Chalice Does Not Work With FIPS Enabled
- Dominant language
- Python
- Stars
- 11.1k
- Forks
- 1k
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 2
Description
Hello!
First off, thank you for this excellent library. We have used it for several years on my project.
We are currently migrating from the public AWS cloud into a private AWS cloud. As a part of this migration, our build servers are moving from vanilla Ubuntu to RHEL 7 with [FIPS](https://en.wikipedia.org/wiki/Federal_Information_Processing_Standards) enabled.
As a result deployments break with this this error (full stack trace omitted for brevity):
```
/webportal/lambda/.venv/lib64/python3.6/site-packages/chalice/deploy/packager.py", line 179, in _hash_project_dir
h = hashlib.md5(contents)
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
```
FIPS disallows the use of md5 in ALL contexts as md5 is an insecure cryptographic algorithm.
The way md5 is currently being used in chalice is perfectly fine as chalice is not actually using the md5 algorithm for encryption. There is a workaround in Python distros on RHEL 7 for use cases like this:
`hashlib.md5(usedforsecurity=False)`
Would it be possible to add support for this? Either by detecting whether or not FIPS is enabled or allowing an argument to be passed in?
Contributor guide
Research direction
Start in chalice/deploy/packager.py at _hash_project_dir and inspect how hashlib.md5 is used while packaging deployments. Reproduce the failure on RHEL 7 with FIPS enabled, then verify that deployment packaging succeeds there while continuing to work in non-FIPS environments.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100