Jira (PUP-1840) Let user change hashing algorithm, to avoid crashing on FIPS-compliant hosts

[Joshua Cooper (JIRA)]

Title: Message Title

Joshua Cooper commented on an issue   Re: Let user change hashing algorithm, to avoid crashing on FIPS-compliant hosts Verified MD5 is not used for any certificate signing operation. CSR and certs signatures default to SHA256WithRSAEncryption, fall back to SHA1WithRSAEncryption, otherwise fail. CRLs default to SHA1, see PUP-2420. This change requires that the digest_algorithm=sha256 setting be applied globally. Filed PUP-2423. Once agent and master settings are modified, the agent can successfully backup files: In site.pp, create a filebucket resource, the path => false part is important: filebucket { 'main': path => false, } File { backup => 'main' } Notice: /Stage[main]/Main/File[/Users/josh/.puppet/puppet.conf]/content: content changed '{sha256}415e8d4611cefaffa4392d3cd282451b076c650fe7f56bb836d26b801b471be2' to '{sha256}84c3582c512959fc92ad3bde581f8ec58c34ebfc6f89fca4459cb670e90e2d9f' Verified that the puppet file application works: $ bundle exec puppet file download {sha256}415e8d4611cefaffa4392d3cd282451b076c650fe7f56bb836d26b801b471be2 --digest_algorithm sha256 [main] server = puppetmaster.solar.lan And the puppet filebucket application works also: $ bundle exec puppet filebucket get 415e8d4611cefaffa4392d3cd282451b076c650fe7f56bb836d26b801b471be2 --digest_algorithm=sha256 [main] server = puppetmaster.solar.lan Add Comment   Puppet / PUP-1840 Let user change hashing algorithm, to avoid crashing on FIPS-compliant hosts I'm using Puppet in part to ensure [Federal Information Processing Standard 140-2](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf) (FIPS 140-2) compliance on my network. Part of this compliance for the system underlying Puppet is to make sure that only [FIPS Approved](http://csrc.nist.gov/publications/fips/fips140-2/fips1402annexa.pdf) algo... This message was sent by Atlassian JIRA (v6.1.4#6159-sha1:44eaede) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at http://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.