FIPS builds for nixpkgs

[goertzenator]

I am working towards packaging FIPS builds of aws-lc for nixpkgs. I am tentatively targeting two versions:

validated: Has a NIST validation certificate, currently AWS-LC-FIPS-2.0.0.
recommended: Latest release, currently AWS-LC-FIPS-3.3.0

The rationale is that some may demand a validated version while others will demand a version with bugfixes.

Getting packages and updates merged into nixpkgs can take a long time so I want to take advantage of the automatic version update features of nixpkgs. Automatically picking up the latest AWS-LC-FIPS version will be easy, however I seek a reliable machine readable way to detect the current validated version.

So, is there currently a reliable way to get the NIST validated version? If not, can we add one?

[dougch]

Thanks for working on nixpkgs!

The current ways to track FIPS versions are our FIPS.md and release tags prefixed with AWS-LC-FIPS.

While the recommended version can be found with a release tag, validation status isn't machine-readable today.

What other mechanism for validation status would be helpful: a structured file, an additional git tag, or something else ?

[goertzenator]

How about something like...

FIPS_VERSIONS.json :

{"validated":
  {
    "AWS-LC-FIPS-2.0.0": {},
    "AWS-LC-FIPS-1.1.0": {},
    "AWS-LC-FIPS-1.0.2": {}
  }
}

This should meet nixpkgs's need to find the latest validated version, but also leaves the door open to install more metadata in the future if other needs arise.

If that approach is acceptable I will test it out next week and submit a PR. I would also add a mention in FIPS.md to offer it to other users and as a cue for maintainers to keep it up to date.

BTW, thank you for the quick and positive response!

[samuel40791765]

Thanks for the proposal — a structured JSON file does seem to be a reasonable shape.

Heads up though, but we're actively revising our FIPS release process, and the set of supported branches and their designations will change as part of that. Anything we add today would likely need restructuring shortly after it lands. For now, FIPS.md is the authoritative source. We'll revisit machine-readable options once the new process is finalized and revisit this.