Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

(PUP-12047) Add logic to skip MD5 checksum method on a FIPS system #9409

Merged
merged 1 commit into from
Jul 2, 2024
Merged

(PUP-12047) Add logic to skip MD5 checksum method on a FIPS system #9409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/puppet/file_serving/http_metadata.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,9 @@ def initialize(http_response, path = '/dev/null')
def collect
# Prefer the checksum_type from the indirector request options
# but fall back to the alternative otherwise
[ @checksum_type, :sha256, :sha1, :md5, :mtime ].each do |type|
[@checksum_type, :sha256, :sha1, :md5, :mtime].each do |type|
next if type == :md5 && Puppet::Util::Platform.fips_enabled?

@checksum_type = type
@checksum = @checksums[type]
break if @checksum
Expand Down
8 changes: 8 additions & 0 deletions spec/unit/file_serving/http_metadata_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,14 @@
expect( metadata.mode ).to be_nil
end

it "skips md5 checksum type in collect on FIPS enabled platforms" do
allow(Puppet::Util::Platform).to receive(:fips_enabled?).and_return(true)
http_response['X-Checksum-Md5'] = 'c58989e9740a748de4f5054286faf99b'
metadata = described_class.new(http_response)
metadata.collect
expect( metadata.checksum_type ).to eq :mtime
end

context "with no Last-Modified or Content-MD5 header from the server" do
it "should use :mtime as the checksum type, based on current time" do
# Stringifying Time.now does some rounding; do so here so we don't end up with a time
Expand Down