hashicorp/nomad · error

md5 checksums are not supported in FIPS-140 mode

Error message

md5 checksums are not supported in FIPS-140 mode

What it means

Artifact checksum validation error: the checksum is declared as md5, but the Nomad agent runs in FIPS-140 mode, where MD5 is unavailable. The digest itself is fine; the algorithm is rejected by policy.

Source

Thrown at nomad/structs/structs.go:9988

	}

	// A "file:<url>" checksum tells go-getter to read the checksum from a
	// remote file rather than supplying a hex digest inline, so there is no
	// digest to validate here; the getter resolves it at fetch time.
	if checksumType == "file" {
		return nil
	}

	checksumBytes, err := hex.DecodeString(checksumVal)
	if err != nil {
		return fmt.Errorf("invalid checksum: %v", err)
	}

	expectedLength := 0
	switch checksumType {
	case "md5":
		if fips140.Enabled() {
			return fmt.Errorf("md5 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = md5.Size
	case "sha1":
		if fips140.Enabled() {
			return fmt.Errorf("sha1 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = sha1.Size
	case "sha256":
		expectedLength = sha256.Size
	case "sha512":
		expectedLength = sha512.Size
	default:
		return fmt.Errorf("unsupported checksum type: %s", checksumType)
	}

	if len(checksumBytes) != expectedLength {
		return fmt.Errorf("invalid %s checksum: %v", checksumType, checksumVal)
	}

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Switch the checksum to sha256 (or sha512): sha256sum file.
2. Obtain a SHA-2 digest from the artifact publisher.
3. Run on a non-FIPS cluster only if policy permits (generally not advisable).

Example fix

// before
checksum = "md5:d41d8cd98f00b204e9800998ecf8427e"
// after
checksum = "sha256:e3b0c44298fc1c149afbf4c8996fb924..."

if fips140.Enabled() && strings.HasPrefix(checksum, "md5:") {
    return errors.New("md5 not allowed in FIPS-140 mode; use sha256")
}

When it happens

Trigger: Artifact block with checksum = "md5:<hex>" submitted to a Nomad cluster with FIPS-140 mode enabled (fips140.Enabled() true).

Common situations: Legacy build artifacts whose publishers only ship MD5 digests; migrating existing jobs onto a FIPS-hardened cluster; upstream projects that default to md5sum output.

Related errors

• sha1 checksums are not supported in FIPS-140 mode
• x5t assertion headers use SHA-1, which is forbidden in FIPS-
• %w; certificate-derived key header must be one of: %q, %q
• checksum value cannot be empty
• checksum must be given as "type:value"; got %q

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/c833226b6e8b5e19. Report an issue: GitHub.