From 62294ce915a0ed5e89ff13b1ad5c855899dc5855 Mon Sep 17 00:00:00 2001 From: Patrick Robert Iacob Date: Thu, 9 Jul 2026 20:22:01 -0700 Subject: [PATCH 1/3] fix: Remove libgcrypt20-hmac from FIPS_PKGS The noble fips-updates pocket does not ship libgcrypt20-hmac. --- stemcell_builder/stages/base_fips_apt/apply.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stemcell_builder/stages/base_fips_apt/apply.sh b/stemcell_builder/stages/base_fips_apt/apply.sh index 8abe4c8f37..0b91fc4de9 100755 --- a/stemcell_builder/stages/base_fips_apt/apply.sh +++ b/stemcell_builder/stages/base_fips_apt/apply.sh @@ -11,7 +11,7 @@ source $base_dir/lib/prelude_bosh.bash mount --bind /sys "$chroot/sys" add_on_exit "umount $chroot/sys" -FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-hmac libgcrypt20-dev" +FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-dev" mock_grub_probe ua_attach From be6564729de496a735a36844b54548044d97b935 Mon Sep 17 00:00:00 2001 From: Patrick Robert Iacob Date: Thu, 9 Jul 2026 20:22:10 -0700 Subject: [PATCH 2/3] fix: FIPS kernel version for noble Noble FIPS uses kernel 6.8, not 5.15. The hardcoded major_kernel_version caused the find for linux-headers-5.15.*-fips to return nothing and fail the build. Also guard the objtool path rewrite so it only applies to pre-6.0 kernels, since noble FIPS (6.8) uses the new objtool/libsubcmd path. --- stemcell_builder/lib/prelude_apply.bash | 5 ++--- stemcell_builder/stages/static_libraries_config/apply.sh | 2 +- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/stemcell_builder/lib/prelude_apply.bash b/stemcell_builder/lib/prelude_apply.bash index a3d6c33381..21d4970e6d 100644 --- a/stemcell_builder/lib/prelude_apply.bash +++ b/stemcell_builder/lib/prelude_apply.bash @@ -59,9 +59,8 @@ function update_kernel_static_libraries { sed -i "s/__KERNEL_VERSION__/$kernel_version/g" $chroot/var/vcap/bosh/etc/static_libraries_list # since kernel 6.5 the objtool/libsubcmd.a has been moved to objtool/libsubcmd/libsubcmd.a - # fips still uses the 5.9 kernel, so we need to rewrite the static_libraries_list file to the old path - # TODO: puting a todo tag here as this could probably be removed in the future if the kernel version gets bumped - if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then + # older fips kernels (5.x) used the old path, so rewrite only for those + if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && [[ "${major_kernel_version}" < "6.0" ]]; then sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list fi } diff --git a/stemcell_builder/stages/static_libraries_config/apply.sh b/stemcell_builder/stages/static_libraries_config/apply.sh index a7ce78e70b..0d3dd4ec75 100755 --- a/stemcell_builder/stages/static_libraries_config/apply.sh +++ b/stemcell_builder/stages/static_libraries_config/apply.sh @@ -16,7 +16,7 @@ if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then # TODO use iaas specific kernel # kernel_suffix="-${stemcell_infrastructure}-fips" kernel_suffix="-fips" - major_kernel_version="5.15" + major_kernel_version="6.8" fi update_kernel_static_libraries ${kernel_suffix} ${major_kernel_version} From 1ed694c17f39087ddef3d6baf0bd3c4b7adc09ea Mon Sep 17 00:00:00 2001 From: Patrick Robert Iacob Date: Thu, 9 Jul 2026 20:22:20 -0700 Subject: [PATCH 3/3] fix: Update FIPS spec package lists for noble Update dpkg-list-ubuntu-aws-fips.txt and dpkg-list-ubuntu-fips.txt to expect 6.8 kernel packages instead of 5.15. Fix arch suffixes on libgcrypt20-dev and libgpg-error-dev in dpkg-list-ubuntu.txt to match dpkg --get-selections output on noble. --- .../spec/assets/dpkg-list-ubuntu-aws-fips.txt | 11 +++++------ bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt | 13 ++++++------- bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt | 4 ++-- 3 files changed, 13 insertions(+), 15 deletions(-) diff --git a/bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt b/bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt index f8fe056322..b9e0de216e 100644 --- a/bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt +++ b/bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt @@ -1,14 +1,13 @@ fips-initramfs kcapi-tools -libgcrypt20-hmac:amd64 libkcapi1:amd64 linux-aws-fips -linux-aws-fips-headers-5.15 -linux-headers-5.15-aws-fips +linux-aws-fips-headers-6.8 +linux-headers-6.8-aws-fips linux-headers-aws-fips -linux-image-5.15-aws-fips +linux-image-6.8-aws-fips linux-image-aws-fips -linux-image-hmac-5.15-aws-fips -linux-modules-5.15-aws-fips +linux-image-hmac-6.8-aws-fips +linux-modules-6.8-aws-fips microcode-initrd openssl-fips-module-3:amd64 diff --git a/bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt b/bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt index 09bc7e2249..b0b5f4a454 100644 --- a/bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt +++ b/bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt @@ -1,14 +1,13 @@ fips-initramfs kcapi-tools -libgcrypt20-hmac:amd64 libkcapi1:amd64 linux-fips -linux-fips-headers-5.15 -linux-headers-5.15-fips +linux-fips-headers-6.8 +linux-headers-6.8-fips linux-headers-fips -linux-image-5.15-fips +linux-image-6.8-fips linux-image-fips -linux-image-hmac-5.15-fips -linux-modules-5.15-fips -linux-modules-extra-5.15-fips +linux-image-hmac-6.8-fips +linux-modules-6.8-fips +linux-modules-extra-6.8-fips openssl-fips-module-3:amd64 diff --git a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt index f9c3bc0e3b..79f75f7476 100644 --- a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt +++ b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt @@ -198,7 +198,7 @@ libfribidi0:amd64 libfuse3-3:amd64 libgcc-13-dev:amd64 libgcc-s1:amd64 -libgcrypt20-dev +libgcrypt20-dev:amd64 libgcrypt20:amd64 libgdbm-compat4t64:amd64 libgdbm6t64:amd64 @@ -209,7 +209,7 @@ libglib2.0-data libgmp10:amd64 libgnutls30t64:amd64 libgomp1:amd64 -libgpg-error-dev +libgpg-error-dev:amd64 libgpg-error0:amd64 libgprofng0:amd64 libgssapi-krb5-2:amd64