🌱 Update TLS profiles to Mozilla guidelines v5.8 by camilamacedo86 · Pull Request #2631 · operator-framework/operator-controller

camilamacedo86 · 2026-04-07T13:21:42Z

Problem

make verify is broken. It starts to fail with

(re)installing /Users/camilam/go/bin/gojq-v0.12.17
env JQ=/Users/camilam/go/bin/gojq-v0.12.17 hack/tools/update-tls-profiles.sh
gojq: cannot iterate over: null
make: *** [update-tls-profiles] Error 5

Solution

Mozilla updated their TLS configuration guidelines to v6.0, which includes:

Removed legacy "old" profile (preserved v5.7 definition for backwards compatibility)
Changed cipher list format from "ciphers.go" to "ciphers.iana"
Added X25519MLKEM768 post-quantum hybrid curve
Fixed cipher constant names (CHACHA20_POLY1305_SHA256)

Updated update-tls-profiles.sh to handle the new JSON structure and added X25519MLKEM768 curve support to tlsprofiles package.

Why it happened?

The failure was caused by Mozilla updating their TLS guidelines from v5.7 to v6.0, which introduced breaking changes to the JSON structure.

netlify · 2026-04-07T13:21:48Z

✅ Deploy Preview for olmv1 ready!

Name	Link
🔨 Latest commit	`dbfcaeb`
🔍 Latest deploy log	https://app.netlify.com/projects/olmv1/deploys/69d515c588dee40008af9db5
😎 Deploy Preview	https://deploy-preview-2631--olmv1.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

Updates the repo’s TLS profile definitions and generator to align with Mozilla’s TLS configuration guidelines v6.0, including new curve and cipher naming updates while keeping the legacy “old” profile available for backward compatibility.

Changes:

Regenerated mozilla_data.go from Mozilla guidelines v6 and added the X25519MLKEM768 hybrid curve to modern/intermediate profiles.
Updated cipher constants for CHACHA20_POLY1305 to the SHA256-suffixed names in the intermediate profile.
Updated update-tls-profiles.sh to consume the new JSON structure (ciphers.iana) and to preserve the v5.7 “old” profile when it’s removed upstream.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
internal/shared/util/tlsprofiles/tlsprofiles.go	Adds X25519MLKEM768 curve ID aliasing and allows it in custom curve parsing.
internal/shared/util/tlsprofiles/mozilla_data.go	Regenerates TLS profile data to Mozilla v6, adding the new curve and updated cipher constants.
hack/tools/update-tls-profiles.sh	Updates generator for Mozilla v6 JSON (`ciphers.iana`) and adds conditional handling for removed “old” profile.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tmshort

I think we should update the old profile to the last time it existed, which was 5.8:
https://ssl-config.mozilla.org/guidelines/5.8.json

So, perhaps run it against that version, then the latest.

tmshort · 2026-04-07T14:02:11Z

I'm actually surprised it didn't break when 5.8 was introduced.

codecov · 2026-04-07T14:03:18Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.95%. Comparing base (fd25bf7) to head (dbfcaeb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2631   +/-   ##
=======================================
  Coverage   68.95%   68.95%           
=======================================
  Files         139      139           
  Lines        9891     9891           
=======================================
  Hits         6820     6820           
  Misses       2562     2562           
  Partials      509      509

Flag	Coverage Δ
e2e	`37.29% <ø> (-0.29%)`	⬇️
experimental-e2e	`52.25% <ø> (+0.02%)`	⬆️
unit	`53.60% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

grokspawn · 2026-04-07T14:13:00Z

Thanks @camilamacedo86!
Looking at the related script, it blindly grabs https://ssl-config.mozilla.org/guidelines/latest.json. Is there some versioned dependency here so we could more easily detect a change?

tmshort · 2026-04-07T14:25:32Z

Thanks @camilamacedo86!
Looking at the related script, it blindly grabs https://ssl-config.mozilla.org/guidelines/latest.json. Is there some versioned dependency here so we could more easily detect a change?

The failure was on purpose, to detect a change in the policy, but because the change was incompatible (i.e. more than just a change in cipher suites), the script threw an error.

tmshort · 2026-04-07T14:30:59Z

+# Check if old profile exists (used for both header note and profile generation)
+has_old_profile=false
+if ${JQ} -e '.configurations.old' ${TMPFILE} > /dev/null 2>&1; then
+    has_old_profile=true
+    old_profile_note=""
+else
+    old_profile_note="
+// NOTE: The \"old\" profile is preserved from Mozilla v5.8 for backwards compatibility,
+//       as it was removed from Mozilla guidelines v${version}."
+fi
+


At this point, the old configuration is gone in 6.0+, not sure we actually need this check anymore, but it can be handled later.

Minimal changes to make verify work: - Change INPUT URL from latest.json to 5.8.json - Update ciphers.go to ciphers.iana (Mozilla v5.8 format change) - Add X25519MLKEM768 post-quantum curve constant - Filter out unsupported ciphers not in Go's crypto/tls: - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 - TLS_RSA_WITH_AES_256_CBC_SHA256 - Update CHACHA20_POLY1305 constants to include _SHA256 suffix Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

tmshort · 2026-04-07T14:35:02Z

Did you remove the test changes?

