enhance: enable OpenSSL FIPS mode for Milvus by XuanYang-cn · Pull Request #48332 · milvus-io/milvus

XuanYang-cn · 2026-03-18T07:09:13Z

Layer 2 (OpenSSL FIPS) changes:

Add programmatic FIPS activation via OSSL_LIB_CTX_load_config in boring_enabled.go (gated by //go:build boringcrypto)
Add openssl-fips.cnf with fips + default providers and default_properties = fips=yes
Use absolute .include path for fipsmodule.cnf — OpenSSL resolves relative .include from the process working directory, not the config file's directory, causing silent FIPS provider load failure
Add RAND_bytes probe after config load to verify the FIPS provider is truly functional (EVP_default_properties_is_fips_enabled only checks the property string, not whether the provider loaded)
Dockerfiles: add openssl fipsinstall + OPENSSL_MODULES env var
Log OpenSSL FIPS status from C++ via EVP_default_properties_is_fips_enabled

Layer 1 (Go BoringCrypto) changes:

Add GOEXPERIMENT=boringcrypto build flag (conditional on MILVUS_FIPS_ENABLED=ON)
Add boringEnabled() build-tagged functions for startup logging

s2n-tls upgrade:

Override s2n 1.4.1 (from aws-c-io) to 1.6.0 in conanfile.py. s2n 1.4.1 only detects FIPS via the legacy OPENSSL_FIPS define (not set by OpenSSL 3.x). s2n 1.6.0 adds EVP_default_properties_is_fips_enabled() detection so s2n enters FIPS mode and uses RAND_bytes() through the FIPS provider.

Codecov Report

❌ Patch coverage is 23.96694% with 92 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.10%. Comparing base (c0dfe97) to head (2e22ceb).
⚠️ Report is 4 commits behind head on 2.6.

Files with missing lines	Patch %	Lines
internal/core/src/storage/MinioChunkManager.h	0.00%	26 Missing ⚠️
internal/core/src/storage/MinioChunkManager.cpp	0.00%	25 Missing ⚠️
internal/storagev2/packed/ffi_common.go	0.00%	11 Missing ⚠️
internal/core/src/storage/ChunkManager.cpp	0.00%	10 Missing ⚠️
internal/core/src/common/init_c.cpp	0.00%	5 Missing ⚠️
internal/core/src/storage/loon_ffi/util.cpp	0.00%	5 Missing ⚠️
internal/core/src/clustering/analyze_c.cpp	0.00%	2 Missing ⚠️
internal/core/src/segcore/packed_writer_c.cpp	0.00%	2 Missing ⚠️
internal/core/src/segcore/arrow_fs_c.cpp	0.00%	1 Missing ⚠️
internal/core/src/segcore/packed_reader_c.cpp	0.00%	1 Missing ⚠️
... and 4 more

Additional details and impacted files

@@            Coverage Diff             @@
##              2.6   #48332      +/-   ##
==========================================
+ Coverage   74.73%   77.10%   +2.36%     
==========================================
  Files        1417     1959     +542     
  Lines      222520   308423   +85903     
==========================================
+ Hits       166307   237808   +71501     
- Misses      48665    63058   +14393     
- Partials     7548     7557       +9

Components	Coverage Δ
Client	`78.49% <ø> (ø)`
Core	`83.31% <8.13%> (∅)`
Go	`75.70% <62.85%> (-0.04%)`	⬇️

Files with missing lines	Coverage Δ
internal/compaction/params.go	`94.64% <100.00%> (+0.09%)`	⬆️
internal/core/src/indexbuilder/index_c.cpp	`53.52% <100.00%> (ø)`
internal/core/src/storage/StorageV2FSCache.cpp	`70.31% <100.00%> (ø)`
internal/core/src/storage/StorageV2FSCache.h	`100.00% <100.00%> (ø)`
internal/core/src/storage/storage_c.cpp	`39.84% <100.00%> (ø)`
internal/datacoord/util.go	`83.39% <100.00%> (+0.06%)`	⬆️
internal/datanode/index/init_segcore.go	`88.46% <100.00%> (+0.46%)`	⬆️
internal/datanode/index/task_analyze.go	`80.68% <100.00%> (+0.13%)`	⬆️
internal/datanode/index/task_index.go	`78.04% <100.00%> (+0.07%)`	⬆️
internal/storagev2/packed/packed_reader.go	`74.78% <100.00%> (+0.21%)`	⬆️
... and 19 more

... and 567 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

zhikunyao · 2026-03-18T09:09:14Z

/ci-rerun-buildenv

sre-ci-robot · 2026-03-18T09:14:38Z

Build Env Images Ready

New builder images have been built and pushed to Harbor.

