facebook / facebook/docusaurus

FIPS Compatibility Issue

Abierto
#10,963 6 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
TypeScript
Estrellas
66.2k
Forks
10k
Merge medio
1 d 3 h
PR fusionados (30 d)
52

Descripción

### Have you read the Contributing Guidelines on issues?

- [x] I have read the [Contributing Guidelines on issues](https://github.com/facebook/docusaurus/blob/main/CONTRIBUTING.md#issues).

### Prerequisites

- [x] I'm using the latest version of Docusaurus.
- [x] I have tried the `npm run clear` or `yarn clear` command.
- [x] I have tried `rm -rf node_modules yarn.lock package-lock.json` and re-installing packages.
- [x] I have tried creating a repro with https://new.docusaurus.io.
- [x] I have read the console error message carefully (if applicable).

### Description

I have a requirement to build my Docusaurus website in a FIPS compliant container. Currently it is not possible as Docusaurus [hardcodes the use of the md5 algorithm](https://github.com/facebook/docusaurus/blob/main/packages/docusaurus-utils/src/hashUtils.ts) .

Could it be possible to use another hashing algorithm that is [compliant to FIPS 140-2](https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexa.pdf) (or a customisable one) like sha256?

Are you only using md5 a hashing function or does it have some cryptographic use also?

I attempted to use [patch-package](https://www.npmjs.com/package/patch-package) to modify my node_modules & replace md5 with sha256 in the hashUtils module. This wasn't successful and resulted in further issues i was unable to debug.

### Reproducible demo

https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic

### Steps to reproduce

The repro uses a publicly available .FIPS image. If you have access to [Chainguard](https://images.chainguard.dev/directory/image/node-fips/overview) there are images available from them that could be substituted into the dockerfile FROM clause.

Clone the repro & navigate to the example.

`cd examples/classic`

Build the dockerfile

`docker build -t fips-repro --no-cache=true .`

### Expected behavior

I would like to think Docusaurus could be built in a FIPS compliant manner with either an applicable algorthim used or a customisable option to replace md5.

### Actual behavior

Attempting to build the site in the FIPS enabled container ends up with a long stacktrace.

```shell
/opt/app-root/src # npm run build

> docusaurus@0.0.0 build
> docusaurus build

[ERROR] Error: Docusaurus could not load module at path "/opt/app-root/src/docusaurus.config.js"
Cause: error:0308010C:digital envelope routines::unsupported
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:36:15)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1)
at async loadContext (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/site.js:39:97)
at async getLocalesToBuild (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:55:21)
at async Command.build (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:29:21)
at async Promise.all (index 0)
at async runCLI (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/cli.js:56:5)
at async file:///opt/app-root/src/node_modules/@docusaurus/core/bin/docusaurus.mjs:44:3 {
[cause]: Error: error:0308010C:digital envelope routines::unsupported
at new Hash (node:internal/crypto/hash:68:19)
at createHash (node:crypto:138:10)
at md5 (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:242165)
at opts.transform.Object.assign.Object.assign.Object.assign.legacy (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:246878)
at transform (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:247408)
at evalModule (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:250828)
at jiti (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:249841)
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:33:16)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1) {
opensslErrorStack: [
'error:03000086:digital envelope routines::initialization error'
],
library: 'digital envelope routines',
reason: 'unsupported',
code: 'ERR_OSSL_EVP_UNSUPPORTED'
}
}
[INFO] Docusaurus version: 3.7.0
Node version: v20.11.1
```

### Your environment

- Public source code: https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic
- Docusaurus version used: 3.7.0
- Environment name and version (e.g. Chrome 89, Node.js 16.4): Docker FIPS image, Node v20.11.1
- Operating system and version (e.g. Ubuntu 20.04.2 LTS): Ubuntu 20.x

### Self-service

- [ ] I'd be willing to fix this bug myself.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.