Provide a FIPS-compliant build of Vector

[syedriko]

A note for the community

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Use Cases

Run Vector in a FIPS environment

Attempted Solutions

Hand-built subset of Vector avoiding the dependency on ring while replacing it with OpenSSL. In some cases, patching the crates with a hard dependency on ring with a feature that calls into OpenSSL instead.
OpenSSL needs to be linked to vector as a shared object.

Proposal

Provide a cross-cutting feature that builds vector and its dependencies so that the only crypto implementation used is OpenSSL, linked as a shared object.

References

#8435

Version

No response

[jszwedko]

We chatted about this some today. We think a next step we can take here is to provide feature flags to build Vector without components that would violate FIPS compliance (like ring). We can then include this in CI to test that no disallowed crates are included. This would be a step towards providing official FIPS-compliant builds by ensuring that others can continue to build at least a subset of Vector to run in FIPS compliant environments.

[syedriko]

Thank you, @jszwedko! That indeed would be a start.