Ubuntu noble - FIPS

[stackunderfl0w]

Update package lists and kernel versions to match release Ubuntu Noble Fips images.
The current specs hardcode the packages and kernel verions used by Jammy Fips, including the now entirely removed libgcrypt20-hmac.

Current config has been tested to build working Noble FIPS images, though full BOSH deployments currently require pending, out-of-tree changes to credhub-release and uaa-release. Their pre-start keystore generation is incompatible with the stricter PKCS#12 requirements enforced by OpenSSL 3.0’s FIPS provider.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: stackunderfl0w / name: Patrick Robert Iacob (1ed694c, 62294ce, be65647)

[coderabbitai]

Important

Approval pending

CodeRabbit has no unresolved comments, but it has not reviewed the latest commit.

Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.

• 🔍 Trigger review

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the Ubuntu Noble FIPS migration. It is concise and directly related to the package and kernel updates.
Description check	✅ Passed	The description explains the package and kernel updates, identifies the obsolete package, and records build testing and deployment limitations. It provides sufficient context for review.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[neddp]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@stemcell_builder/lib/prelude_apply.bash`:
- Around line 62-64: Update the condition in the FIPS rewrite block to extract
and numerically compare the kernel’s major component against 6, rather than
comparing dotted version strings lexically. Preserve the existing rewrite
behavior only for FIPS kernels with a numeric major version below 6.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c463db26-48c1-4972-a4a2-9432c8701aba

📥 Commits

Reviewing files that changed from the base of the PR and between 480058d and 1ed694c.

📒 Files selected for processing (6)

• bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt
• bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt
• bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
• stemcell_builder/lib/prelude_apply.bash
• stemcell_builder/stages/base_fips_apt/apply.sh
• stemcell_builder/stages/static_libraries_config/apply.sh

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[aramprice]

@stackunderfl0w - as a first pass we ask that folks address (either by making changes or dismissing) the AI comments.

Based on your comments above it sounds like coderabbit's suggestion is probably fine to dismiss - as long as we don't end up with a kernel major version 10 on ubuntu-noble (?).

It may be worthwhile though as any changes to ubuntu-noble will be merged forward to ubuntu-resolute (and whatever is next) so having code that is safe when the kernel hits v10 might save someone heartache in the future.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

stemcell_builder/lib/prelude_apply.bash:65

• The path migration is documented as occurring at kernel 6.5, but this comparison only checks the major component. A FIPS kernel in the 6.0–6.4 range would therefore retain the new objtool/libsubcmd/libsubcmd.a path even though it still needs the old path, leaving a nonexistent entry in static_libraries_list. Compare both major and minor components against 6.5.

  if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then

[aramprice]

I added - FIPS to the title for clarity. Feel free to remove it this doesn't seem correct.