From a26f6655546158153807017e7ded2aff5e4e10e4 Mon Sep 17 00:00:00 2001 From: Panu Matilainen Date: Mon, 31 Jan 2022 11:13:35 +0200 Subject: [PATCH] Bump hash for rpmdb cookie to SHA256 to appease FIPS The rpmdb cookie is not a security feature, but as these existing hashes are more convenient than coming up with our own... we then run into the great big wall of FIPS which in its current incarnation disallows use of SHA1. And so rpmdbCookie() fails under current FIPS. Just bumping the algorithm to SHA256 seems the path of lowest resistance, whether that algo makes sense for this purpose or not. --- lib/rpmdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rpmdb.c b/lib/rpmdb.c index 01d49a641..00bd4236f 100644 --- a/lib/rpmdb.c +++ b/lib/rpmdb.c @@ -2642,7 +2642,7 @@ char *rpmdbCookie(rpmdb db) rpmdbIndexIterator ii = rpmdbIndexIteratorInit(db, RPMDBI_NAME); if (ii) { - DIGEST_CTX ctx = rpmDigestInit(PGPHASHALGO_SHA1, RPMDIGEST_NONE); + DIGEST_CTX ctx = rpmDigestInit(PGPHASHALGO_SHA256, RPMDIGEST_NONE); const void *key = 0; size_t keylen = 0; while ((rpmdbIndexIteratorNext(ii, &key, &keylen)) == 0) { -- 2.34.1