RPM file uses MD5 file digest which is blocked on FIPS enabled systems
lm-sig opened this issue · comments
Preflight Checklist
- I agree to follow the Code of Conduct that this project adheres to.
- I have searched the issue tracker for a feature request that matches the one I want to file, without success.
You must agree to search and the code of conduct. You must fill in this entire template. If you delete part/all or miss parts out your issue will be closed.
Describe the bug
The RPM file provided on the github releases page provides files with a MD5 file digest. RPM files built on RHEL or Fedora will create RPM files with a SHA256 file digest. When you attempt to install the drawio RPM file on a FIPS enabled RHEL system the RPM installation will fail.
To Reproduce
Steps to reproduce the behavior:
- dnf install -y ./drawio-x86_64-24.2.5.rpm
- "Error unpacking rpm package draw.io-24.2.5-1.x86_64"
- rpm -qp --qf "%{filedigestalgo}\n" ./drawio-x86_64-24.2.5.rpm
- Output is "(none)" which indicates MD5. RHEL or Fedora RPMs will output "8" for SHA256.
Expected behavior
Package installs when FIPS mode is enabled.
Please update your RPM builds to generate SHA256 file digests. You can verify it with the rpm -qp --qf "%{filedigestalgo}\n" command.
Screenshots
draw.io version (In the Help->About menu of the draw.io editor):
- draw.io version 24.2.5
Desktop (please complete the following information):
- OS: RedHat Enterprise Linux (RHEL) 8
Additional context
FIPS is a security mode on RHEL that disables algorithms such as MD5 that are now considered insecure.
The issue will be fixed in the next release
Thanks for the report
12.4.0.
Confirmed to be generated with a SHA256 digest. Thank you, all!
$ rpm -qp --qf "%{filedigestalgo}\n" ./drawio-x86_64-24.4.0.rpm
8