chocolatey/choco · error · ApplicationException

When FIPS Mode is enabled, Chocolatey requires {0} feature a

Error message

When FIPS Mode is enabled, Chocolatey requires {0} feature also be enabled.

What it means

When the OS is in FIPS mode, the .NET MD5 provider throws when Chocolatey tries to set MD5 as its hash algorithm (FIPS disallows non-compliant algorithms). SetHashProvider catches that, and if the 'useFipsCompliantChecksums' feature is NOT enabled, it throws this ApplicationException requiring that feature to also be on. Chocolatey uses MD5 checksums by default; FIPS mode blocks them, so the feature flag is mandatory in such environments.

Source

Thrown at src/chocolatey/infrastructure.app/builders/ConfigurationBuilder.cs:646

                }
                catch (Exception ex)
                {
                    if (!config.CommandName.IsEqualTo("feature"))
                    {
                        if (ex.InnerException != null && ex.InnerException.Message.ContainsSafe("FIPS"))
                        {
                            "chocolatey".Log().Warn(ChocolateyLoggers.Important, @"
FIPS Mode detected - run 'choco feature enable -n {0}'
 to use Chocolatey.".FormatWith(ApplicationParameters.Features.UseFipsCompliantChecksums));

                            var errorMessage = "When FIPS Mode is enabled, Chocolatey requires {0} feature also be enabled.".FormatWith(ApplicationParameters.Features.UseFipsCompliantChecksums);
                            if (string.IsNullOrWhiteSpace(config.CommandName))
                            {
                                "chocolatey".Log().Error(errorMessage);
                                return;
                            }

                            throw new ApplicationException(errorMessage);
                        }

                        throw;
                    }
                }
            }
        }

#pragma warning disable IDE0022, IDE1006
        [Obsolete("This overload is deprecated and will be removed in v3.")]
        [EditorBrowsable(EditorBrowsableState.Never)]
        public static void initialize_with(Lazy<IEnvironment> environment)
            => InitializeWith(environment);

        [Obsolete("This overload is deprecated and will be removed in v3.")]
        public static bool is_compatibility_checks_disabled(IFileSystem filesystem, IXmlService xmlService)
            => AreCompatibilityChecksDisabled(filesystem, xmlService);

View on GitHub (pinned to 0d5abdd10c)

Solutions

Run 'choco feature enable -n useFipsCompliantChecksums' before other operations.
In config files (chocolatey.config) set <feature name="useFipsCompliantChecksums" enabled="true"/>.
If FIPS is not actually required, disable OS FIPS policy via Group Policy / secpol.msc and reboot.

Example fix

# before
choco install pkg   # fails: FIPS Mode detected

# after
choco feature enable -n useFipsCompliantChecksums
choco install pkg

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the FIPS feature is enabled before running commands on FIPS machines.
if (System.Security.Cryptography.CryptoConfig.AllowOnlyFipsAlgorithms)
{
    // run: choco feature enable -n useFipsCompliantChecksums
    var cfg = System.Xml.Linq.XDocument.Load(chocoConfigPath);
    // set <feature name="useFipsCompliantChecksums" enabled="true"/>
}

Try / catch

// In automation wrappers, catch the FIPS error and self-heal by enabling the feature.
try { RunChoco("install pkg"); }
catch (ApplicationException ex) when (ex.Message.Contains("FIPS Mode"))
{
    RunChoco("feature enable -n useFipsCompliantChecksums");
    RunChoco("install pkg");
}

Prevention

On FIPS-enforced machines, enable useFipsCompliantChecksums as part of provisioning before other choco commands.
Detect FIPS via System.Security.Cryptography.CryptoConfig.AllowOnlyFipsAlgorithms to gate behavior.
Document the FIPS feature requirement in deployment runbooks.

When it happens

Trigger: FIPS security policy enabled on the machine (Group Policy 'System cryptography: Use FIPS compliant algorithms') AND the 'useFipsCompliantChecksums' Chocolatey feature is disabled, while running a command (config.CommandName is set) that needs hashing. If CommandName is empty it only logs the error and returns.

Common situations: Government/regulated/enterprise machines with FIPS enforced via GPO; disabling the feature after it was auto-enabled; new deployments onto FIPS-locked servers without first enabling the feature.

Related errors

AI-assisted analysis of chocolatey/choco@0d5abdd10c (2026-08-13). Data as JSON: /api/errors/7c53b8404a60c735. Report an issue: GitHub.