System-wide crypto-policies and FIPS setup of the Red Hat build of OpenJDK 25 (OPENJDK-1686, alternative #1)

#
# System-wide crypto-policies and FIPS setup
#
# The following crypto-policies setup automatically detects when the system
# is in FIPS mode and configures OpenJDK accordingly. If OpenJDK needs to
# ignore the system and disable its FIPS setup, just disable the usage of
# the system crypto-policies, by any of the methods described below.
#
# The redhat.crypto-policies system property is a boolean switch that
# controls the usage on a per-run basis. For example, pass
# -Dredhat.crypto-policies=false to disable the system crypto-policies.
#
# This setup consists of the following files in $JAVA_HOME/conf/security:
#
#   'redhat/false/crypto-policies.properties' (policies usage disabled file)
#      Empty file, applied when the boolean switch is passed as false.
#
#   'redhat/true/crypto-policies.properties' (policies usage enabled file)
#      Performs the crypto-policies and FIPS setup, applied when the boolean
#      switch is passed as true.
#
#   'redhat/crypto-policies.properties' (policies usage default file)
#      Determines the default choice by including one of the previous files,
#      applied when the boolean switch is not passed.
#      The system crypto-policies usage is enabled by default:
#        include true/crypto-policies.properties
#
# To enable or disable the usage of the crypto-policies on a per-deployment
# basis, edit the policies usage default file, changing the included file.
# For example, execute the following command to persistently disable the
# crypto-policies:
#   sed -i s/true/false/ $JAVA_HOME/conf/security/redhat/crypto-policies.properties
# Applications can still override this on a per-run basis, for example by
# passing -Dredhat.crypto-policies=true.
#
# To disable the redhat.crypto-policies boolean switch, modify the following
# include directive as follows. Replace ${redhat.crypto-policies} by true to
# force-apply the system crypto-policies:
#   include redhat/true/crypto-policies.properties
# Remove or comment out the include directive to force-disable the setup:
#   #include redhat/${redhat.crypto-policies}/crypto-policies.properties
#
include redhat/${redhat.crypto-policies}/crypto-policies.properties
#       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# WARNING: anything placed after this include directive will apply on top
# of the described setup. Adding properties below this section is strongly
# discouraged, as it poses a risk of overriding the system crypto-policies
# or invalidating the FIPS deployment.

name = FIPS
library = ${java.home}/lib/libnssadapter.so
slot = 3
nssUseSecmod = false
attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true }