> On 21 Jan 2025, at 21:59, Tom Lane <t...@sss.pgh.pa.us> wrote: > (If we end up inventing a FIPS-mode flag, I would fully expect > interested vendors to patch our code to force it on when the > OS-level flag is set, which is exactly what they will have done > to OpenSSL. We should design our behavior with that in mind.)
This patch is essentially a FIPS-mode flag as it's designed to block the built-in non-certified code in pgcrypto which ensures that OpenSSL is used for all crypto operations. When setting this GUC to "fips" it will match the OpenSSL setting, disable built-in crypto when OpenSSL has FIPS enabled and allow it when OpenSSL has FIPS disabled. Setting it to off will disable built-in crypto regardless of FIPS mode in OpenSSL. -- Daniel Gustafsson
