Wiki - https://fedoraproject.org/wiki/Changes/Deprecate_gtk3-rs
Discussion Thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-deprecate-gtk3-r…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The Rust bindings for GTK3 (and related libraries) are unmaintained
upstream, and are no longer updated in lockstep with bindings for GLib
and other related libraries. This Change to mark the packages for the
gtk3-rs crates as deprecated reflects this status.
== Owner ==
* Name: [[User:Decathorpe| Fabio Valentini]]
* Email: decathorpe (at) gmail (dot) com
* Name: Rust SIG
* Email: rust (at) lists (dot) fedoraproject (dot) org
== Detailed Description ==
It was announced that the Rust bindings for GTK3 are on basic
maintenance only in the
[https://gtk-rs.org/blog/2023/02/10/new-release.html release
announcement for gtk-rs 0.17].
The [https://gtk-rs.org/blog/2023/08/28/new-release.html release
announcement for gtk-rs 0.18] noted that it would be the last release
that included the GTK3 bindings.
As expected, the [https://gtk-rs.org/blog/2024/06/01/new-release.html
release announcement for gtk-rs 0.19] announces that support for the
GTK3 bindings was officially dropped.
Applications that rely on the Rust bindings for GTK3 continue to pull
in version 0.18 of the Rust bindings for GLib, cairo, pango, etc.
(which were obsoleted by version 0.19 and then 0.20) and the
unmaintained bindings for atk and gdk. This also affects the Rust
bindings for libhandy.
These Rust bindings receive regular fixes for safety and correctness
issues - continuing to depend on old versions is not ideal, since only
critical fixes are backported to the Fedora packages for these
obsolete versions (if that is even possible). The upstream project
does not backport fixes or release new versions of older release
branches at all.
== Feedback ==
N/Y
== Benefit to Fedora ==
The Rust bindings for GTK3 are obsolete. This Change ensures that no
new packages are introduced that depend on them, and that they can
eventually be removed from Fedora entirely (alongside old versions of
the bindings for GLib, cairo, pango, etc. that are only still present
because they are pulled in by the GTK3 bindings that are no longer
updated in lockstep).
== Scope ==
* Proposal owners:
All affected packages are marked with `Provides: deprecated()`
according to the
[https://docs.fedoraproject.org/en-US/packaging-guidelines/deprecating-packa…
Packaging Guidelines for deprecating packages].
rust-atk
rust-atk-sys
rust-gdk
rust-gdk-sys
rust-gtk
rust-gtk-sys
rust-gtk3-macros
rust-libhandy
rust-libhandy-sys
* Other developers:
N/A
* Release engineering:
N/A
* Policies and guidelines:
N/A
* Trademark approval:
N/A
* Alignment with the Fedora Strategy:
Err ... maybe?
== Upgrade/compatibility impact ==
N/A
== How To Test ==
Ensure that `dnf repoquery --provides rust-$crate-devel` includes
`deprecated()` for all listed packages in Fedora 42+.
== User Experience ==
N/A
== Dependencies ==
Two packages currently depend on the Rust bindings for GTK3, and both
already have open upstream issues for moving to GTK4:
* squeekboard: https://gitlab.gnome.org/World/Phosh/squeekboard/-/issues/64
* system76-keyboard-configurator:
https://github.com/pop-os/keyboard-configurator/issues/133
== Contingency Plan ==
N/A (not a System Wide Change)
In the extremely unlikely event that adding `Provides: deprecated()`
to any or all of the listed packages causes problems, this change can
be easily reverted.
* Contingency mechanism: N/A (not a System Wide Change)
* Contingency deadline: F42 Final Freeze
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
* https://gtk-rs.org/blog/2023/02/10/new-release.html
* https://gtk-rs.org/blog/2023/08/28/new-release.html
* https://gtk-rs.org/blog/2024/06/01/new-release.html
== Release Notes ==
The Rust bindings for GTK3 are obsolete and officially unmaintained.
The packages for them have been marked as deprecated to prevent new
packages that depend on them from being added to Fedora, and they will
be removed from a future release.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/AutomatedPackitOnboarding
Discussion thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-automated-onboar…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
To ease the onboarding process for package maintainers and their
release workflows, we propose to automatically create pull requests
with the initial [https://packit.dev/ Packit] configuration file for
newly created projects at src.fedoraproject.org. Once merged, this
configuration will enable Packit to automate the release process,
reducing repetitive tasks for maintainers.
== Owner ==
* Name: [[User:lbarczio| Laura Barcziová]], [[User:lachmanfrantisek|
František Lachman]], [[User:nforro| Nikola Forró]], [[User:mmasari|
Maja Massarini]], [[User:mfocko| Matej Focko]]
* Email: lbarczio(a)redhat.com, flachman(a)redhat.com, nforro(a)redhat.com,
mmassari(a)redhat.com, mfocko(a)redhat.com
== Detailed Description ==
This proposal introduces a mechanism to simplify the onboarding of
Fedora package maintainers to Packit by removing the need to create
the configuration manually. When a new project is created at
src.fedoraproject.org, a pull request with a default Packit
configuration file will automatically be opened.
Our proposal would be to add a CLI argument to the `fedpkg
request-repo` command, similar to the existing argument `--monitor`.
By default, this argument would be enabled and it would result in a
Packit pull request being created upon the creation of a new
repository. For maintainers who prefer not to have a Packit pull
request created, this can be easily disabled by setting the relevant
CLI argument during the repository creation request.
Once the pull request is merged, this configuration will:
* Automate the process of opening pull requests for updates when
upstream releases occur (triggered by Upstream Release Monitoring),
including necessary changes to the spec file and sources.
* Handle subsequent Koji builds and Bodhi updates after the pull
requests are merged by the maintainer.
The automation would be configured by default to operate only on `rawhide`.
This ensures that maintainers no longer need to spend time on
repetitive release-related tasks. Instead, they can focus on package
quality and innovation.
The pull request will also contain detailed instructions explaining:
* What is Packit and how the default configuration works.
* How maintainers can customize it to suit their project’s needs, such
as disabling certain tasks.
* The steps to opt out of the automated pull request process.
== Feedback ==
Discussions have indicated an interest in opt-out possibilities. As
mentioned above, our current proposal would be implementing the
opt-out via a CLI argument when requesting the repository creation.
