azurelinux/base/core Enable FIPS-140 mode

[narisu-ops]

Is your feature request related to a problem? Please describe.

To be FIPS Compliance, base image must use only approved cryptographic libraries by FIPS-140 to comply with government, financial & other customer requirements.

mcr.microsoft.com/azurelinux/base/core:3.0. Please confirm this image is FIPS enabled.

Describe the solution you'd like

OpenSSL 3 is the minimum version approved
For Mariner, use OpenSSL that comes with it. Mariner team is committed to keep the crypto FIPS certified.
Do not hardcode to OpenSSL 1.1.1.
All code must be dynamically linked to OpenSSL, statically linking code to OpenSSL is not allowed.

[narisu-ops]

checked openssl version for this image:

root [ / ]# openssl list -providers
Providers:
default
name: OpenSSL Default Provider
version: 3.3.5
status: active
symcryptprovider
name: symcryptprovider
version: 1.9.4
status: active

So I assume we should be good?

[eric-desrochers]

You'll need to deploy this container mcr.microsoft.com/azurelinux/base/core:3.0 which is FIPS capable (OpenSSL), but you'll also need to run it on a FIPS-enabled container host (kernel) to be fully FIPS.

[narisu-ops]

Thanks for confirming. @eric-desrochers, does AZL has a busybox tag which operates the same way?