Skip to content

FIPS 140-3 validated password hashing — ADR, packaging, and build pipeline - #8469

Draft
aaronlippold wants to merge 197 commits into
masterfrom
feature/fips-compliant-password-hashing
Draft

FIPS 140-3 validated password hashing — ADR, packaging, and build pipeline#8469
aaronlippold wants to merge 197 commits into
masterfrom
feature/fips-compliant-password-hashing

docs: add the distribution model to ADR-006

a8b1f1c
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / SonarCloud succeeded Jul 30, 2026 in 7s

9 new alerts including 1 high severity security vulnerability

New alerts in code changed by this pull request

Security Alerts:

  • 1 high
  • 5 medium
  • 3 low

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 201 in .github/workflows/build-rpm.yml

See this annotation in the file changed.

Code scanning / SonarCloud

External GitHub Actions and workflows should be pinned to a commit hash High

Use full commit SHA hash for this dependency. See more on SonarQube Cloud

Check warning on line 133 in packaging/rpm/scripts/setup-build-deps.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 221 in packaging/rpm/scripts/setup-build-deps.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 153 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 310 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check warning on line 312 in packaging/rpm/setup-rpm-build-env.sh

See this annotation in the file changed.

Code scanning / SonarCloud

HTTPS should be enforced on HTTP clients following redirects Medium

Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here. See more on SonarQube Cloud

Check notice on line 31 in .github/workflows/build-rpm.yml

See this annotation in the file changed.

Code scanning / SonarCloud

Read permissions should be defined at the job level Low

Move this read permission from workflow level to job level. See more on SonarQube Cloud

Check notice on line 191 in packaging/rpm/heimdall-setup.sh

See this annotation in the file changed.

Code scanning / SonarCloud

Clear-text protocols should not be used Low

Make sure that using clear-text protocols is safe here. See more on SonarQube Cloud

Check notice on line 477 in packaging/rpm/heimdall-setup.sh

See this annotation in the file changed.

Code scanning / SonarCloud

Clear-text protocols should not be used Low

Make sure that using clear-text protocols is safe here. See more on SonarQube Cloud