crypto configuration instead of setting a local one
- Dominant language
- Rust
- Stars
- 162
- Forks
- 76
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 3
Description
This is a follow-up on the discussion about using the system-wide crypto configuration instead of setting a locally. See the conclusion of the discussion: https://github.com/keylime/rust-keylime/pull/761/files#r1581052015
There is no easy way to make `rust-openssl` to use the system-wide `openssl` configuration. Following the system-wide configuration has advantages:
- No need to select and maintain the local configuration, just follow the system configuration for a sane selection
- When the system-wide configuration is updated, the crypto used by the agent would be updated automatically, without changes in the code or in the configuration
- When the system is running on FIPS mode and sets a FIPS-approved configuration, the agent would follow the configuration automatically
Normally, when the system uses `crypto-policies` which sets the `openssl` configuration, it is sufficient for the application to use the default configuration to inherit the system-wide configuration. The problem is that `rust-openssl` does not provide an easy way to use the `openssl` default configuration.
Related: #761
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the conclusion in the linked discussion on pull request #761 and review how rust-openssl currently handles OpenSSL configuration. Investigate how the agent can inherit the system-wide crypto-policies configuration, including FIPS-approved settings. Done means the agent follows the system configuration without maintaining a separate local selection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100