Add vote for PR 21363: fips complaince on installation

[paulidale]

Note: the security policy for the 140-3 validation will mandate the -pedantic option as part of the installation instructions.

[paulidale]

Calling a vote to accept openssl/openssl#21363 subject to the usual review process

[paulidale]

vote: +1

[slontis]

vote: +1

[beldmit]

vote: +1

I should say that enforcing EMS. significantly breaks backward compatibility and there will be gazillion of questions "why it doesn't work and how to make it work without breaking FIPS compliance"

[mspncp]

vote: +1

[mattcaswell]

vote: +1

[hlandau]

vote: +1

[paulidale]

I should say that enforcing EMS. significantly breaks backward compatibility and there will be gazillion of questions "why it doesn't work and how to make it work without breaking FIPS compliance"

Yeah, it's not ideal. I think the questions about a non-compliant installation by default will be more painful. I don't know if we'd get any but worse would be if someone noticed that we were non-compliant and instead of failing, things worked.

As for the final question, FIPS mandates that EMS be used, so it cannot work in a compliant installation.

At least it is enforced only when using the FIPS provider, so a small subset of users might be impacted.

[paulidale]

Closing vote which was accepted 6 for, 3 not voted.

[t-j-h]

Vote [+0]

[t8m]

Vote: [+1]