== Benefit to Fedora ==
This change aims to:
* Simplify the initial setup process for using Packit, reducing
barriers for Fedora package maintainers.
* Decrease the time and effort spent on repetitive release-related
tasks, allowing maintainers to focus on their packages’ quality and
innovation.
* Provide maintainers with clear guidance and support for customizing
or opting out of automation to ensure the system is flexible and
user-friendly.
* Introduce Packit to maintainers as they create new packages,
starting with typically simpler projects that are easier to automate,
making it a good opportunity for them to learn about Packit.
== Scope ==
* Proposal owners:
# Implement automated pull request creation and integrate it into
src.fedoraproject.org workflows (probably via `fedpkg request-repo`
command and the related scripts for repo creation).
# Document the new process thoroughly.
# Followup support for users in the created PRs.
* Other developers:
This will be very isolated change that shouldn’t require much (if any)
work done by other developers. If we contribute the code to the repo
creation functionality, we would just need some guidance/review on
these changes.
* Release engineering:
Coordination with release engineering is not required.
A mass rebuild is not necessary for this change.
* Policies and guidelines:
Packaging guidelines should be updated to describe this process and
the opt-out option, after the implementation is done.
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
This proposal aligns with Fedora’s strategy of improving contributor
experience and easing workflows, supporting a more efficient and
user-friendly ecosystem.
== Upgrade/compatibility impact ==
This change will not affect the compatibility/upgrade.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
== How To Test ==
Requesting a new repo in src.fedoraproject.org should result in pull
request with Packit configuration being created for that repo.
== User Experience ==
With this change, package maintainers will experience:
* Automated pull requests containing default Packit configuration
files for newly created projects at src.fedoraproject.org.
* Clear explanations and instructions within the pull requests to help
them understand the configurations and make necessary adjustments.
* The ability to quickly get started with Packit without needing to
manually create configuration files.
* An opt-out option for those who prefer not to/can’t (their packages
are not suitable for this kind of automation) use Packit.
Once the Packit configuration is merged, the release process will be
almost fully automated. This includes:
* Opening pull requests for required updates when upstream releases occur.
* Performing Koji builds and Bodhi updates automatically after merging
the updates by the maintainer.
This automation significantly reduces the repetitive workload for
maintainers, allowing them to dedicate their time to improving package
quality and addressing other critical aspects of their projects.
== Dependencies ==
N/A
== Contingency Plan ==
This feature is technically not really tight to the new Fedora version.
* Contingency mechanism: N/A
* Contingency deadline: N/A
* Blocks release? No
== Documentation ==
There is no documentation for this yet, the work needed to be done by
Packit maintainers is tracked in
https://github.com/packit/packit-service/issues/2506. The
documentation will be done as part of the work.
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Hi folks,
Voting has now opened for the F41 election for FESCo. You can cast your
votes from the elections app <https://elections.fedoraproject.org/> and
read the candidates interviews from here, or go to the elections blog post
<https://communityblog.fedoraproject.org/f41-elections-voting-is-now-open/>
for a linked list of our candidates.
Voting will close on Friday 20th december with the results announced on
Monday the 23rd December.
Best of luck to all of our great candidates!
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Hello folks,
In order to hold an election for FESCo this cycle, we need more candidates!
FESCo has decided to extend the nominations period until Thursday 5th
December[1], which means if you or someone you know would like to run for
election for FESCo, you now have until 23:23:59 UTC on Thursday 5th
December to nominate yourself or someone else[2]. Please make sure you have
the permission of the person you wish to nominate before nominating them.
If we receive enough candidates to hold an election for FESCo, voting will
start on Friday 6th December, as per the elections schedule[3].
If we do not receive enough nominations to hold an election by Thursday
December 5th, the current candidates will be automatically elected to FESCo.
Kindest regards.,
Aoife
[1] https://pagure.io/fesco/issue/3292
[2] https://fedoraproject.org/wiki/Development/SteeringCommittee/Nominations
[3] https://fedorapeople.org/groups/schedule/f-41/f-41-elections-tasks.html
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/SDL2onSDL3
Discussion Thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-replace-sdl-2-wi…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
This Change proposes to replace SDL 2 with sdl2-compat, which uses SDL 3.
== Owner ==
* Name: [[User:Ngompa| Neal Gompa]]
* Email: ngompa13(a)gmail.com
== Detailed Description ==
SDL 2 feature development ended some time ago with efforts being
focused on SDL 3. However, many older games still use SDL 2 and cannot
change to SDL 3. In order to continue to support SDL 2 games in the
modern world, let's replace SDL 2 with sdl2-compat, which uses SDL 3.
This also has the effect of moving SDL 1.2 games to SDL3 through
sdl12-compat running on sdl2-compat.
== Feedback ==
== Benefit to Fedora ==
Switching SDL 2 powered games to use <code>sdl2-compat</code> ensures
that SDL-based applications continue to use the actively developed
codebase. This also has the effect of SDL 1.2 powered games that use
<code>sdl12-compat</code> to run on SDL3 as well through the fully
supported path of <code>sdl12-compat</code> running on
<code>sdl2-compat</code> running on SDL3.
== Scope ==
* Proposal owners:
** Package [https://github.com/libsdl-org/sdl2-compat libsdl2-compat]
(native: [https://bugzilla.redhat.com/2316576 RH#2316576], mingw:
[https://bugzilla.redhat.com/2330101 RH#2330101])
** Retire {{package|SDL2}} and {{package|mingw-SDL2}} completely
* Other developers:
* Release engineering: [https://pagure.io/releng/issue/12485 #12485]
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy: N/A
== Upgrade/compatibility impact ==
The <code>SDL2</code> package would be transparently upgraded to
<code>libsdl2-compat</code> package and games using it should just
transparently start using SDL 3.0.
== How To Test ==
The testing steps are simple:
0. Enable the [https://copr.fedorainfracloud.org/coprs/ngompa/SDL2onSDL3/
<code>SDL2onSDL3</code> COPR]: <code>dnf copr enable
ngompa/SDL2onSDL3</code>
1. Swap <code>SDL2</code> for <code>sdl2-compat</code>: <code>dnf swap
SDL2 sdl2-compat</code>
2. Run something that uses SDL 2 like {{package|supertuxkart}} and see
that it works.
3. Run something that uses SDL 1.2 like {{package|icebreaker}} and see
that it works.