Image tag: 20260318-e2fa8ed

Type	OS	Harbor Image
CPU	ubuntu22.04	`harbor-us-vdc.zilliz.cc/milvusdb/milvus-env:ubuntu22.04-20260318-e2fa8ed`
CPU	amazonlinux2023	`harbor-us-vdc.zilliz.cc/milvusdb/milvus-env:amazonlinux2023-20260318-e2fa8ed`

Next Steps

To use these new builder images for CI, update the .env file in this PR:

# Update CPU builder tag
sed -i 's/^DATE_VERSION=.*/DATE_VERSION=20260318-e2fa8ed/' .env
sed -i 's/^LATEST_DATE_VERSION=.*/LATEST_DATE_VERSION=20260318-e2fa8ed/' .env

Then commit and push to trigger CI with the new builder images.

Build: #14

sre-ci-robot · 2026-03-18T09:16:29Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

mergify · 2026-03-19T09:27:35Z

@XuanYang-cn Thanks for your contribution. Please submit with DCO, see the contributing guide https://github.com/milvus-io/milvus/blob/master/CONTRIBUTING.md#developer-certificate-of-origin-dco.

sre-ci-robot · 2026-03-19T09:27:57Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

sre-ci-robot · 2026-03-19T09:30:18Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

sre-ci-robot · 2026-03-19T11:56:17Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

sre-ci-robot · 2026-03-20T06:47:38Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

mergify · 2026-03-20T08:47:57Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

sre-ci-robot · 2026-03-20T11:07:46Z

[INFO] PR Label Summary by Default
[FAILED] PR #48331 not merged

Title: enhance: enable OpenSSL FIPS mode for Milvus
Status: OPEN
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

mergify · 2026-03-20T12:00:42Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

XuanYang-cn · 2026-03-23T02:21:10Z

rerun go-sdk

mergify · 2026-03-23T04:22:17Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

XuanYang-cn · 2026-03-23T06:09:35Z

rerun go-sdk

mergify · 2026-03-23T08:11:00Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

XuanYang-cn · 2026-03-23T09:16:20Z

rerun go-sdk

mergify · 2026-03-23T10:01:09Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

Layer 2 (OpenSSL FIPS) changes: - Add programmatic FIPS activation via OSSL_LIB_CTX_load_config in boring_enabled.go (gated by //go:build boringcrypto) - Add openssl-fips.cnf with fips + default providers and default_properties = fips=yes - Dockerfiles: add openssl fipsinstall + OPENSSL_MODULES env var - Log OpenSSL FIPS status from C++ via EVP_default_properties_is_fips_enabled Layer 1 (Go BoringCrypto) changes: - Add GOEXPERIMENT=boringcrypto build flag (conditional on MILVUS_FIPS_ENABLED=ON) - Add boringEnabled() build-tagged functions for startup logging s2n-tls upgrade: - Override s2n 1.4.1 (from aws-c-io) to 1.6.0 in conanfile.py. s2n 1.4.1 only detects FIPS via the legacy OPENSSL_FIPS define (not set by OpenSSL 3.x). s2n 1.6.0 adds EVP_default_properties_is_fips_enabled() detection so s2n enters FIPS mode and uses RAND_bytes() through the FIPS provider. enhance: add CRC32C checksum and TLS support for object storage (#9) Add CRC32C checksum validation for MinIO/S3 PutObject requests and enhance TLS configuration for object storage connections. See also: milvus-io#48202, milvus-io#48301 pr: milvus-io#48331 Signed-off-by: jiaqizho <jiaqi.zhou@zilliz.com> Signed-off-by: yangxuan <xuan.yang@zilliz.com>

Signed-off-by: yangxuan <xuan.yang@zilliz.com>

sre-ci-robot · 2026-03-24T02:24:38Z

[INFO] PR Label Summary by Default
[SUCCESS] PR #48331 merged to master

Title: enhance: enable OpenSSL FIPS mode for Milvus
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

mergify · 2026-03-24T03:22:11Z

@XuanYang-cn go-sdk check failed, comment rerun go-sdk can trigger the job again.

tedxu · 2026-03-24T11:37:49Z

/lgtm
/approve

sre-ci-robot · 2026-03-24T11:38:00Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tedxu, XuanYang-cn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [tedxu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sre-ci-robot · 2026-03-24T11:38:38Z

[INFO] PR Label Summary by Default
[SUCCESS] PR #48331 merged to master

Title: enhance: enable OpenSSL FIPS mode for Milvus
Link: enhance: enable OpenSSL FIPS mode for Milvus #48331

