Are SpiceDB images FIPS-140-2 compliant or has the team looked into that at all?

I don't know if it is compliant and I'm not aware if anybody in the team looked into it. I'd suggest opening an issue if it's a blocker for y'all!

K cool, thanks!

All security related cryptography in SpiceDB is using the Go standard library which is likely FIPS compliant. If it's not, it's because it chooses more modern ciphersuites to be more secure. Go has a fanatastic reputation among languages in this regard.

I read go standard lib is not FIPS compliant and I guess they may have no plans for that, but I'm definitely not an expert on it. Red Hat did some work for go distribution to hook in with FIPS 140-2 compliant openssl libs so it should be possible but in that case would require building a custom image. That said, I haven't looked into it that much yet so that's probably not the whole / correct story.

Yeah, it's been a while, but the last time I had to make a project FIPS compliant, it involved overriding the ciphersuites in the standard library to add back insecure ones that had been removed :x

Thank you, will do