Issues should be reported upstream for the fastest response:
https://github.com/libsdl-org/sdl2-compat/issues
<!-- REQUIRED FOR SYSTEM WIDE CHANGES -->
== User Experience ==
There shouldn't be a noticeable user impact, other than possibly a
smoother experience because applications are using SDL 3.0.
== Dependencies ==
== Contingency Plan ==
* Contingency mechanism: Revert back to shipping SDL2 / mingw-SDL2 packages
* Contingency deadline: Final Freeze
* Blocks release? N/A (not a System Wide Change)
== Documentation ==
N/A (not a System Wide Change)
== Release Notes ==
Applications that use SDL 2 will now transparently use SDL 3 through
the <code>sdl2-compat</code> package. This makes it so applications
that historically used SDL 2 now use SDL 3.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/Ruby_3.4
Discussion Thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-ruby-3-4-system-…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Ruby 3.4 is the latest stable version of Ruby. Many new features and
improvements are included for the increasingly diverse and expanding
demands for Ruby. With this major update from Ruby 3.3 in Fedora 41 to
Ruby 3.4 in Fedora 42, Fedora becomes the superior Ruby development
platform.
== Owner ==
* Name: [[User:vondruch| Vít Ondruch]]
* Email: vondruch(a)redhat.com
* Name: [[User:mtasaka| Mamoru Tasaka]]
* Email: mtasaka(a)fedoraproject.org
== Detailed Description ==
Ruby 3.4 is upstream's new major release of Ruby. Many new features
and improvements are included.
=== Prism ===
Switch the default parser from parse.y to Prism to improve
maintainability, error tolerance, portability, and performance.
=== Language changes ===
* String literals in files without a `frozen_string_literal` comment
now emit a deprecation warning when they are mutated.
* `it` is added to reference a block parameter.
* Keyword splatting `nil` when calling methods is now
supported.`**nil` is treated similarly to `**{}`, passing no keywords,
and not calling any conversion methods.
* Block passing is no longer allowed in index.
* Keyword arguments are no longer allowed in index.#20218]]
=== Core classes updates ===
* Exception
** `Exception#set_backtrace` now accepts an array of
`Thread::Backtrace::Location`. `Kernel#raise`, `Thread#raise` and
`Fiber#raise` also accept this new format.
* Range
** `Range#size` now raises `TypeError` if the range is not iterable.
=== Compatibility issues ===
* Error messages and backtrace displays have been changed.
** Use a single quote instead of a backtick as a opening quote.
** Display a class name before a method name (only when the class has
a permanent name).
** `Kernel#caller`, `Thread::Backtrace::Location`'s methods, etc. are
also changed accordingly.
* `Hash#inspect` rendering has changed.
** Symbol keys are displayed using the modern symbol key syntax: `"{user: 1}"`
** Other keys now have spaces around `=>`: `'{"user" => 1}'`, while
previously they didn't: `'{"user"=>1}'`
=== C API updates ===
* `rb_newobj` and `rb_newobj_of` (and corresponding macros
`RB_NEWOBJ`, `RB_NEWOBJ_OF`, `NEWOBJ`, `NEWOBJ_OF`) have been removed.
* Removed deprecated function `rb_gc_force_recycle`.
=== Implementation improvements ===
* `Array#each` is rewritten in Ruby for better performance.
=== Miscellaneous changes ===
* Passing a block to a method which doesn't use the passed block will
show a warning on verbose mode (`-w`).
* Redefining some core methods that are specially optimized by the
interpeter and JIT like `String.freeze` or `Integer#+` now emits a
performance class warning (`-W:performance` or `Warning[:performance]
= true`).
== Feedback ==
== Benefit to Fedora ==
With a latest release, Ruby language is supporting the newest language
features, which enables even faster and easier development of Ruby
applications.
== Scope ==
* Proposal owners:
** Finish packaging of Ruby 3.4. Current changes available in PR
https://src.fedoraproject.org/rpms/ruby/pull-request/196
** Rebuilding of Ruby packages providing native extensions (i.e.
packages which depends on libruby).
* Other developers:
** Rebuild of packages with binary extensions (i.e. packages which
depends on libruby) will be handled automatically, but some packages
might need fixes/updates to support Ruby 3.4 properly.
* Release engineering: [https://pagure.io/releng/issue/12469 #12469]
** The packages are going to be rebuild in side-tag, but that does not
need releng involvement nowadays.
* Policies and guidelines: N/A (not needed for this Change)
* Trademark approval: N/A (not needed for this Change)
* Alignment with the Fedora Strategy:
== Upgrade/compatibility impact ==
* User specific Ruby binary extensions need to be rebuild.
* Adjustments to new language features will be needed.
* Ruby packages/application dependencies might need to be adjusted if
newly bundled gems are used.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? No
== How To Test ==
== User Experience ==
The Ruby programs/scripts should behave as they were used to.
== Dependencies ==
<pre>
$ dnf repoquery --disablerepo=* --enablerepo=rawhide
--enablerepo=rawhide-source --arch=src --whatrequires 'ruby-devel' |
sort | uniq | wc -l
122
</pre>
== Contingency Plan ==
* Contingency mechanism: We would like to get a special buildroot tag
to be able to rebuild necessary the packages with Ruby 3.4. If
anything goes wrong, the tag could be easily dropped and previous
version of Ruby 3.3 and its dependencies stays intact. The tag would
be merged into F42 after everything is rebuild.
* Contingency deadline: Mass Rebuild
* Blocks release? No
== Documentation ==
* [http://www.ruby-doc.org/ Help and documentation for the Ruby
programming language]
* [https://github.com/ruby/ruby/blob/ruby_3_4/NEWS.md Ruby 3.4.0 NEWS]
* [https://www.ruby-lang.org/en/news/2024/10/07/ruby-3-4-0-preview2-released/
Ruby 3.4.0 preview2 release announcement]
== Release Notes ==
* The Ruby 3.4 bumps soname, therefore Ruby packages, which use binary
extensions, should be rebuilt. Nevertheless, since upstream paid great
attention to source compatibility, no changes to your code are needed.
https://github.com/ruby/ruby/blob/ruby_3_4/NEWS.md
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/RemoveFipsModeSetup
Discussion Thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-remove-fips-mode…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
Remove the `fips-mode-setup` command provided by the `crypto-policies`
package. The functionality it currently performs will be partially
removed, partially replaced by automation.
