Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(PUP-12047) Add logic to skip MD5 checksum method on a FIPS system #9405

Merged
merged 1 commit into from
Jun 27, 2024

Conversation

AriaXLi
Copy link
Contributor

@AriaXLi AriaXLi commented Jun 25, 2024

This commit adds logic in http_metadata.rb to skip MD5 related checksums when FIPS is enabled since MD5 is not supported on FIPS enabled systems. This PR addresses #9375.

@AriaXLi AriaXLi requested a review from a team as a code owner June 25, 2024 22:04
@AriaXLi
Copy link
Contributor Author

AriaXLi commented Jun 25, 2024

I was able to successfully re-produce the error on a RHEL 7 FIPS machine:

[root@slower-bedstraw ~] cat another_test.pp
file { '/tmp/test':
        ensure => file,
        source => "https://github.com/voxpupuli/webhook-go/releases/download/v2.6.1/webhook-go_2.6.1_linux_amd64.deb",
      }
     
[root@slower-bedstraw ~]# puppet apply another_test.pp
Notice: Compiled catalog for slower-bedstraw.delivery.puppetlabs.net in environment production in 0.01 seconds
Error: /Stage[main]/Main/File[/tmp/test]: Could not evaluate: Parameter checksum failed on File[/tmp/test]: MD5 is not supported in FIPS mode (file: /root/another_test.pp, line: 1)
Notice: Applied catalog in 0.55 seconds

With my changes the error goes away:

[root@slower-bedstraw ~]# puppet apply another_test.pp
Notice: Compiled catalog for slower-bedstraw.delivery.puppetlabs.net in environment production in 0.01 seconds
Notice: Applied catalog in 0.67 seconds

This commit adds logic in http_metadata.rb to skip MD5 related checksums
when FIPS is enabled since MD5 is not supported on FIPS enabled systems.
@cthorn42 cthorn42 merged commit a43942b into puppetlabs:main Jun 27, 2024
9 checks passed
@cthorn42 cthorn42 added the backport 7.x Generate a backport PR to 7.x label Jun 27, 2024
Copy link

Backport failed for 7.x, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally.

git fetch origin 7.x
git worktree add -d .worktree/backport-9405-to-7.x origin/7.x
cd .worktree/backport-9405-to-7.x
git checkout -b backport-9405-to-7.x
ancref=$(git merge-base 8047d1cdbf33affa85bc134cf4e6c264bffd7530 1f7c8ef64843847846b0a8b2d8a1fe9858eb0bd8)
git cherry-pick -x $ancref..1f7c8ef64843847846b0a8b2d8a1fe9858eb0bd8

@joshcooper
Copy link
Contributor

@AriaXLi it looks like the backport failed, were you or @cthorn42 going to manually backport?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport 7.x Generate a backport PR to 7.x bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants