facebook / facebook/docusaurus

FIPS Compatibility Issue

Offen
#10,963 6 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
bug
Vorherrschende Sprache
TypeScript
Sterne
66.2k
Forks
10k
Ø Merge
1 T. 3 Std.
Gemergte PRs (30 T.)
52

Beschreibung

### Have you read the Contributing Guidelines on issues?

- [x] I have read the [Contributing Guidelines on issues](https://github.com/facebook/docusaurus/blob/main/CONTRIBUTING.md#issues).

### Prerequisites

- [x] I'm using the latest version of Docusaurus.
- [x] I have tried the `npm run clear` or `yarn clear` command.
- [x] I have tried `rm -rf node_modules yarn.lock package-lock.json` and re-installing packages.
- [x] I have tried creating a repro with https://new.docusaurus.io.
- [x] I have read the console error message carefully (if applicable).

### Description

I have a requirement to build my Docusaurus website in a FIPS compliant container. Currently it is not possible as Docusaurus [hardcodes the use of the md5 algorithm](https://github.com/facebook/docusaurus/blob/main/packages/docusaurus-utils/src/hashUtils.ts) .

Could it be possible to use another hashing algorithm that is [compliant to FIPS 140-2](https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexa.pdf) (or a customisable one) like sha256?

Are you only using md5 a hashing function or does it have some cryptographic use also?

I attempted to use [patch-package](https://www.npmjs.com/package/patch-package) to modify my node_modules & replace md5 with sha256 in the hashUtils module. This wasn't successful and resulted in further issues i was unable to debug.

### Reproducible demo

https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic

### Steps to reproduce

The repro uses a publicly available .FIPS image. If you have access to [Chainguard](https://images.chainguard.dev/directory/image/node-fips/overview) there are images available from them that could be substituted into the dockerfile FROM clause.

Clone the repro & navigate to the example.

`cd examples/classic`

Build the dockerfile

`docker build -t fips-repro --no-cache=true .`

### Expected behavior

I would like to think Docusaurus could be built in a FIPS compliant manner with either an applicable algorthim used or a customisable option to replace md5.

### Actual behavior

Attempting to build the site in the FIPS enabled container ends up with a long stacktrace.

```shell
/opt/app-root/src # npm run build

> docusaurus@0.0.0 build
> docusaurus build

[ERROR] Error: Docusaurus could not load module at path "/opt/app-root/src/docusaurus.config.js"
Cause: error:0308010C:digital envelope routines::unsupported
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:36:15)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1)
at async loadContext (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/site.js:39:97)
at async getLocalesToBuild (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:55:21)
at async Command.build (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:29:21)
at async Promise.all (index 0)
at async runCLI (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/cli.js:56:5)
at async file:///opt/app-root/src/node_modules/@docusaurus/core/bin/docusaurus.mjs:44:3 {
[cause]: Error: error:0308010C:digital envelope routines::unsupported
at new Hash (node:internal/crypto/hash:68:19)
at createHash (node:crypto:138:10)
at md5 (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:242165)
at opts.transform.Object.assign.Object.assign.Object.assign.legacy (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:246878)
at transform (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:247408)
at evalModule (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:250828)
at jiti (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:249841)
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:33:16)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1) {
opensslErrorStack: [
'error:03000086:digital envelope routines::initialization error'
],
library: 'digital envelope routines',
reason: 'unsupported',
code: 'ERR_OSSL_EVP_UNSUPPORTED'
}
}
[INFO] Docusaurus version: 3.7.0
Node version: v20.11.1
```

### Your environment

- Public source code: https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic
- Docusaurus version used: 3.7.0
- Environment name and version (e.g. Chrome 89, Node.js 16.4): Docker FIPS image, Node v20.11.1
- Operating system and version (e.g. Ubuntu 20.04.2 LTS): Ubuntu 20.x

### Self-service

- [ ] I'd be willing to fix this bug myself.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.