== Owner ==
* Name: Clemens Lang
* Email: cllang(a)redhat.com
== Detailed Description ==
`fips-mode-setup` in the `crypto-policies` package is currently used
to switch Fedora systems into FIPS mode. FIPS mode is designed to
change cryptographic components in Fedora (the kernel's crypto API,
OpenSSL, NSS, GnuTLS, and libgcrypt) to comply with the United States
[https://en.wikipedia.org/wiki/FIPS_140 Federal Information Processing
Standards requirements for cryptographic modules, better known as FIPS
140].
We propose removing this utility. Instead, systems should be placed
into FIPS mode using one of the following methods:
* Pass `fips=1` on the kernel command line of the Anaconda installer
(i.e., install in FIPS mode)
* Use the `osbuild-composer` image build functionality with the
<pre>[customizations]\n fips=true</pre> customization to build an
image in FIPS mode
* Use `bootc` as documented at
https://gitlab.com/fedora/bootc/examples/-/tree/main/fips
This will remove all tooling to switching in and out of FIPS mode
after installation. Switching after installation is a bad idea anyway,
see below for the rationale. Switching out of FIPS mode without
reinstalling does not make sense from a compliance point of view.
=== Context information on FIPS ===
For compliance with these standards, the cryptographic modules must be
submitted to the
[https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program
Cryptographic Module Validation Program] run by the US National
Institute of Standards and Technology. Such certifications are lengthy
efforts involving a company accredited to perform review and testing
before submission, the so-called Cryptographic and Security Testing
Laboratories (CSTLs). It takes upwards of a year to receive a
certification, and costs a mid five-figure sum per CPU architecture to
do this. Due to lack of funding and the fast pace of Fedora, Fedora's
modules are not submitted. As a consequence, FIPS mode on Fedora is
useful for testing only. Several distributions downstream of Fedora
(RHEL, AlmaLinux, Oracle Linux, Amazon Linux), perform their own FIPS
validations.
Occasionally, users think that enabling FIPS mode improves security.
While running in FIPS mode does enable some additional checks and
disables some older algorithms, we see FIPS mode as a compliance tool,
not as a security tool. In some situations, enabling FIPS mode
actually '''decreases''' security: for example, LUKS disk encryption
normally uses the modern GPU-resistant Argon2 key derivation function,
but because it is not FIPS-approved, it falls back to the older and
generally considered weaker PBKDF2 in FIPS mode. FIPS mode also does
not allow the use of Curve25519 for key exchange (used by default in
TLS 1.3), or the ChaCha20-Poly1305 authenticated encryption algorithm
(again, used in TLS 1.3) both of which are considered modern and good.
We do not recommend running FIPS mode to "improve security". A
well-configured crypto policy is a much better tool to limit the use
of legacy algorithms without the side effect of disabling newer
non-US-specified algorithms.
=== Why remove `fips-mode-setup`? ===
To correctly switch a system to FIPS mode, multiple knobs need to be adjusted:
* The system-wide cryptographic policy needs to be `FIPS` or based on it
* The `fips` dracut initramfs module needs to be enabled to run an
integrity test (a FIPS 140 requirement) on the kernel image, followed
by re-generating the initramfs
* The kernel command line needs to contain `fips=1` to switch the
kernel to FIPS mode (which also enables a slower FIPS-compliant DRBG)
* If `/boot` is on a separate partition, a
`boot=UUID=<uuid-of-boot-partition>` flag needs to be added to the
kernel command line for the `fips` dracut initramfs module to be able
to find the expected message authentication code for the kernel
binary.
This process is somewhat brittle due to the number of different
changes that need to be made. Additionally, `fips-mode-setup
--disable`, which only exists for testing purposes because the
compliance requirements do not support switching systems out of FIPS
mode, does not undo adding the `fips` module to the initramfs to avoid
a risk that the system will no longer boot afterwards.
`fips-mode-setup --check` subsequently reports an inconsistent
configuration, which is frequently confusing users.
This user confusion is one of the reasons why we propose to remove this tool.
Instead, we will turn the `fips=1` kernel command line flag into the
single source of truth for whether FIPS mode is enabled. We have
already removed or will remove some of the separate knobs and instead
automate them to follow the single source of truth:
* The system-wide cryptographic policy will automatically follow the
`fips=1` kernel command line flag to remove the need for the manual
switch previously performed by `fips-mode-setup`. This is
[https://github.com/dracut-ng/dracut-ng/tree/main/modules.d/01fips-crypto-po…
already implemented by a dracut module], which will add two
bind-mounts before pivoting to the root filesystem if the system is in
FIPS mode, but the crypto-policy is not.
* For systems that are not started using dracut (e.g., containers with
systemd), the `crypto-policies` package ships
`fips-crypto-policy-overlay.service`, which runs early during boot and
also applies these bind mounts. See
https://bugzilla.redhat.com/show_bug.cgi?id=2325499. This change is
independent of this change proposal, and we will pursue this
regardless of whether the community agrees that this change is a good
idea, since it does make sense as a separate incremental improvement.
* Containers started using `podman` on hosts in FIPS mode did already
create these bind mounts, but we are also modernizing that, see
[https://github.com/containers/common/issues/2130
containers/common#2130] and
[https://github.com/containers/common/pull/2174
containers/common#2174].
* The `crypto-policies` package has been adjusted to detect and handle
this situation during upgrades and when `update-crypto-policies --set`
is called manually. This also improves the behavior of
`update-crypto-policies --set` in containers in FIPS mode, which was a
lot more brittle before.
* We will enable the dracut `fips` module on all systems. This is
required for unified kernel images anyway. The `fips` dracut module
does nothing if the system is not in FIPS mode (i.e., `fips=1` is not
on the kernel command line).
The other big reason for removing `fips-mode-setup` is that it allows
switching to FIPS mode after installation, which means that certain
algorithmic choices have already been made. For example, `cryptsetup`
will use PBKDF2 as key derivation function in FIPS setup, but Argon2
otherwise. A system with LUKS disk encryption initially set up outside
of FIPS mode but switched into FIPS mode later using `fips-mode-setup`
would end up in one of two states: either, non-compliant due to the
use of Argon2, or unbootable in case the cryptographic library refuses
the attempt to use Argon2. OpenSSH is also affected during
installation or first system boot with its hostkey algorithm choices.
