Skip to content
代码片段 群组 项目
未验证 提交 e65e8a1b 编辑于 作者: Stan Hu's avatar Stan Hu
浏览文件

Fix Maven packages not working on FIPS kernels

On a FIPS kernel with a non-FIPS GitLab build, Maven package uploads
previously would fail with 422 Unprocessible Entity errors. This
occurred because Workhorse was generating an MD5 sum for the
accelerated upload, but the Rails API rejects any use of MD5 in FIPS
mode.

Workhorse was generating an MD5 sum because its on check for FIPS
involves more conditions:

1. The binary has been compiled with the `fips` build tag.
2. The platform is amd64 running on a Linux runtime.
3. The kernel has FIPS enabled (e.g. `/proc/sys/crypto/fips_enabled` is 1).
4. A system OpenSSL can be dynamically loaded via ldopen().

On a standard GitLab installation, 1 is not true, so Workhorse
believed it was working in a standard environment. However, GitLab
Rails only checks whether the OpenSSL library is FIPS-enabled.

To resolve this discrepancy, we now:

1. Pass `UploadHashFunctions` to indicate which hashes should be used
   in the Workhorse `/authorize` response.
2. Workhorse will use this list to determine which hashes to compute.
   If the list is empty, Workhorse will assume all hashes can be used.

Relates to https://gitlab.com/gitlab-org/gitlab/-/issues/380559

Changelog: fixed
上级 4e654a91
No related branches found
No related tags found
无相关合并请求
显示 200 个添加130 个删除
加载中
0% 加载中 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册