[
https://issues.apache.org/jira/browse/IMPALA-14932?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18077748#comment-18077748
]
ASF subversion and git services commented on IMPALA-14932:
----------------------------------------------------------
Commit 5239fcf427b9570c3491889f2b69c59d50001592 in impala's branch
refs/heads/master from yida.wu
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=5239fcf42 ]
IMPALA-14932: Disable AI functions in FIPS mode
Impala AI functions ai_generate_text and ai_generate_text_default
rely on JCEKS for credential or simply plain, which are not
FIPS-approved.
Add a check to return a clear error to disable these functions in
FIPS mode.
Tests:
Ran exhaustive tests.
Manually test in a FIPS cluster and return the error as expected.
Change-Id: I8d217fb0a7320a131f09abf00cc272961c5696b2
Reviewed-on: http://gerrit.cloudera.org:8080/24244
Tested-by: Impala Public Jenkins <[email protected]>
Reviewed-by: Yida Wu <[email protected]>
> Disable ai_generate_text in FIPS mode
> -------------------------------------
>
> Key: IMPALA-14932
> URL: https://issues.apache.org/jira/browse/IMPALA-14932
> Project: IMPALA
> Issue Type: Improvement
> Components: Backend
> Reporter: Yida Wu
> Assignee: Yida Wu
> Priority: Major
> Fix For: Impala 5.0.0
>
>
> Impala AI functions ai_generate_text, ai_generate_text_default rely on JCEKS
> for credential storage. These functions support two credential types, JCEKS
> and plain. However, JCEKS uses non-FIPS-approved algorithms, and
> credential_type="plain" is also not FIPS-compliant. Therefore, these
> functions should be better to disable in FIPS mode for now. Support for
> FIPS-compliant keystores for credential (e.g., BCFKS) may be explored in the
> future.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
