活动：'crypto.fips.indicator'

🌐 Event: 'crypto.fips.indicator'

• operation <string> 提供者定义的操作类型。
• reason <string> 提供者定义的操作未获批准的原因说明。
• blocked <boolean> 指标回调是否阻止了操作。
• count <number> 这个消息表示的匹配挂起指示器调用的数量。
• dropped <number> 在这条消息发送之前，额外指标调用的次数下降了。

当 Node.js 使用的 OpenSSL FIPS 提供者检测到某个操作在相应的提供者检查放宽后不被 FIPS 批准时，会发出此消息。当提供者配置为向后兼容时，这类操作是可能的。operation 和 reason 值来自提供者，应将它们视为不透明的字符串，而不是稳定的枚举值。

🌐 Emitted when the OpenSSL FIPS provider used by Node.js detects an operation that is not FIPS approved after the corresponding provider check was relaxed. Such operations are possible when the provider is configured for backwards compatibility. The operation and reason values come from the provider and should be treated as opaque strings rather than stable enumerations.

使用 --enable-fips-indicator-events 启动 Node.js 以启用此通道。没有这个选项，订阅不会安装 OpenSSL 回调，也不会发布任何消息。

🌐 Start Node.js with --enable-fips-indicator-events to enable this channel. Without the option, subscribing does not install the OpenSSL callback and no messages are published.

订阅通道只是用于观察，从不会改变操作的结果。Node.js 会保留在初始化其加密支持之前安装的任何本地指示器回调的结果。当使用 --force-fips=strict 时，无论是否启用了指示器事件或通道是否有订阅者，Node.js 都会拒绝回调指示的非批准操作。

🌐 Subscribing to the channel is observation-only and never changes the result of an operation. Node.js preserves the result from any native indicator callback installed before Node.js initializes its crypto support. When --force-fips=strict is used, Node.js rejects callback-indicated non-approved operations whether or not indicator events are enabled or the channel has subscribers.

消息是在主线程上异步发布的，因为 OpenSSL 指示器可能来自 Worker 或其他线程。只有主线程上的订阅才能接收消息。消息相对于源操作的传递顺序没有定义，而且消息无法与特定的调用或 Worker 关联。

🌐 Messages are published asynchronously on the main thread because OpenSSL indicators can originate from Workers or other threads. Only subscriptions on the main thread receive messages. Delivery order relative to the originating operation is not defined, and a message cannot be correlated with a particular call or Worker.

一次加密操作可能会多次触发 OpenSSL 指示器。匹配的待处理调用会被合并，并在 count 中反映出来，这不一定代表加密操作的次数。最多可以排队 256 条不同的消息。额外的调用会在第一条排队消息的 dropped 中报告。排队的消息不会让事件循环保持活跃，所以这个通道更适合用作诊断参考，而不是权威的审计日志。

🌐 One cryptographic operation can invoke the OpenSSL indicator more than once. Matching pending invocations are coalesced and reflected in count, which does not necessarily represent a number of cryptographic operations. At most 256 distinct messages are queued. Additional invocations are reported in dropped on the first queued message. Queued messages do not keep the event loop active, so this channel is best-effort diagnostics rather than an authoritative audit log.

这个通道观察 Node.js 使用的默认 OpenSSL 库上下文。它不会观察本地插件或其他使用另一个 OSSL_LIB_CTX 或另一个 libcrypto 副本的代码。它在 OpenSSL 3.4 及更高版本中可用，但在 BoringSSL 中不可用。配置为直接拒绝检查的提供者，包括严格的 OpenSSL FIPS 提供者，可能会在不发出指示的情况下拒绝操作。是否收到消息，并不能证明 Node.js 或某个加密操作已通过 FIPS 验证。

🌐 This channel observes the default OpenSSL library context used by Node.js. It does not observe native addons or other code that uses another OSSL_LIB_CTX or another copy of libcrypto. It is active with OpenSSL 3.4 and later and is not available with BoringSSL. A provider configured to reject a check directly, including a pedantic OpenSSL FIPS provider, can reject an operation without emitting an indicator. Receiving or not receiving a message does not establish that Node.js or a cryptographic operation is FIPS validated.

import diagnosticsChannel from 'node:diagnostics_channel';

diagnosticsChannel.subscribe('crypto.fips.indicator', (message) => {
  console.error('Non-approved cryptographic operation', message);
}); 拷贝