{"record":{"id":"c833226b6e8b5e19","repo":"hashicorp/nomad","slug":"md5-checksums-are-not-supported-in-fips-140-mode","errorCode":null,"errorMessage":"md5 checksums are not supported in FIPS-140 mode","messagePattern":"md5 checksums are not supported in FIPS-140 mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":9988,"sourceCode":"\t}\n\n\t// A \"file:<url>\" checksum tells go-getter to read the checksum from a\n\t// remote file rather than supplying a hex digest inline, so there is no\n\t// digest to validate here; the getter resolves it at fetch time.\n\tif checksumType == \"file\" {\n\t\treturn nil\n\t}\n\n\tchecksumBytes, err := hex.DecodeString(checksumVal)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid checksum: %v\", err)\n\t}\n\n\texpectedLength := 0\n\tswitch checksumType {\n\tcase \"md5\":\n\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"md5 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = md5.Size\n\tcase \"sha1\":\n\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"sha1 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = sha1.Size\n\tcase \"sha256\":\n\t\texpectedLength = sha256.Size\n\tcase \"sha512\":\n\t\texpectedLength = sha512.Size\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported checksum type: %s\", checksumType)\n\t}\n\n\tif len(checksumBytes) != expectedLength {\n\t\treturn fmt.Errorf(\"invalid %s checksum: %v\", checksumType, checksumVal)\n\t}","sourceCodeStart":9970,"sourceCodeEnd":10006,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L9970-L10006","documentation":"Artifact checksum validation error: the checksum is declared as md5, but the Nomad agent runs in FIPS-140 mode, where MD5 is unavailable. The digest itself is fine; the algorithm is rejected by policy.","triggerScenarios":"Artifact block with checksum = \"md5:<hex>\" submitted to a Nomad cluster with FIPS-140 mode enabled (fips140.Enabled() true).","commonSituations":"Legacy build artifacts whose publishers only ship MD5 digests; migrating existing jobs onto a FIPS-hardened cluster; upstream projects that default to md5sum output.","solutions":["Switch the checksum to sha256 (or sha512): sha256sum file.","Obtain a SHA-2 digest from the artifact publisher.","Run on a non-FIPS cluster only if policy permits (generally not advisable)."],"exampleFix":"// before\nchecksum = \"md5:d41d8cd98f00b204e9800998ecf8427e\"\n// after\nchecksum = \"sha256:e3b0c44298fc1c149afbf4c8996fb924...\"","handlingStrategy":"validation","validationCode":"if fips140.Enabled() && strings.HasPrefix(checksum, \"md5:\") {\n    return errors.New(\"md5 not allowed in FIPS-140 mode; use sha256\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on sha256 for all artifact checksums","Document FIPS mode constraints for job authors","Reject md5/sha1 in CI job linting"],"tags":["nomad","checksum","fips","md5","compliance"],"backgroundTag":"fips-forbidden-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}