[JEP-237] Disable usage stats in fips mode

core/src/main/java/hudson/model/UsageStatistics.java

@@ -64,6 +64,7 @@
 import javax.crypto.spec.IvParameterSpec;
 import javax.crypto.spec.SecretKeySpec;
 import jenkins.model.Jenkins;
+import jenkins.security.FIPS140;
 import jenkins.util.SystemProperties;
 import net.sf.json.JSONObject;
 import org.kohsuke.stapler.StaplerRequest;
@@ -102,8 +103,10 @@ public UsageStatistics(String keyImage) {
      * Returns true if it's time for us to check for new version.
      */
     public boolean isDue() {
-        // user opted out. no data collection.
-        if (!Jenkins.get().isUsageStatisticsCollected() || DISABLED)     return false;
+        // user opted out (explicitly or FIPS is requested). no data collection
+        if (!Jenkins.get().isUsageStatisticsCollected() || DISABLED || FIPS140.useCompliantAlgorithms()) {
+            return false;
+        }
 
         long now = System.currentTimeMillis();
         if (now - lastAttempt > DAY) {
@@ -212,7 +215,7 @@ public Permission getRequiredGlobalConfigPagePermission() {
     public boolean configure(StaplerRequest req, JSONObject json) throws FormException {
         try {
             // for backward compatibility reasons, this configuration is stored in Jenkins
-            Jenkins.get().setNoUsageStatistics(json.has("usageStatisticsCollected") ? null : true);
+            Jenkins.get().setNoUsageStatistics(json.has("usageStatisticsCollected") ? null : Boolean.TRUE);
             return true;
         } catch (IOException e) {
             throw new FormException(e, "usageStatisticsCollected");

core/src/main/java/jenkins/security/FIPS140.java

@@ -0,0 +1,60 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2023, Cloudbees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package jenkins.security;
+
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import jenkins.util.SystemProperties;
+
+/**
+ * Utilities to help code change behaviour when it is desired to run in a FIPS-140 enabled environment.
+ * The environment (host, JVM and servlet container), must be suitably configured which is outside the scope of the Jenkins project.
+ * @see <a href="https://csrc.nist.gov/pubs/fips/140-2/upd2/final">FIPS-140-2</a>
+ * @see <a href="https://github.com/jenkinsci/jep/tree/master/jep/237#readme">JEP-237</a>
+ * @since TODO
+ */
+public class FIPS140 {
+
+    private static final Logger LOGGER = Logger.getLogger(FIPS140.class.getName());
+
+    private static final boolean FIPS_COMPLIANCE_MODE = SystemProperties.getBoolean(FIPS140.class.getName() + ".COMPLIANCE");
+
+    static {
+        if (useCompliantAlgorithms()) {
+            LOGGER.log(Level.CONFIG, "System has been asked to run in FIPS-140 compliant mode");
+        }
+    }
+
+    /**
+     * Provide a hint that the system should strive to be compliant with <a href="https://csrc.nist.gov/pubs/fips/140-2/upd2/final">FIPS-140-2</a>.
+     * This can be used by code that needs to make choices at runtime whether to disable some optional behaviour that is not compliant with FIPS-140,
+     * or to switch to a compliant (yet less secure) alternative.
+     * If this returns {@code true} it does not mean that the instance is compliant, it merely acts as a hint.
+     * @return {@code true} iff the system should prefer compliance with FIPS-140-2 over compatibility with existing data or alternative non approved algorithms.
+     */
+    public static boolean useCompliantAlgorithms() {
+        return FIPS_COMPLIANCE_MODE;
+    }
+
+}

core/src/main/resources/hudson/model/UsageStatistics/global.groovy

@@ -1,7 +1,19 @@
 package hudson.model.UsageStatistics
 
+import hudson.model.UsageStatistics
+import jenkins.security.FIPS140
+import hudson.Functions
+
 def f=namespace(lib.FormTagLib)
 