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-07T14:37:13Z

 OUTPUT=internal/shared/util/tlsprofiles/mozilla_data.go
-INPUT=https://ssl-config.mozilla.org/guidelines/latest.json
+INPUT=https://ssl-config.mozilla.org/guidelines/5.8.json



PR metadata/title mentions updating to Mozilla TLS guidelines v6.0, but this script is pinned to guidelines/5.8.json (and the generated mozilla_data.go reports DATA VERSION 5.8). Please align the PR title/description with the actual pinned version, or update the script/data generation to the intended v6.0 source URL/version so make verify stays consistent with the stated change.

Copilot · 2026-04-07T14:37:13Z

 // This is primarily so that we don't have to rewrite curve values in mozilla_data.go
 const (
-	X25519     tls.CurveID = tls.X25519
-	prime256v1 tls.CurveID = tls.CurveP256
-	secp384r1  tls.CurveID = tls.CurveP384
-	secp521r1  tls.CurveID = tls.CurveP521
+	X25519MLKEM768 tls.CurveID = tls.X25519MLKEM768
+	X25519         tls.CurveID = tls.X25519
+	prime256v1     tls.CurveID = tls.CurveP256
+	secp384r1      tls.CurveID = tls.CurveP384
+	secp521r1      tls.CurveID = tls.CurveP521
 )

 var curves = map[string]tls.CurveID{
-	"X25519":     tls.X25519,
-	"prime256v1": tls.CurveP256,
-	"secp384r1":  tls.CurveP384,
-	"secp521r1":  tls.CurveP521,
+	"X25519MLKEM768": tls.X25519MLKEM768,
+	"X25519":         tls.X25519,
+	"prime256v1":     tls.CurveP256,
+	"secp384r1":      tls.CurveP384,
+	"secp521r1":      tls.CurveP521,
 }


New curve support (X25519MLKEM768) is added here, but there is no test that curveId/curveSlice.Set accepts this new value. Consider extending the existing TLS profile flag/unit tests to include X25519MLKEM768 so regressions in curve parsing are caught.

tmshort

/approve

openshift-ci · 2026-04-07T14:49:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Copilot AI review requested due to automatic review settings April 7, 2026 13:21

openshift-ci Bot requested review from anik120 and grokspawn April 7, 2026 13:21

Copilot started reviewing on behalf of camilamacedo86 April 7, 2026 13:23 View session

camilamacedo86 requested a review from tmshort April 7, 2026 13:26

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Comment thread internal/shared/util/tlsprofiles/tlsprofiles.go

Comment thread internal/shared/util/tlsprofiles/mozilla_data.go

Comment thread internal/shared/util/tlsprofiles/mozilla_data.go

Comment thread hack/tools/update-tls-profiles.sh Outdated

camilamacedo86 force-pushed the fix-make-verify branch from 89b7b9f to 89b7085 Compare April 7, 2026 13:39

Copilot AI review requested due to automatic review settings April 7, 2026 13:42

camilamacedo86 force-pushed the fix-make-verify branch from 89b7085 to c7b4c59 Compare April 7, 2026 13:42

Copilot started reviewing on behalf of camilamacedo86 April 7, 2026 13:42 View session

Copilot AI reviewed Apr 7, 2026

View reviewed changes

Comment thread internal/shared/util/tlsprofiles/tlsprofiles_test.go Outdated

Comment thread hack/tools/update-tls-profiles.sh Outdated

Comment thread hack/tools/update-tls-profiles.sh Outdated

tmshort requested changes Apr 7, 2026

View reviewed changes

Comment thread hack/tools/update-tls-profiles.sh Outdated

Comment thread hack/tools/update-tls-profiles.sh Outdated

Comment thread hack/tools/update-tls-profiles.sh Outdated

Comment thread internal/shared/util/tlsprofiles/tlsprofiles_test.go Outdated

openshift-ci Bot assigned tmshort Apr 7, 2026

camilamacedo86 force-pushed the fix-make-verify branch from c7b4c59 to 60f6e68 Compare April 7, 2026 14:25

tmshort reviewed Apr 7, 2026

View reviewed changes

Comment thread internal/shared/util/tlsprofiles/mozilla_data.go

tmshort reviewed Apr 7, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings April 7, 2026 14:33

camilamacedo86 force-pushed the fix-make-verify branch from 60f6e68 to dbfcaeb Compare April 7, 2026 14:33

camilamacedo86 changed the title ~~🌱 Update TLS profiles to Mozilla guidelines v6.0~~ 🌱 Update TLS profiles to Mozilla guidelines v5.8 Apr 7, 2026

Copilot AI reviewed Apr 7, 2026

View reviewed changes

tmshort approved these changes Apr 7, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 7, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 7, 2026

openshift-merge-bot Bot merged commit 4510b1b into operator-framework:main Apr 7, 2026
31 checks passed

Conversation

camilamacedo86 commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Why it happened?

Uh oh!

netlify Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for olmv1 ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tmshort left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tmshort commented Apr 7, 2026

Uh oh!

codecov Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

grokspawn commented Apr 7, 2026

Uh oh!

tmshort commented Apr 7, 2026

Uh oh!

Uh oh!

tmshort Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

tmshort commented Apr 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

tmshort left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Apr 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

camilamacedo86 commented Apr 7, 2026 •

edited

Loading

netlify Bot commented Apr 7, 2026 •

edited

Loading

tmshort left a comment •

edited

Loading

codecov Bot commented Apr 7, 2026 •

edited

Loading