feat: FIPS 140-3 Compliant Docker Images - #39324

Merged

ggazzo merged 70 commits into

fips-ddp-streamer

Jul 20, 2026

Commits on Jul 20, 2026

feat: conditional fips mode
cardoso
committed
cf4e430
ci: add fips lane
cardoso
committed
851ed25
ci: build fips image in advance
cardoso
committed
4517647
ci: allow selecting test lanes to run
cardoso
committed
38625c5
fix: allow sha-1 for ws handshake
cardoso
committed
f188495
Revert "ci: allow selecting test lanes to run"
cardoso
committed
09e51bf
chore: streamline fips env vars
cardoso
committed
743e5d8
Revert "fix: allow sha-1 for ws handshake"
cardoso
committed
c7240fc
fix(fips): use js implementation for ws handshake
cardoso
committed
1fbd716
refactor: improve fips init script
cardoso
committed
8cb5bf3
ci: guard against missing creds
cardoso
committed
1d25e60
feat(presence-service): fips mode
cardoso
committed
303d199
ci: reduce duplication of fips checks
cardoso
committed
5c960d3
ci: fips docker compose overrides
cardoso
committed
841fc12
ci: specify targets
cardoso
committed
98d9d83
ci: enhance naming and streamline service matrix
cardoso
committed
5117900
fix: set fips mode on start
cardoso
committed
f6a12ac
fix: update artifact pattern
cardoso
committed
80a8947
ci: matrix generation job
cardoso
committed
c2b839e
feat(authorization-service): fips
cardoso
committed
9c7bc13
fix(ddp-streamer): remove flaky check
cardoso
committed
e777a9f
feat(queue-worker): fips
cardoso
committed
564e619
feat(account-service): fips
cardoso
committed
d15ba31
fix(ci): compose build fallback creds
cardoso
committed
77c62f4
fix(ci): retry docker buildx with backoff
cardoso
committed
34b0fe6
feat(ci): fips image pull step service readiness checks
cardoso
committed
e8d28cb
feat(omnichannel-transcript): fips
cardoso
committed
fe3235b
ci: improve readiness checks
cardoso
committed
8889049
fix(ci): update readiness check for omnichannel-transcript service
cardoso
committed
599428f
fix(ci): update image pull step to support both EE and FIPS releases
cardoso
committed
01614ba
ci: make readiness check more robust
cardoso
committed
2d6b2f2
ci: do not skip rocketchat image in fork runs
cardoso
committed
9d6aa09
fix(fips): enhance SHA-1 handling in FIPS mode for WebSocket handshake
cardoso
committed
1f59625
fix(fips): enhance SHA-1 handling in FIPS mode with error handling for unsupported methods
cardoso
committed
27d6c0d
fix(ci): remove exclusion of rocketchat-cov service from promotion process
cardoso
committed
85cfd73
fix(fips): improve SHA-1 handling in FIPS mode by storing updates for WebSocket handshake
cardoso
committed
49b24e9
chore: consistent fips checks
cardoso
committed
5368832
fix(fips): add WebSocket handshake validation for SHA-1 input in FIPS mode
cardoso
committed
f4ec697
fix(fips): prevent multiple calls to digest in SHA-1 mock implementation for WebSocket handshake
cardoso
committed
1a5623f
fix(fips): add TEMP_DOCKERHUB_FIPS_USER and TEMP_DOCKERHUB_FIPS_PASS to environment variables for DockerHub login
cardoso
committed
d04ee51
fix(ci): improve service wait logic by checking for running containers before proceeding
cardoso
committed
ae52898
fix(ci): semgrep findings
cardoso
committed
d240962
chore: reduce logs
cardoso
committed
fa38620
chore: use --force-fips
cardoso
committed
46ea026
chore: reduce diff
cardoso
committed
0d12e4a
feat(ddp-streamer): use alpine for fips
cardoso
committed
d65ca1b
fix(ci): skip publish of rocketchat-cov
cardoso
committed
d41dedd
ci: fix retry loop
cardoso
committed
b6a6d93
ci(fips): build and publish rocketchat-fips image with temporary production artifact mapping
cardoso
committed
dd8e247
ci: hash pin docker/login-action
cardoso
committed
75af699
fix(fips): remove temporary DockerHub org
cardoso
committed
cb34817
feat: use fips base image for rocketchat service
cardoso
committed
9cf662b
feat: force fips in monolith
cardoso
committed
20514b3
feat: show fips mode in logs
cardoso
committed
35fc40b
feat: show fips mode in statistics
cardoso
committed
5a92423
chore(deps): update fips base images for node 22.22.3
cardoso
committed
1bd9925
fix!(fips): use sha256 instead of md5 for 2fa fingerprint
cardoso
committed
f948770
fix(fips): use sha256 for meteor method rate limiting
cardoso
committed
fcaf3a4
fix(fips): install deno in monolith image
cardoso
committed
b57b539
fix(federation-matrix): change from md5 to sha256 for ETag for FIPS compliance
cardoso
committed
952002a
chore(fips): reduce ci diff
cardoso
committed
7c6bcef
refactor(ddp-streamer/fips): remove sha1 fallback
cardoso
committed
184496d
fix(fips): use node for apps engine
cardoso
committed
6e1e197
feat(fips): add license validation
cardoso
committed
5397df0
chore: add changeset
cardoso
committed
264b2cf
chore: refactor CI matrix strategy

d-gubert
authored and
cardoso
committed
7414b09
chore: address some review comments
cardoso
committed
b0afcd9
ci: use separate prop for fips
cardoso
committed
5138ba0
chore: update changeset
cardoso
committed
7415d28
ci(fips): temporarily disable ui tests (#41477)
cardoso
committed
703adc5