Re: Allow tests to pass in OpenSSL FIPS mode

On 04.10.22 17:45, Peter Eisentraut wrote:
> While working on the column encryption patch, I wanted to check that
> what is implemented also works in OpenSSL FIPS mode.  I tried running
> the normal test suites after switching the OpenSSL installation to FIPS
> mode, but that failed all over the place.  So I embarked on fixing that.
>  Attached is a first iteration of a patch.

Continuing this, we have fixed many issues since. Here is a patch set
to fix all remaining issues.

v4-0001-citext-Allow-tests-to-pass-in-OpenSSL-FIPS-mode.patch
v4-0002-pgcrypto-Allow-tests-to-pass-in-OpenSSL-FIPS-mode.patch

These two are pretty straightforward.

v4-0003-Allow-tests-to-pass-in-OpenSSL-FIPS-mode-TAP-test.patch

This one does some delicate surgery and could use some thorough review.

v4-0004-Allow-tests-to-pass-in-OpenSSL-FIPS-mode-rest.patch

This just adds alternative expected files. The question is mainly just
whether there are better ways to organize this.

v4-0005-WIP-Use-fipshash-in-brin_multi-test.patch

Here, some previously fixed md5() uses have snuck back in. I will need
to track down the origin of this and ask for a proper fix there. This
is just included here for completeness.