Additionally, even keys that would be usable in FIPS mode must be
considered tainted on systems switched to FIPS mode after
installation, because key generation behaves different in FIPS mode
(e.g., all RSA keys would have to be thrown away and re-generated).
For these reasons, we have come to the conclusion that the only sane
way to create a system in FIPS mode, is to install it in FIPS mode.
`fips-mode-setup` is therefore actively harmful.
== Feedback ==
Users that do not care about compliance but only run Fedora in FIPS
mode for testing may not want to reinstall from scratch just for that
purpose. For these cases, and when the above limitations are well
understood, the `fips=1` kernel command line flag can be modified
directly, e.g. using
<pre>grubby --update-kernel=ALL --args="fips=1 boot=UUID=$(blkid
--output value --match-tag UUID "$(findmnt --first --noheadings -o
SOURCE /boot)")"</pre>
The `boot=UUID=<partition-uuid>` part of this command is only required
if `/boot` is a separate partition, because the `fips` dracut
initramfs module will otherwise not be able to locate the message
authentication code to verify the integrity of the kernel image.
Users that do not care about compliance that want to switch systems
out of FIPS mode can equally use grubby to remove the `fips=1` kernel
command line flag.
== Benefit to Fedora ==
* Upstream testing on systems in FIPS mode will use consistent
algorithm choices everywhere.
* Misconfigurations such as the use of the Argon2 key derivation
function for LUKS disk encryption in FIPS mode will be reduced.
* Misconfigurations such as the use of a non-FIPS system-wide
cryptographic policy in FIPS mode will automatically be avoided
* Maintenance for `fips-mode-setup` can be stopped, freeing up
resources for other changes
== Scope ==
* Proposal owners: Most of the changes mentioned above are incremental
improvements that made sense on their own and have already landed.
Removal of the `fips-mode-setup` tool is the remaining step that could
not be done without a change proposal and TBD.
* Other developers: No further changes are expected from other
developers. From a user point of view, FIPS mode will continue to work
as it did before. The only change is on how to enable FIPS mode. The
anaconda installer that used to invoke `fips-mode-setup` has already
been changed to call `/usr/libexec/fips-setup-helper` provided by the
`crypto-policies` package instead.
* Release engineering: [https://pagure.io/releng/issue/12472 #12472]
* Policies and guidelines: not needed for this Change
* Trademark approval: not needed for this Change
* Alignment with the Fedora Strategy: This simplifies the ecosystem
connections because it reduces the number of downstream changes.
== Upgrade/compatibility impact ==
Systems in FIPS mode that were configured to not use the FIPS
system-wide cryptographic policy will see their policy automatically
be changed to FIPS mode. Running in FIPS mode with a non-FIPS
crypto-policy is considered a misconfiguration.
Scripts that used `fips-mode-setup` will stop working after the upgrade.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? No
== How To Test ==
Testers that will try the three methods outlined above to switch to
FIPS mode are welcome. From downstream testing, we expect no issues.
Using `dnf reinstall crypto-policies` on a system that has the two
bind-mounts for the FIPS crypto-policy (i.e., that's in FIPS mode but
its crypto-policy was not manually switched to `FIPS`) should pass
without issue, and the files in `/etc/crypto-policies/back-ends`
should correspond to those in
`/usr/share/crypto-policies/back-ends/FIPS`. We also expect no issues
here from downstream testing.
Testers that run Fedora containers with systemd on hosts in FIPS mode
(i.e., `/proc/sys/crypto/fips_enabled` contains `1`) both with
`podman` and with other container runtimes are very welcome.
== User Experience ==
Users will notice that `fips-mode-setup` no longer exists. Users that
want to switch systems to FIPS mode need to follow different steps.
At the same time, switching to FIPS mode now comes with fewer pitfalls
and fewer possibilities for misconfigurations and inconsistencies.
== Dependencies ==
The following packages have already adapted to this potential change
and will continue to work:
* `anaconda`
* `dracut`
* `podman`
* `crypto-policies` (in particular `update-crypto-policies` and the
package `%pre` and `%post` scriptlets)
== Contingency Plan ==
* Contingency mechanism: We will keep `fips-mode-setup` and try again
next release
* Contingency deadline: beta freeze (or even later, if required)
* Blocks release? No
== Documentation ==
* https://github.com/dracut-ng/dracut-ng/pull/576
* https://github.com/containers/common/issues/2130
* https://github.com/containers/common/pull/2174
* https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/205
== Release Notes ==
The `fips-mode-setup` command that could be used to switch systems to
FIPS mode after installation has been removed.
Switching to FIPS mode after installation has subtle bugs and is no
longer recommended. To switch systems to FIPS mode,
* add `fips=1` to the kernel command line of the installer
* use `osbuild-composer` with the following customization to build a
FIPS-enabled image:
[customizations]
fips = true
* use `bootc` and add the `fips=1` kernel command line flag in your
`Containerfile` as documented in the example at
https://gitlab.com/fedora/bootc/examples/-/tree/main/fips
To disable FIPS mode, re-install your system without enabling FIPS
mode. Disabling FIPS mode without reinstalling does not make sense
from a compliance point of view.
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney
Wiki - https://fedoraproject.org/wiki/Changes/IntelSGX
Discussion Thread -
https://discussion.fedoraproject.org/t/f42-change-proposal-intel-sgx-softwa…
This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes
process, proposals are publicly announced in order to receive
community feedback. This proposal will only be implemented if approved
by the Fedora Engineering Steering Committee.
== Summary ==
The Intel SGX technology enables creation of execution enclaves, whose
memory is encrypted and thus protected from all other code running on
the CPU, including SMM, firmware, kernel and userspace. This proposal
is to introduce the SGX host software stack, architectural enclaves
and development packages to Fedora, to enable future introduction
applications and features which have a dependency on SGX technology.
The primary feature that will leverage SGX in a subsequent Fedora
release is expected to be Intel TDX, which provides confidential
virtual machines, and is in the process of being integrated with QEMU
and Linux/KVM.
== Owner ==
* Name: [[User:berrange| Daniel Berrange]]
* Email: berrange(a)redhat.com
== Detailed Description ==
The Intel SGX technology enables creation of execution enclaves, whose
memory is encrypted and thus protected from all other code running on
the machine, including SMM, firmware, kernel and userspace. While it
has many potential use cases, this proposal is focused around the
infrastructure needed to enable support for attestation of TDX
confidential virtual machines.
