{"record":{"id":"641aba0f4a2b7404","repo":"puppetlabs/puppet","slug":"md5-is-not-supported-in-fips-mode","errorCode":null,"errorMessage":"MD5 is not supported in FIPS mode","messagePattern":"MD5 is not supported in FIPS mode","errorType":"validation","errorClass":"ArgumentError","httpStatus":null,"severity":"error","filePath":"lib/puppet/type/file/checksum.rb","lineNumber":24,"sourceCode":"# files.\nPuppet::Type.type(:file).newparam(:checksum) do\n  include Puppet::Util::Checksums\n\n  # The default is defined in Puppet.default_digest_algorithm\n  desc \"The checksum type to use when determining whether to replace a file's contents.\n\n    The default checksum type is sha256.\"\n\n  # The values are defined in Puppet::Util::Checksums.known_checksum_types\n  newvalues(:sha256, :sha256lite, :md5, :md5lite, :sha1, :sha1lite, :sha512, :sha384, :sha224, :mtime, :ctime, :none)\n\n  defaultto do\n    Puppet[:digest_algorithm].to_sym\n  end\n\n  validate do |value|\n    if Puppet::Util::Platform.fips_enabled? && (value == :md5 || value == :md5lite)\n      raise ArgumentError, _(\"MD5 is not supported in FIPS mode\")\n    end\n  end\n\n  def sum(content)\n    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content\n    type = digest_algorithm\n    \"{#{type}}\" + send(type, content)\n  end\n\n  def sum_file(path)\n    type = digest_algorithm\n    method = type.to_s + \"_file\"\n    \"{#{type}}\" + send(method, path).to_s\n  end\n\n  def sum_stream(&block)\n    type = digest_algorithm\n    method = type.to_s + \"_stream\"","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/type/file/checksum.rb#L6-L42","documentation":"The file type's checksum property validates its values; when Puppet::Util::Platform.fips_enabled? is true, `md5` and `md5lite` raise ArgumentError 'MD5 is not supported in FIPS mode' because FIPS-mode OpenSSL refuses MD5 digests.","triggerScenarios":"`file { '/x': ensure => file, checksum => md5 }` on a node booted with fips=1; `digest_algorithm = md5` in puppet.conf making md5 the default for every file resource; third-party modules hardcoding checksum => md5lite; manifests copied from non-FIPS environments.","commonSituations":"Government/regulated environments enabling the kernel fips flag; RHEL fips=1 nodes; older modules predating Puppet's sha256 default; compliance hardening that flips FIPS on after manifests were written.","solutions":["Change the resource: `checksum => sha256` (or drop the checksum line).","Set the global default in puppet.conf: `[main] digest_algorithm = sha256`.","Patch or upgrade modules that hardcode md5/md5lite — many have upstream FIPS fixes.","Confirm FIPS state while debugging: `cat /proc/sys/crypto/fips_enabled`."],"exampleFix":"// before\nfile { '/etc/app.conf':\n  ensure   => file,\n  checksum => md5,\n}\n\n// after\nfile { '/etc/app.conf':\n  ensure   => file,\n  checksum => sha256,\n}","handlingStrategy":"validation","validationCode":"// Puppet: fail fast at compile time on FIPS nodes\nif $facts['fips_enabled'] and $checksum in ['md5', 'md5lite'] {\n  fail('md5 checksums are unavailable under FIPS — use sha256')\n}","typeGuard":"def fips_safe_checksum?(value)\n  !(Puppet::Util::Platform.fips_enabled? && %w[md5 md5lite].include?(value.to_s))\nend","tryCatchPattern":"rescue ArgumentError and rewrite the resource's checksum to sha256; md5 can never work on a FIPS node, so there is no retry path — remediation is a config change, then re-run the agent.","preventionTips":["Default digest_algorithm to sha256 in puppet.conf for the whole fleet.","Audit modules for checksum => md5 / md5lite before enabling FIPS.","Expect the first run after switching checksum types to re-digest files.","Track the fips_enabled fact in inventory to know which nodes are affected."],"tags":["puppet","fips","md5","checksum","compliance"],"backgroundTag":"fips-restricted-algorithm","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}