-
Improvement
-
Resolution: Fixed
-
Minor
-
None
Git plugin plugin is not FIPS compliant.
It allows skipping TLS verify which should not be allowed in a FIPS 140-2 environment.
We should implement these checks when running in FIPS mode
- links to
The current code have a `doCheckUrl` method for UserRemoteConfig but there is no equivalent method for GitSCMSource while it's the equivalent class for pipeline projects. I would like to have the same FIPS control for both but I wonder about the rest of the existing control made in UserRemoteConfig$
DescriptorImpl#doCheckUrl, should we have exactly the same with a new method GitSCMSource$DescriptorImpl#doCheckRemote? Or we just limit the change to FIPS requirement?
Perso I would like to have exact same control. But do not take it as a very strong opinion