The SGX software stack that is to be introduced can be categorized
into a number of distinct areas:
* Support for developing new enclaves
** Header files for the enclave code (a minimalist C library, C++
library, crypto and some other misc libraries)
** Static library archives for linking into the enclave binaries.
** Build helper tools (for signing enclaves, generating code enclave
API entrypoints)
* Support for developing applications that use enclaves, eg to be able
to load and communicate with enclaves.
** Header files for platform code
** Dynamic libraries for platform code
* Support for deploying applications that use enclaves
** Enclave service daemon - assists unprivileged applications in
loading enclaves
** Registration tools - assists platform administrator in acquiring
certificates from Intel servers to identity the platform
** Quote generation daemon - assists QEMU in acquiring signed
attestation reports for TDX VMs.
The code and binaries related to the host OS platform components will
be installed in the normal filesystem locations common to all Fedora
packages. e.g. libraries in '''/usr/lib64''', headers in
'''/usr/include''' and binaries in '''/usr/bin'''.
For the purposes of packaging, the enclaves will be
[https://fedoraproject.org/wiki/Virt/SGXEnclaves#Enclaves_as_a_platform_buil…
treated as cross-compilation target]. While the compiler build
architecture target is '''x86_64''', the runtime has custom C / C++
libraries that must be used, and requires a separate code loader, all
completely separate from any existing Fedora libraries. Enclaves
cannot be directly linked to applications, they are strictly
independent & self-contained ELF binaries.
With this in mind, following the example of MinGW64 packages living
under '''/usr/x86_64-w64-mingw''', all enclave related headers and
libraries are proposed to be placed under '''/usr/x86_64-intel-sgx''',
specifically the '''lib64''' and '''include''' sub-directories. There
is no concept of executable binaries for enclaves, only libraries, nor
ancillary data files. Thus no '''bin''' or '''share''' directories are
required under this location. The installation tree locations will be
defined in RPM macros provided by the '''sgx-srpm-macros''' package
The generated binary packages will generally all have an ''sgx-''
prefix to their name, with those containing exclusively enclave
related content having the more specialized ''sgx-enclave-'' name
prefix.
For reasons of brevity, this change proposal does not go far into all
technical details of SGX. For a deeper understanding of SGX enclaves
beyond this proposal, [https://fedoraproject.org/wiki/Virt/SGXEnclaves
consult this companion document].
== Feedback ==
* '''Feedback:''' ''The SGX technology can be used as a way to
implement DRM. Notable example has been BluRay playback.''.
'''Answer:''' As with many technologies, it is possible to use SGX in
ways that are both positive and negative, wrt the owner / users of a
machine. Use of SGX for DRM in BluRay playback is hostile to the
owner/user of a machine. This change is '''NOT''' proposing to
introduce / support any such usage/applications in Fedora. The fact
that bad uses of SGX may exist outside of Fedora, is no justification
for rejecting the use of SGX in Fedora when applied to scenarios that
can offer features directly benefiting Fedora's users.
* '''Feedback:''' ''The SGX enclave code is not open source, because
it requires a vendor signature on output binaries''. '''Answer:''' All
of the SGX code is made available under a variety open source licenses
(Apache, BSD, MIT, GPL & more), which are fully approved by Fedora.
One of the architectural enclaves, '''pce''', requires an Intel
signature because it is used to establish the root of trust with the
hardware. In their role of bootstrapping use of SGX hardware, the
architectural enclaves are a type of firmware, and it is normal for
firmware to have a vendor signature. In contrast to almost all
firmware which is proprietary, the architectural enclave code is all
under Fedora approved OSS licenses. All of the architectural enclaves,
can be rebuilt from source by a user, with customizations, signed with
a user specified key and then loaded if desired. There are some subtle
limitations if attempting this, documented in
[[Virt/SGXEnclaves#Rebuilding_&_self-signing_architectural_enclaves |
the companion document]], but the code is none the less all OSS.
== Benefit to Fedora ==
As a general purpose infrastructure technology, SGX can be applied to
/ used by a wide variety of scenarios / applications.
In the context of this change proposal, '''no application''' usage is
intended to be introduced, the focus is around general software
infrastructure enablement.
A followup change proposal (for a subsequent Fedora release) will be
made to introduce Intel TDX confidential virtual machines, which is
anticipated to be the first end user facing application of SGX
technology. Attestation is the means by which a guest VM owner can
prove that their VM machine is running in confidential mode on genuine
Intel hardware, as opposed to in a faked "blue pill" environment. All
currently shipping Intel CPUs which support TDX build attestation on
top of SGX with OSS enclave code (the '''tdqe''' enclave), as opposed
to embedding attestation in proprietary firmware which is the approach
taken by other vendors for confidential computing. NB, the '''tdqe'''
enclave and '''qgs''' daemon will be included in this proposal, but
will remain unused until this followup TDX support is integrated with
Fedora.
It is well known that SGX technology can be applied is to build DRM
systems which allow 3rd party organizations to control what users do
with their machines. This proposal '''MUST NOT''' be interpreted as
endorsing such use cases. Such DRM systems would almost certainly rely
on close source enclaves signed exclusively by a 3rd party org, and
could not be considered hardware enablement firmware. As such they
would not be eligible for inclusion in Fedora.
== Scope ==
=== Proposal owners===
The proposal owners will be introducing a number of new packages to
Fedora. Initially, no existing packages are likely to gain
dependencies on the new SGX packages. At a future date when TDX is
integrated into Fedora, one or more of the libvirt/qemu sub-RPMs may
gain a dependency on certain SGX packages needed to support TDX.
The important new packages will be
* '''sgx-srpm-macros''': this will produce a binary RPM of the same
name, containing RPM macros that define the directory locations for
SGX enclaves under '''/usr/x86_64-intel-sgx'''. These macros will be
consumed by other RPMs that deal with enclave pacakging
* '''linux-sgx''': this provides the full SGX software stack,
including the enclave development libraries and headers, host OS
development libraries and headers, supporting host OS build tools, and
various host OS runtime daemons/binaries. This package will include
'''unsigned''' builds of the architectural enclaves built using the
standard Fedora toolchain. Users could choose to sign these with their
own keys and deploy them, with the caveat noted earlier wrt the
'''pce''' enclave in particular. This package will result in creation
of many binary sub-RPMs for distinct components.