Use /refresh-label to update related check and label manually

sre-ci-robot requested review from bigsheeper and cydrain March 18, 2026 07:09

sre-ci-robot added area/compilation size/L Denotes a PR that changes 100-499 lines. labels Mar 18, 2026

mergify bot added dco-passed DCO check passed. kind/enhancement Issues or changes related to enhancement labels Mar 18, 2026

sre-ci-robot added do-not-merge/need-merge-master-first any pr merge to release branch need to merge master first do-not-merge/need-milestone generate by v2-label-manager labels Mar 18, 2026

XuanYang-cn added this to the 2.6.13 milestone Mar 18, 2026

sre-ci-robot removed the do-not-merge/need-milestone generate by v2-label-manager label Mar 18, 2026

sre-ci-robot added the low-code-coverage add test-label from zhikun, diff coverage > 80% label Mar 18, 2026

mergify bot added the ci-passed label Mar 18, 2026

XuanYang-cn force-pushed the fips26 branch from aa2bdb2 to 7a9bf25 Compare March 19, 2026 09:26

sre-ci-robot added the area/internal-api label Mar 19, 2026

mergify bot added needs-dco DCO is missing in this pull request. and removed dco-passed DCO check passed. labels Mar 19, 2026

sre-ci-robot removed the ci-passed label Mar 19, 2026

XuanYang-cn force-pushed the fips26 branch from 1c8e04f to f3c04e3 Compare March 19, 2026 11:55

XuanYang-cn force-pushed the fips26 branch from f3c04e3 to fe57633 Compare March 19, 2026 11:57

mergify bot added the dco-passed DCO check passed. label Mar 19, 2026

sre-ci-robot removed the low-code-coverage add test-label from zhikun, diff coverage > 80% label Mar 20, 2026

mergify bot added the ci-passed label Mar 20, 2026

XuanYang-cn added 3 commits March 24, 2026 10:23

fix coding style

2305218

Signed-off-by: yangxuan <xuan.yang@zilliz.com>

fix coding style

2e22ceb

Signed-off-by: yangxuan <xuan.yang@zilliz.com>

XuanYang-cn force-pushed the fips26 branch from ff075f3 to 2e22ceb Compare March 24, 2026 02:23

sre-ci-robot removed the do-not-merge/need-merge-master-first any pr merge to release branch need to merge master first label Mar 24, 2026

sre-ci-robot removed the ci-passed label Mar 24, 2026

sre-ci-robot added the low-code-coverage add test-label from zhikun, diff coverage > 80% label Mar 24, 2026

mergify bot added the ci-passed label Mar 24, 2026

sre-ci-robot assigned tedxu Mar 24, 2026

sre-ci-robot added the lgtm label Mar 24, 2026

sre-ci-robot added the approved label Mar 24, 2026

sre-ci-robot merged commit 5e6ae26 into milvus-io:2.6 Mar 24, 2026
17 of 22 checks passed

XuanYang-cn deleted the fips26 branch March 24, 2026 11:58

Conversation

XuanYang-cn commented Mar 18, 2026

Uh oh!

sre-ci-robot commented Mar 18, 2026

Uh oh!

sre-ci-robot commented Mar 18, 2026

Uh oh!

codecov bot commented Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

zhikunyao commented Mar 18, 2026

Uh oh!

sre-ci-robot commented Mar 18, 2026

Build Env Images Ready

Next Steps

Uh oh!

sre-ci-robot commented Mar 18, 2026

Uh oh!

mergify bot commented Mar 19, 2026

Uh oh!

sre-ci-robot commented Mar 19, 2026

Uh oh!

sre-ci-robot commented Mar 19, 2026

Uh oh!

sre-ci-robot commented Mar 19, 2026

Uh oh!

sre-ci-robot commented Mar 20, 2026

Uh oh!

mergify bot commented Mar 20, 2026

Uh oh!

sre-ci-robot commented Mar 20, 2026

Uh oh!

mergify bot commented Mar 20, 2026

Uh oh!

XuanYang-cn commented Mar 23, 2026

Uh oh!

mergify bot commented Mar 23, 2026

Uh oh!

XuanYang-cn commented Mar 23, 2026

Uh oh!

mergify bot commented Mar 23, 2026

Uh oh!

XuanYang-cn commented Mar 23, 2026

Uh oh!

mergify bot commented Mar 23, 2026

Uh oh!

sre-ci-robot commented Mar 24, 2026

Uh oh!

mergify bot commented Mar 24, 2026

Uh oh!

tedxu commented Mar 24, 2026

Uh oh!

sre-ci-robot commented Mar 24, 2026

Uh oh!

sre-ci-robot commented Mar 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Mar 18, 2026 •

edited

Loading