Ubuntu noble - FIPS

bosh-stemcell/spec/assets/dpkg-list-ubuntu-aws-fips.txt

@@ -1,14 +1,13 @@
 fips-initramfs
 kcapi-tools
-libgcrypt20-hmac:amd64
 libkcapi1:amd64
 linux-aws-fips
-linux-aws-fips-headers-5.15
-linux-headers-5.15-aws-fips
+linux-aws-fips-headers-6.8
+linux-headers-6.8-aws-fips
 linux-headers-aws-fips
-linux-image-5.15-aws-fips
+linux-image-6.8-aws-fips
 linux-image-aws-fips
-linux-image-hmac-5.15-aws-fips
-linux-modules-5.15-aws-fips
+linux-image-hmac-6.8-aws-fips
+linux-modules-6.8-aws-fips
 microcode-initrd
 openssl-fips-module-3:amd64

bosh-stemcell/spec/assets/dpkg-list-ubuntu-fips.txt

@@ -1,14 +1,13 @@
 fips-initramfs
 kcapi-tools
-libgcrypt20-hmac:amd64
 libkcapi1:amd64
 linux-fips
-linux-fips-headers-5.15
-linux-headers-5.15-fips
+linux-fips-headers-6.8
+linux-headers-6.8-fips
 linux-headers-fips
-linux-image-5.15-fips
+linux-image-6.8-fips
 linux-image-fips
-linux-image-hmac-5.15-fips
-linux-modules-5.15-fips
-linux-modules-extra-5.15-fips
+linux-image-hmac-6.8-fips
+linux-modules-6.8-fips
+linux-modules-extra-6.8-fips
 openssl-fips-module-3:amd64

bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt

@@ -198,7 +198,7 @@ libfribidi0:amd64
 libfuse3-3:amd64
 libgcc-13-dev:amd64
 libgcc-s1:amd64
-libgcrypt20-dev
+libgcrypt20-dev:amd64
 libgcrypt20:amd64
 libgdbm-compat4t64:amd64
 libgdbm6t64:amd64
@@ -209,7 +209,7 @@ libglib2.0-data
 libgmp10:amd64
 libgnutls30t64:amd64
 libgomp1:amd64
-libgpg-error-dev
+libgpg-error-dev:amd64
 libgpg-error0:amd64
 libgprofng0:amd64
 libgssapi-krb5-2:amd64

stemcell_builder/lib/prelude_apply.bash

@@ -50,6 +50,8 @@ function pkg_exists {
 function update_kernel_static_libraries {
   kernel_suffix=${1}
   major_kernel_version=${2}
+  kernel_major=${major_kernel_version%%.*}
+
 
   suffix=$kernel_suffix
   if [ ! -z "$UBUNTU_FIPS_USE_IAAS_KERNEL" ]; then
@@ -59,9 +61,8 @@ function update_kernel_static_libraries {
   sed -i "s/__KERNEL_VERSION__/$kernel_version/g" $chroot/var/vcap/bosh/etc/static_libraries_list
 
   # since kernel 6.5 the objtool/libsubcmd.a has been moved to objtool/libsubcmd/libsubcmd.a
-  # fips still uses the 5.9 kernel, so we need to rewrite the static_libraries_list file to the old path
-  # TODO: puting a todo tag here as this could probably be removed in the future if the kernel version gets bumped
-  if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then
+  # older fips kernels (5.x) used the old path, so rewrite only for those
+  if [[ "${stemcell_operating_system_variant}" == 'fips' ]] && (( kernel_major < 6 )); then
     sed -i "s|objtool/libsubcmd/libsubcmd.a|objtool/libsubcmd.a|g" $chroot/var/vcap/bosh/etc/static_libraries_list
   fi
 }

stemcell_builder/stages/base_fips_apt/apply.sh

@@ -11,7 +11,7 @@ source $base_dir/lib/prelude_bosh.bash
 mount --bind /sys "$chroot/sys"
 add_on_exit "umount $chroot/sys"
 
-FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-hmac libgcrypt20-dev"
+FIPS_PKGS="openssh-client openssh-server openssl openssl-fips-module-3 libssl3 libssl-dev libgcrypt20 libgcrypt20-dev"
 
 mock_grub_probe
 ua_attach

stemcell_builder/stages/static_libraries_config/apply.sh

@@ -16,7 +16,7 @@ if [[ "${stemcell_operating_system_variant}" == 'fips' ]]; then
     # TODO use iaas specific kernel
     # kernel_suffix="-${stemcell_infrastructure}-fips"
     kernel_suffix="-fips"
-    major_kernel_version="5.15"
+    major_kernel_version="6.8"
 fi
 
 update_kernel_static_libraries ${kernel_suffix} ${major_kernel_version}