Bug 834743 - fedpkg is depending on md5, which is not allowed in fips mode
Summary: fedpkg is depending on md5, which is not allowed in fips mode
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: fedpkg
Version: 24
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: cqi
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-06-23 05:08 UTC by Paul Wouters
Modified: 2018-04-11 08:28 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-12-13 08:18:26 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Paul Wouters 2012-06-23 05:08:22 UTC
fedpkg won't work in fips mode because it checks the file download cheksums in the sources file using md5.

md5 is weak, and we should not trust it to verify network obtained files.

It would be good if we can migrate away from md5 in the sources file to sha1 or sha256. As this migration will probably take a while, due to packagers needing to update their sources files, it should start sooner rather then later.

Comment 1 Kamil Dudka 2012-08-28 12:41:54 UTC
Is there any workaround for this bug?

Comment 2 Fedora Admin XMLRPC Client 2012-11-30 18:27:28 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 3 Fedora End Of Life 2013-04-03 14:32:24 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 19 development cycle.
Changing version to '19'.

(As we did not run this process for some time, it could affect also pre-Fedora 19 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 19 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora19

Comment 4 Dennis Gilmore 2013-12-16 00:20:48 UTC
lookaside cache needs md5. right now it is absolutely required. we need to convert the whole lookaside cache to sha356sum to move off of needing md5

Comment 5 Jan Kurik 2015-07-15 15:07:14 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle.
Changing version to '23'.

(As we did not run this process for some time, it could affect also pre-Fedora 23 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23

Comment 6 Jan Kurik 2016-02-24 13:11:38 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle.
Changing version to '24'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase

Comment 7 cqi 2016-08-23 08:00:58 UTC
Is sha512sum okay?

Comment 8 Lubomír Sedlář 2016-12-13 08:18:26 UTC
As of Dec 12 and fedpkg-1.26 newly uploaded sources will use SHA512.

https://fedoraproject.org/wiki/ReleaseEngineering/FlagDay2016

Comment 9 Paul Wouters 2016-12-13 19:39:28 UTC
awesome! Thanks!


Note You need to log in before you can comment on or make changes to this bug.