hashicorp/nomad · error

sha1 checksums are not supported in FIPS-140 mode

Error message

sha1 checksums are not supported in FIPS-140 mode

What it means

Artifact checksum validation error: the checksum is declared as sha1, but the agent runs in FIPS-140 mode where SHA-1 is not permitted for this use. Only SHA-256/SHA-512 family algorithms pass in that mode.

Source

Thrown at nomad/structs/structs.go:9993

	if checksumType == "file" {
		return nil
	}

	checksumBytes, err := hex.DecodeString(checksumVal)
	if err != nil {
		return fmt.Errorf("invalid checksum: %v", err)
	}

	expectedLength := 0
	switch checksumType {
	case "md5":
		if fips140.Enabled() {
			return fmt.Errorf("md5 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = md5.Size
	case "sha1":
		if fips140.Enabled() {
			return fmt.Errorf("sha1 checksums are not supported in FIPS-140 mode")
		}
		expectedLength = sha1.Size
	case "sha256":
		expectedLength = sha256.Size
	case "sha512":
		expectedLength = sha512.Size
	default:
		return fmt.Errorf("unsupported checksum type: %s", checksumType)
	}

	if len(checksumBytes) != expectedLength {
		return fmt.Errorf("invalid %s checksum: %v", checksumType, checksumVal)
	}

	return nil
}

const (

View on GitHub (pinned to 482b49bf1a)

Solutions

1. Use sha256sum/sha512sum to produce the digest and declare it as sha256 or sha512.
2. Ask the artifact publisher for a SHA-2 digest.
3. Re-pin the artifact source to a version that ships SHA-2 checksums.

Example fix

// before
checksum = "sha1:2fd4e1c67a2d28fced849ee1bb76e7391b93eb12"
// after
checksum = "sha256:567d9b8f6b0c9d..."

if fips140.Enabled() && strings.HasPrefix(checksum, "sha1:") {
    return errors.New("sha1 not allowed in FIPS-140 mode; use sha256")
}

When it happens

Trigger: Artifact block with checksum = "sha1:<hex>" on a FIPS-140-enabled Nomad agent.

Common situations: Older release pipelines publishing sha1sums; git-commit-style identifiers mistakenly used as artifact checksums; legacy documentation examples.

Related errors

• md5 checksums are not supported in FIPS-140 mode
• x5t assertion headers use SHA-1, which is forbidden in FIPS-
• x5t assertion headers use SHA-1, which is forbidden in FIPS-
• %w; certificate-derived key header must be one of: %q, %q
• checksum value cannot be empty

AI-assisted analysis of hashicorp/nomad@482b49bf1a (2026-09-04). Data as JSON: /api/errors/f0fda9a23faaf6bf. Report an issue: GitHub.