Jenkins core: Non-compliant classes and libraries

End-of-life announcement

CloudBees CI 2.516.3.29358 was the last version of CloudBees CI on modern cloud platforms to produce Federal Information Processing Standards (FIPS)-compliant images.

This end-of-life announcement allows CloudBees to focus on driving new technology and product innovation as well as maintaining existing products and standards that are actively used by customers.

After CloudBees CI 2.516.3.29358, FIPS support will be discontinued and will no longer be supported. CloudBees recommends removing any dependencies on FIPS support and discontinuing its use immediately.

For more information regarding this end-of-life announcement, please contact CloudBees Support.

This section describes the Jenkins classes and libraries that are not FIPS 140-3 compliant. A Jenkins class or library is non-compliant if it does not adhere to FIPS 140-3 standards. They should not be used in your pipelines and scripts.

Usage statistics

The UsageStatistics class is disabled because it is not FIPS 140-3 compliant.

HMACConfidentialKey

The HMACConfidentialKey class returns HMAC computed code using the HMAC-SHA256 algorithm.

This class is not FIPS 140-3 compliant because the original HMAC code is trimmed based on the length supplied in the constructor and trimmed code is not reliable for security checks.

Jenkins CLI

Jenkins CLI is a tool that uses cryptographic libraries, and it can be used outside a FIPS environment. Therefore, it is not supported when Jenkins is in FIPS mode.