Each FIPS 140 certificate for a package can take several months to complete and is valid for 5 years. However, as vulnerabilities happen security-critical fixes may need to be included faster than a certification cycle. For that, we provide two ways to consume validated packages: a stream called
fips, where the exact packages validated by NIST are present; and another stream called
fips-updates where the validated packages are present, but are updated with security fixes. The
fips-updates stream also allows access to the packages during the validation phase, enabling early application development and testing. Both streams are revalidated periodically during Ubuntu standard support phase.
Switching from ‘fips’ to ‘fips-updates’
If you are on a system with the
fips stream enabled such as Ubuntu Pro FIPS, you can switch to the
fips-updates stream with the following command.
sudo ua enable fips-updates