RPM signed with old hash, doesn't work in FIPS mode

[juburr]

It seems like many of the RPMs are signed with older digests like MD5 or SHA1? My team is reporting that it won't dnf install correctly on machines with FIPS enabled.

Workaround (unfortunately just ignore the digest):

• sudo rpm -ivh --nofiledigest ./timescaledb-toolkit-postgresql-15-1.18.0-0.x86_64.rpm

[zilder]

Hi @juburr,

Are you installing packages through repository or as individual rpm packages? The packages themselves don't contain signature, but the repository metadata should be gpg-signed. This is handled by packagecloud, not directly by us.
Or do you mean checksums?

rpm -Kv timescaledb-toolkit-postgresql-15-1.21.0-0.x86_64.rpm
timescaledb-toolkit-postgresql-15-1.21.0-0.x86_64.rpm:
    Header SHA256 digest: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: OK
    MD5 digest: OK

[juburr]

I'll reach out to that team & get back to you with details. I suspect they were dnf install'ing it via the packagecloud.io repo, but I can't say for sure.

[juburr]

I did some digging. Verification shows that the payload and header are OK, but the per-file digests are all MD5.

$ rpm -qp --qf 'FILEDIGESTALGO=%{FILEDIGESTALGO}\n' timescaledb-toolkit-postgresql-15-1.18.0-0.x86_64.rpm

FILEDIGESTALGO=(none)

It appears that (none) means the package doesn’t declare a digest algorithm. When FILEDIGESTALGO is missing, the rpm assumes MD5 (legacy behavior), which FIPS mode blocks.

$ rpm -qp --queryformat '[%{FILENAMES} %{FILEDIGESTS} %{FILEDIGESTALGO}\n]' timescaledb-toolkit-postgresql-15-1.18.0-0.x86_64.rpm
/usr/lib/.build-id  (none)
/usr/lib/.build-id/1d  (none)
/usr/lib/.build-id/1d/e0805b0c3b982fe7ef1661adfedb01786d77d6  (none)
/usr/pgsql-15/lib/timescaledb_toolkit-1.18.0.so 737ff101cdda3e3751061c1d3e782026 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.10.0-dev--1.18.0.sql 1f20a09a94d50e8e2b653634ffd295b7 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.10.1--1.18.0.sql 1f20a09a94d50e8e2b653634ffd295b7 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.11.0--1.18.0.sql ca6b93ea9cb89815737afb1b5d1122ce (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.12.0--1.18.0.sql bb3639f97e89005bed32be7021940414 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.12.1--1.18.0.sql bb3639f97e89005bed32be7021940414 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.13.0--1.18.0.sql bb3639f97e89005bed32be7021940414 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.13.1--1.18.0.sql bb3639f97e89005bed32be7021940414 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.14.0--1.18.0.sql 90638662552e572ec50ab7971a36d0d3 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.15.0--1.18.0.sql 0c2f51fa46aa186a7b289456523ceef7 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.16.0--1.18.0.sql c92e956be72030487ee12b06a1b5b7b6 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.17.0--1.18.0.sql c92e956be72030487ee12b06a1b5b7b6 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.18.0.sql 4fac88e158352349195d2350144f8398 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.6.0--1.18.0.sql 875634edb56a59365f9efb163cb5c256 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.7.0--1.18.0.sql 875634edb56a59365f9efb163cb5c256 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit--1.8.0--1.18.0.sql 875634edb56a59365f9efb163cb5c256 (none)
/usr/pgsql-15/share/extension/timescaledb_toolkit.control 4a0e3d5882490cac7d8161e9c9acbda7 (none)