* '''linux-sgx-enclaves-prebuilt''': this provides solely the
pre-built, signed architectural enclaves. While they could be provided
as part of the '''linux-sgx''' package, it is split off to make it
simpler to update the architectural enclave independently of the main
software stack. This ability will be important if needing to ship a
new release of SGX enclaves for a security fix in stable Fedora
branches, without being forced to introduce updates of the host OS
software stack that may have inappropriate changes for pushing into an
existing stable branch.
==== Optional extra: reproducible builds ====
The SGX pre-built, signed architectural enclaves are built from code
entirely under Fedora approved OSS licenses and support a reproducible
build process. The upstream implementation of this process involves an
Ubuntu dockerfile that populates a NixOS build environment. With some
skilled work, it is possible to replicate an equivalent build
environment in the context of Fedora. It requires providing custom
builds of GCC, binutils, nasm, glibc (headers only) and kernel (uapi
headers only) at specific release versions, with specific build
configuration options and certain patches. Given such packages in
Fedora, it is then possible to perform a reproducible build that
successfully validates as matching the code payload of the pre-built,
signed architectural enclaves.
Maintaining such a reproducible build process in Fedora would have a
non-negligible maintenance overhead if done on an ongoing basis.
Originally it was thought that a reproducible build could be performed
in the same package that provides the pre-built enclave binaries, as a
way to block shipping of the pre-built binaries, unless proved to
match the source.
Given the requirements for specific toolchain versions, however, this
would impose considerable delays when shipping CVE updates in stable
Fedora branches. eg a newly issued pre-built enclave binary containing
a CVE fix, may imply use of newer GCC, binutils, nasm versions than
are currently available in the Fedora stable release. It is highly
undesirable to go through the new package process to add new
toolschain versions to stable Fedora, as a pre-requisite to ship CVE
fixes in a stable branch, even if the new package process were
expedited to avoid full re-review.
If a reproducible build were to be mandated, it would involve the
following additional packages in Fedora:
* '''sgx-compat-gccXXXX''' - one (or more) GCC builds at specified
designated versions required by the reproducible build
* '''sgx-compat-binutilsXXXX''' - one (or more) binutils builds at
specified designated versions required by the reproducible build
* '''sgx-compat-nasmXXXX''' - one NASM build at specified designated
versions required by the reproducible build
* '''sgx-compat-glibc-headersXXXX''' - one glibc build at specified
designated versions required by the reproducible build. Note only the
header files are required, no library build.
* '''sgx-compat-kernel-headersXXXX''' - one kernel build at specified
designated versions required by the reproducible build. Note only the
uapi header files are required, no vmlinux build
* '''sgx-enclaves-reproducibleXXX''' - one (or more) reproducible
builds of SGX architectural enclaves
Note, the need for multiple versions of GCC & binutils in the
reproducible build is an
[https://github.com/intel/linux-sgx/issues/1045 upstream build
environment bug].
Note, the need for glibc & header headers is also a likely
[https://github.com/intel/linux-sgx/pull/1062 upstream build
environment bug].
Note, the need for multiple '''sgx-enclaves-reproducibleXXX'''
versions in parallel is because not all enclaves re-issued on each
release. Only enclaves which have CVE fixes or functional changes get
re-issued as new pre-built, signed binaries. IOW to validate all
binary enclaves potentially requires doing reproducible builds of
multiple SGX releases.
=== Other developers===
Maintainers of the '''fedora-release''' package will need to review a
merge request that proposes new systemd unit file presets. See later
in this document for the details of units.
===Release engineering===
N/A - does not impact deliverables for releng
===Policies and guidelines===
Agreement is needed around the designation of the pre-built, signed
SGX architectural enclaves as firmware. Note, "'''architectural
enclaves'''" are being considered distinct from "'''application
enclaves'''" - the latter should be expected to build from source in
the normal manner & be signed by Fedora, if any such enclaves are ever
added to Fedora.
==== Architectural enclaves as firmware ====
Normal Fedora practice requires building everything from source. There
is a general exception to this for firmware blobs, which don't need to
be built from source and don't need to be under an OSS compliant
license as long as the binaries can be freely distributed. Hardware
firmware binaries almost always include a digital signature from the
vendor, to ensure that only trusted firmware is loaded onto the
device. Thus even if source code is available for a given firmware
binary, Fedora would still need to be shipping it as a pre-built
vendor supplied signed binary, in order to pass the cryptographic
verification checks typically performed by hardware when loading
firmware.
Another example of shipping pre-built vendor binaries would be CPU
microcode. This could be considered firmware for the core CPU, and
again are vendor supplied, signed binaries, with no source code
available.
The architectural enclaves satisfy the classical role of firmware, in
the context of the SGX technology, providing enablement for
application usage. Unusually for firmware they are made available with
100% of their code under Fedora approved OSS licenses. The
architectural enclaves, however, are still consumed as pre-built
signed binaries due to the need to establish a chain of trust rooted
back to Intel as the CPU hardware vendor.
'''Overall''', the architectural enclaves meet the definition of
firmware documented in the
[https://docs.fedoraproject.org/en-US/legal/license-approval/#_technical_fir…
Fedora licensing guidelines]:
# ''The files must be non-executable within the Fedora Linux context
(note: this means that the files cannot run on their own, not that
they are just chmod -x).'' ✅ enclave ELF binarjies must be loaded into
memory using the specialized SGX loader.
# ''The files must not be libraries, within the Fedora Linux
context.'' ✅ enclave ELF binaries must be loaded into memory using as
specialized SGX loader, the glibc ELF loader can not be used for this.
# ''The files must be standalone, not embedded in executable or
library code (within the Fedora Linux context).'' ✅ enclave binaries
are always standalone, self-contained files. They are consumed by
regular host software, but cannot be linked to Fedora platform
binaries/libraries.
# ''The files must be necessary for the functionality of open source
code being included in Fedora Linux or to enable Fedora Linux to boot
on a specific device, where no other reliable and supported mechanisms
exist.'' ✅ the pre-built, signed '''architectural enclaves''' shipped
by Intel, serve to bootstrap the use of SGX technology by
applications. ❌ as higher level software services, other
'''application enclaves''' would not qualify.
