{"record":{"id":"f0fda9a23faaf6bf","repo":"hashicorp/nomad","slug":"sha1-checksums-are-not-supported-in-fips-140-mode","errorCode":null,"errorMessage":"sha1 checksums are not supported in FIPS-140 mode","messagePattern":"sha1 checksums are not supported in FIPS-140 mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nomad/structs/structs.go","lineNumber":9993,"sourceCode":"\tif checksumType == \"file\" {\n\t\treturn nil\n\t}\n\n\tchecksumBytes, err := hex.DecodeString(checksumVal)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid checksum: %v\", err)\n\t}\n\n\texpectedLength := 0\n\tswitch checksumType {\n\tcase \"md5\":\n\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"md5 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = md5.Size\n\tcase \"sha1\":\n\t\tif fips140.Enabled() {\n\t\t\treturn fmt.Errorf(\"sha1 checksums are not supported in FIPS-140 mode\")\n\t\t}\n\t\texpectedLength = sha1.Size\n\tcase \"sha256\":\n\t\texpectedLength = sha256.Size\n\tcase \"sha512\":\n\t\texpectedLength = sha512.Size\n\tdefault:\n\t\treturn fmt.Errorf(\"unsupported checksum type: %s\", checksumType)\n\t}\n\n\tif len(checksumBytes) != expectedLength {\n\t\treturn fmt.Errorf(\"invalid %s checksum: %v\", checksumType, checksumVal)\n\t}\n\n\treturn nil\n}\n\nconst (","sourceCodeStart":9975,"sourceCodeEnd":10011,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/nomad/structs/structs.go#L9975-L10011","documentation":"Artifact checksum validation error: the checksum is declared as sha1, but the agent runs in FIPS-140 mode where SHA-1 is not permitted for this use. Only SHA-256/SHA-512 family algorithms pass in that mode.","triggerScenarios":"Artifact block with checksum = \"sha1:<hex>\" on a FIPS-140-enabled Nomad agent.","commonSituations":"Older release pipelines publishing sha1sums; git-commit-style identifiers mistakenly used as artifact checksums; legacy documentation examples.","solutions":["Use sha256sum/sha512sum to produce the digest and declare it as sha256 or sha512.","Ask the artifact publisher for a SHA-2 digest.","Re-pin the artifact source to a version that ships SHA-2 checksums."],"exampleFix":"// before\nchecksum = \"sha1:2fd4e1c67a2d28fced849ee1bb76e7391b93eb12\"\n// after\nchecksum = \"sha256:567d9b8f6b0c9d...\"","handlingStrategy":"validation","validationCode":"if fips140.Enabled() && strings.HasPrefix(checksum, \"sha1:\") {\n    return errors.New(\"sha1 not allowed in FIPS-140 mode; use sha256\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Migrate legacy sha1 digests to sha256 upstream","Flag sha1 usage in job linting","Coordinate with artifact publishers to ship SHA-2 sums"],"tags":["nomad","checksum","fips","sha1","compliance"],"backgroundTag":"fips-forbidden-algorithm","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}