Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add FIPS support to CodeChecker #4308

Open
GunMetalBull305 opened this issue Aug 2, 2024 · 3 comments
Open

Add FIPS support to CodeChecker #4308

GunMetalBull305 opened this issue Aug 2, 2024 · 3 comments
Labels
dependencies 📦 Pull requests that update a dependency file dev env ⛑️ Development environment python Pull requests that update Python code (used by DependaBot) refactoring 😡 ➡️ 🙂 Refactoring code. usability 👍 Usability-related features

Comments

@GunMetalBull305
Copy link

GunMetalBull305 commented Aug 2, 2024

CodeChecker uses hashlib md5() in several areas. This causes problems on FIPS enabled systems, since MD5 is not supported in that mode.

The hashlib md5() signature was updated to include a workaround in Python 3.9. Implementing this workaround in CodeChecker should allow it to function on FIPS systems.

If changing how md5() is called is not feasible, then it may also be possible to use sha256(), which is FIPS compliant.

We are using CodeChecker for our CD/CI, which is transitioning to a FIPS platform. This will become a blocker for that process.

Update: Simply replacing 'md5' with 'sha256' seems to work, but I don't know if there are any unintended side effects.

@whisperity
Copy link
Member

The biggest issue I think is figuring out where hashes are stored and deciding whether existing hashes should be transitioned or we can accept duplicates.

There is a (likely outdated) pull request for the changing of md5() calls, but the signature it uses is only available since Py 3.9 and I'm not sure whether it's possible for us to set that as the lowest requirement just yet.

@whisperity
Copy link
Member

whisperity commented Aug 2, 2024

#3751

@GunMetalBull305
Copy link
Author

A quick check for using sha256 in place of md5 appears to work down to at least Python 3.6.8 (RHEL 8.9).

@whisperity whisperity added dev env ⛑️ Development environment usability 👍 Usability-related features refactoring 😡 ➡️ 🙂 Refactoring code. dependencies 📦 Pull requests that update a dependency file python Pull requests that update Python code (used by DependaBot) labels Aug 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies 📦 Pull requests that update a dependency file dev env ⛑️ Development environment python Pull requests that update Python code (used by DependaBot) refactoring 😡 ➡️ 🙂 Refactoring code. usability 👍 Usability-related features
Projects
None yet
Development

No branches or pull requests

2 participants