Re: How can I contact the crypto team?

On 2026-06-23 1:57 AM, Alexander Sosedkin wrote:
> On Tue, Jun 23, 2026 at 12:46 AM Gordon Messmer<[email protected]> wrote:
>> I would like to add AWS s2n-tls to Fedorahttps://github.com/aws/s2n-tls
> Would you mind sharing the higher-level motivation for that?


I would like to package aws-kms-pkcs11: 
https://copr.fedorainfracloud.org/coprs/gordonmessmer/aws-kms-pkcs11/packages/

This package allows the use of AWS KMS as an HSM, which I am using to 
sign code and rpm packages.


> Alright, as you've probably already read at
> https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies,
> from the crypto-policies perspective,
> we don't want applications/libraries to force any specific algorithms
> as such hardcoded decisions go stale and haunt us decades later.
> Instead the defaults should follow a configuration file we generate.
> Offering a sane allowlisting configuration format is strongly desired,
> so that rebases bringing in new algorithms don't become unnecessarily awkward.
> I'd be happy to clarify further, but for that I'd need your questions.


I would like to revive a number of AWS libraries in Fedora, including 
s2n-tls. The s2n-tls project is considering dropping support for 
OpenSSL, and focusing on "aws-lc" which is a fork of BoringSSL.

https://github.com/aws/aws-lc

https://github.com/aws/s2n-tls/issues/5783 (OpenSSL Support Roadmap ticket)

I mentioned to them that in order to package aws-lc in Fedora, it would 
need to comply with system crypto policies, as indicated at 
https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies/

While I wait on their reply: If they were interested in supporting 
Fedora crypto policies, is there any documentation available that 
describes the required compliance? Any tests suites that validate it? 
Can we point them to the patches that implement system integration for 
any other libcrypto that we ship?

Thanks, Alexander

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new