 f.section(title: _("Usage Statistics")) {
-    f.optionalBlock(field: "usageStatisticsCollected", checked: app.usageStatisticsCollected, title: _("statsBlurb"))
+    if (UsageStatistics.DISABLED) {
+        span(class: "jenkins-not-applicable") {
+            raw(_("disabledBySystemProperty"))
+        }
+    } else if (FIPS140.useCompliantAlgorithms()) {
+        f.optionalBlock(field: "usageStatisticsCollected", checked: app.usageStatisticsCollected, title: _("statsBlurbFIPS"))
+    } else {
+        f.optionalBlock(field: "usageStatisticsCollected", checked: app.usageStatisticsCollected, title: _("statsBlurb"))
+    }
 }

core/src/main/resources/hudson/model/UsageStatistics/global.properties

@@ -22,4 +22,8 @@
 
 statsBlurb=\
   Help make Jenkins better by sending anonymous usage statistics and crash reports to the Jenkins project
+statsBlurbFIPS=\
+  Help make Jenkins better by sending telemetry to the Jenkins project
+disabledBySystemProperty=\
+  The option to send anonymous usage statistics, crash reports and telemetry to the Jenkins project is disabled by a <a href="https://www.jenkins.io/doc/book/managing/system-properties/#hudson-model-usagestatistics-disabled">System Property</a>.
 

core/src/main/resources/hudson/model/UsageStatistics/help-usageStatisticsCollected.jelly

@@ -6,25 +6,35 @@
         When enabled, Jenkins periodically sends information to the Jenkins project.
         The Jenkins project uses this information to set development priorities.
     </div>
-    <h1>General usage statistics</h1>
-    <div>
-        <p>Jenkins reports the following general usage statistics:</p>
-        <ul>
-            <li>Your Jenkins version</li>
-            <li>For your controller and each agent, the OS type and number of executors</li>
-            <li>Installed plugins and their versions</li>
-            <li>Number of items (like jobs) of each item type</li>
-        </ul>
-        <p>
-            This <b>does not</b> report any personally identifiable information. The only information reported by Jenkins is information inherently revealed by the HTTP protocol, such as the IP address.
-
-            These usage statistics are aggregated, updated monthly, and published to <a href="https://stats.jenkins.io">stats.jenkins.io</a>
-        </p>
-    </div>
+    <j:invokeStatic className="jenkins.security.FIPS140" method="useCompliantAlgorithms" var="fips"/>
+    <j:if test="${!fips}">
+        <h1>General usage statistics</h1>
+        <div>
+            <p>Jenkins reports the following general usage statistics:</p>
+            <ul>
+                <li>Your Jenkins version</li>
+                <li>For your controller and each agent, the OS type and number of executors</li>
+                <li>Installed plugins and their versions</li>
+                <li>Number of items (like jobs) of each item type</li>
+            </ul>
+            <p>
+                This <b>does not</b> report any personally identifiable information.
+                The only information reported by Jenkins is information inherently revealed by the HTTP protocol, such as the IP address.
+                These usage statistics are aggregated, updated monthly, and published to <a href="https://stats.jenkins.io">stats.jenkins.io</a>
+            </p>
+        </div>
+    </j:if>
     <h1>Telemetry collection</h1>
     <div>
         <p>
-            In addition to the general usage statistics listed above, the Jenkins project collects telemetry data from specific trials to inform future development.
+            <j:choose>
+                <j:when test="${fips}">
+                    The Jenkins project collects telemetry data from specific trials to inform future development.
+                </j:when>
+                <j:otherwise>
+                    In addition to the general usage statistics listed above, the Jenkins project collects telemetry data from specific trials to inform future development.
+                </j:otherwise>
+            </j:choose>
             Each trial has a specific purpose and a defined end date, after which collection stops, independent of the installed versions of Jenkins or plugins.
             Once a trial is complete, the trial results may be aggregated and shared with the developer community.
         </p>