Thus it should be permissible to ship the pre-built, signed
'''architectural enclaves''' binaries with no policy changes.
Conversely '''application enclaves''' should NOT be considered
firmware, and thus be required to follow the full Fedora packaging
guidelines. No '''application enclaves''' are anticipated for
inclusion in Fedora with this change proposal.
==== Reproducible build validation policy ====
Even if the view of '''architectural enclaves''' as firmware were to
be rejected, there is an alternative precedent that can justify
inclusion of the pre-built signed enclaves in Fedora.
In this case we consider the '''shim''' package, where Fedora builds a
binary from known good source, possibly with local patches, and sends
it off for signing by Microsoft, packaging the binary that is sent
back into an RPM. Microsoft has various requirements before it will
permit signing a vendor's shim.
Consider if the requirements on shim signing were tightened a little
more to require a designated toolchain version, such that all shim
builds became 100% reproducible on any platform. There would be no
need to send the binary to Microsoft for signing, as any binary built
in Fedora would inherently match a standard pre-published signed
binary from that shim release + toolchain. It would be impossible to
distinguish Microsoft signing & returning Fedora's reproducible build,
from Microsoft sending back their original pre-signed build.
This is effectively the situation SGX architectural enclaves are in.
None the less, there are some differences between the shim & SGX scenarios.
The first is that today Fedora has the ability to add arbitrary local
patches to shim & build with arbitrary toolchain versions, which would
be in conflict with a hypothetical requirement for reproducible builds
& fixed toolchain.
The second is that on most (but not all) hardware, users can enroll
personal certificates in the firmware to allow it to trust a shim
binary signed by the user, rather than Microsoft. In the case of SGX
enclaves, it is strictly possible from a technical POV for a user to
build & load & run their own self-signed SGX architectural enclaves.
From a practical POV, however, it is inescapable for the '''pce'''
enclave to have an Intel signature. Without that signature, no
certificate proving authenticity of the hardware can be obtained from
Intel, which would thus undermine the goal of SGX technology. The
certificate is the mechanism for the Fedora user to prove to
themselves that their platform contains genuine Intel CPUs. The other
enclaves do have ways to be used with user supplied signatures,
provided the consuming applications allow sufficient flexibility in
their verification mechanisms. From a practical POV, all usage will be
expecting Intel signatures again because these signatures are a means
for users to establish trust in their hardware platform, but users do
have the freedom to diverge if needed.
===Trademark approval===
N/A
===Alignment with the Fedora Strategy===
This aligns with
* '''"Reaching the world"'''. Including SGX will make the Fedora
support for hosting Intel TDX confidential virtual machines feature
complete, by enabling attestation by the guest owner
* '''"Innovation & leadership in technology"'''. SGX is a general
purpose infrastructure technology which enables application developers
to build systems to securely run sensitive workloads. Confidential
virtual machines are expected to become a standard part of the public
cloud in the coming years, as well as make inroads into private clouds
in large organizations. As noted earlier, SGX unlocks the ability to
ship TDX confidential VM technology in future Fedora.
== Upgrade/compatibility impact ==
This is a new package set which should not have any upgrade impact, as
it will not initially be a dependency of other software. In future it
may be pulled in automatically as a dependency in certain KVM
deployment scenarios. Even when installed, using anything related to
SGX first requires host firmware changes to enable use of the
technology. The systemd services provided have their unit files
conditionalized on the existence of '''/dev/sgx_enclave''' device
nodes.
== Early Testing (Optional) ==
Do you require 'QA Blueprint' support? N
The proposed new packages are available for testing via Copr, until
such time as they are reviewed & built in Fedora koji:
* https://copr.fedorainfracloud.org/coprs/berrange/sgx-ng/
These should work on any Intel Xeon class platform which has a
suitable HW configuration. NB there may be specific DIMM population
requirements.
== How To Test ==
* [https://fedoraproject.org/wiki/Virt/SGX Documentation on host
setup] is available but that's a fairly minimalist test. It does not
do much that's interesting to an end user, but is at least proving
that the '''pce''' and '''ide''' enclaves are usable. This is the
limit of the anticipated testing of SGX in Fedora. More extensive
testing will be performed when TDX is integrated at a later date,
though some of this may be performed early on an adhoc basis using
development snapshots of TDX.
== User Experience ==
Initially the will be minimal real world user experience impact, since
on its own this proposal doesn't deliver noticeable end user features.
No existing applications in Fedora are known to have support for SGX
and none are being proposed yet.
The conceptual user benefit will be that users can bootstrap trust in
SGX on their Fedora host. This will facilitate users in deploying 3rd
party applications of their choosing that utilize SGX. It will
facilitate testing by engineers working on TDX support and its
integration into Fedora.
At a later time, when support for Intel TDX is integrated into KVM and
QEMU, the real world Fedora user benefit will significantly expand.
== Dependencies ==
The primary functional dependency for use of SGX is kernel support,
which has been enabled in Fedora for some time. See
"'''CONFIG_X86_SGX=y'''" in the kconfig files.
The packages include some new systemd unit files, two of which should
be configured to be started by default. This will require changes to
the systemd presets in the 'fedora-release' package.
* '''mpa_registration.service''' - this is conditionalized on SGX
being enabled, as witnessed by existence of '''/dev/sgx_eclave.'''
Thus enabling it by default will be a no-op on any existing machines
which have not had SGX turned on in the firmware. It is expected to be
installed on all SGX installations
* '''qgs.socket''' (as a trigger for '''qgs.service''') - this is
likewise conditionalized on SGX being enabled. This will may be pulled
in as a dependency of either libvirt or QEMU RPMs, TBD in the future
TDX change proposal.
== Contingency Plan ==
* Contingency mechanism: The new packages have no ill effects on
existing Fedora usage. Any outstanding work can be postponed to a
later release if required.
* Contingency deadline: Beta freeze
* Blocks release? No
== Documentation ==
[https://fedoraproject.org/wiki/Virt/SGX Documentation on host setup]
is available which is pretty much all that this change is expected to
enable.
A change proposal in future Fedora will cover usage of SGX with TDX
confidential virtual machines, which is more interesting to end users.
== Release Notes ==
--
Aoife Moloney
Fedora Operations Architect
Fedora Project
Matrix: @amoloney:fedora.im
IRC: amoloney