puppetlabs/puppet · error · ArgumentError

MD5 is not supported in FIPS mode

Error message

MD5 is not supported in FIPS mode

What it means

The file type's checksum property validates its values; when Puppet::Util::Platform.fips_enabled? is true, `md5` and `md5lite` raise ArgumentError 'MD5 is not supported in FIPS mode' because FIPS-mode OpenSSL refuses MD5 digests.

Source

Thrown at lib/puppet/type/file/checksum.rb:24

# files.
Puppet::Type.type(:file).newparam(:checksum) do
  include Puppet::Util::Checksums

  # The default is defined in Puppet.default_digest_algorithm
  desc "The checksum type to use when determining whether to replace a file's contents.

    The default checksum type is sha256."

  # The values are defined in Puppet::Util::Checksums.known_checksum_types
  newvalues(:sha256, :sha256lite, :md5, :md5lite, :sha1, :sha1lite, :sha512, :sha384, :sha224, :mtime, :ctime, :none)

  defaultto do
    Puppet[:digest_algorithm].to_sym
  end

  validate do |value|
    if Puppet::Util::Platform.fips_enabled? && (value == :md5 || value == :md5lite)
      raise ArgumentError, _("MD5 is not supported in FIPS mode")
    end
  end

  def sum(content)
    content = content.is_a?(Puppet::Pops::Types::PBinaryType::Binary) ? content.binary_buffer : content
    type = digest_algorithm
    "{#{type}}" + send(type, content)
  end

  def sum_file(path)
    type = digest_algorithm
    method = type.to_s + "_file"
    "{#{type}}" + send(method, path).to_s
  end

  def sum_stream(&block)
    type = digest_algorithm
    method = type.to_s + "_stream"

View on GitHub (pinned to e227c27540)

Solutions

1. Change the resource: `checksum => sha256` (or drop the checksum line).
2. Set the global default in puppet.conf: `[main] digest_algorithm = sha256`.
3. Patch or upgrade modules that hardcode md5/md5lite — many have upstream FIPS fixes.
4. Confirm FIPS state while debugging: `cat /proc/sys/crypto/fips_enabled`.

Example fix

// before
file { '/etc/app.conf':
  ensure   => file,
  checksum => md5,
}

// after
file { '/etc/app.conf':
  ensure   => file,
  checksum => sha256,
}

// Puppet: fail fast at compile time on FIPS nodes
if $facts['fips_enabled'] and $checksum in ['md5', 'md5lite'] {
  fail('md5 checksums are unavailable under FIPS — use sha256')
}

def fips_safe_checksum?(value)
  !(Puppet::Util::Platform.fips_enabled? && %w[md5 md5lite].include?(value.to_s))
end

rescue ArgumentError and rewrite the resource's checksum to sha256; md5 can never work on a FIPS node, so there is no retry path — remediation is a config change, then re-run the agent.

When it happens

Trigger: `file { '/x': ensure => file, checksum => md5 }` on a node booted with fips=1; `digest_algorithm = md5` in puppet.conf making md5 the default for every file resource; third-party modules hardcoding checksum => md5lite; manifests copied from non-FIPS environments.

Common situations: Government/regulated environments enabling the kernel fips flag; RHEL fips=1 nodes; older modules predating Puppet's sha256 default; compliance hardening that flips FIPS on after manifests were written.

Related errors

• Unsupported checksum type %{checksum_type}
• Unable to verify existing FileBucket backup at '%{path}'.
• Invalid value '%{value}' for parameter %{name}. Allowed valu
• File not found
• Downloaded release for %{name} did not match expected checks

AI-assisted analysis of puppetlabs/puppet@e227c27540 (2026-08-21). Data as JSON: /api/errors/641aba0f4a2b7404. Report an issue: GitHub.