{"record":{"id":"7c53b8404a60c735","repo":"chocolatey/choco","slug":"when-fips-mode-is-enabled-chocolatey-requires-0","errorCode":null,"errorMessage":"When FIPS Mode is enabled, Chocolatey requires {0} feature also be enabled.","messagePattern":"When FIPS Mode is enabled, Chocolatey requires (.+?) feature also be enabled\\.","errorType":"exception","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"src/chocolatey/infrastructure.app/builders/ConfigurationBuilder.cs","lineNumber":646,"sourceCode":"                }\r\n                catch (Exception ex)\r\n                {\r\n                    if (!config.CommandName.IsEqualTo(\"feature\"))\r\n                    {\r\n                        if (ex.InnerException != null && ex.InnerException.Message.ContainsSafe(\"FIPS\"))\r\n                        {\r\n                            \"chocolatey\".Log().Warn(ChocolateyLoggers.Important, @\"\r\nFIPS Mode detected - run 'choco feature enable -n {0}'\r\n to use Chocolatey.\".FormatWith(ApplicationParameters.Features.UseFipsCompliantChecksums));\r\n\r\n                            var errorMessage = \"When FIPS Mode is enabled, Chocolatey requires {0} feature also be enabled.\".FormatWith(ApplicationParameters.Features.UseFipsCompliantChecksums);\r\n                            if (string.IsNullOrWhiteSpace(config.CommandName))\r\n                            {\r\n                                \"chocolatey\".Log().Error(errorMessage);\r\n                                return;\r\n                            }\r\n\r\n                            throw new ApplicationException(errorMessage);\r\n                        }\r\n\r\n                        throw;\r\n                    }\r\n                }\r\n            }\r\n        }\r\n\r\n#pragma warning disable IDE0022, IDE1006\r\n        [Obsolete(\"This overload is deprecated and will be removed in v3.\")]\r\n        [EditorBrowsable(EditorBrowsableState.Never)]\r\n        public static void initialize_with(Lazy<IEnvironment> environment)\r\n            => InitializeWith(environment);\r\n\r\n        [Obsolete(\"This overload is deprecated and will be removed in v3.\")]\r\n        public static bool is_compatibility_checks_disabled(IFileSystem filesystem, IXmlService xmlService)\r\n            => AreCompatibilityChecksDisabled(filesystem, xmlService);\r\n\r","sourceCodeStart":628,"sourceCodeEnd":664,"githubUrl":"https://github.com/chocolatey/choco/blob/0d5abdd10cc177a141e69547cad6935b419b6c17/src/chocolatey/infrastructure.app/builders/ConfigurationBuilder.cs#L628-L664","documentation":"When the OS is in FIPS mode, the .NET MD5 provider throws when Chocolatey tries to set MD5 as its hash algorithm (FIPS disallows non-compliant algorithms). SetHashProvider catches that, and if the 'useFipsCompliantChecksums' feature is NOT enabled, it throws this ApplicationException requiring that feature to also be on. Chocolatey uses MD5 checksums by default; FIPS mode blocks them, so the feature flag is mandatory in such environments.","triggerScenarios":"FIPS security policy enabled on the machine (Group Policy 'System cryptography: Use FIPS compliant algorithms') AND the 'useFipsCompliantChecksums' Chocolatey feature is disabled, while running a command (config.CommandName is set) that needs hashing. If CommandName is empty it only logs the error and returns.","commonSituations":"Government/regulated/enterprise machines with FIPS enforced via GPO; disabling the feature after it was auto-enabled; new deployments onto FIPS-locked servers without first enabling the feature.","solutions":["Run 'choco feature enable -n useFipsCompliantChecksums' before other operations.","In config files (chocolatey.config) set <feature name=\"useFipsCompliantChecksums\" enabled=\"true\"/>.","If FIPS is not actually required, disable OS FIPS policy via Group Policy / secpol.msc and reboot."],"exampleFix":"# before\nchoco install pkg   # fails: FIPS Mode detected\n\n# after\nchoco feature enable -n useFipsCompliantChecksums\nchoco install pkg","handlingStrategy":"validation","validationCode":"// Ensure the FIPS feature is enabled before running commands on FIPS machines.\nif (System.Security.Cryptography.CryptoConfig.AllowOnlyFipsAlgorithms)\n{\n    // run: choco feature enable -n useFipsCompliantChecksums\n    var cfg = System.Xml.Linq.XDocument.Load(chocoConfigPath);\n    // set <feature name=\"useFipsCompliantChecksums\" enabled=\"true\"/>\n}","typeGuard":null,"tryCatchPattern":"// In automation wrappers, catch the FIPS error and self-heal by enabling the feature.\ntry { RunChoco(\"install pkg\"); }\ncatch (ApplicationException ex) when (ex.Message.Contains(\"FIPS Mode\"))\n{\n    RunChoco(\"feature enable -n useFipsCompliantChecksums\");\n    RunChoco(\"install pkg\");\n}","preventionTips":["On FIPS-enforced machines, enable useFipsCompliantChecksums as part of provisioning before other choco commands.","Detect FIPS via System.Security.Cryptography.CryptoConfig.AllowOnlyFipsAlgorithms to gate behavior.","Document the FIPS feature requirement in deployment runbooks."],"tags":["fips","security","cryptography","checksums","compliance"],"backgroundTag":null,"analyzedSha":"0d5abdd10cc177a141e69547cad6935b419b6c17","analyzedAt":"2026-08-13T18:33:03.301Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}