facebook / facebook/docusaurus
FIPS Compatibility Issue
- Ngôn ngữ chính
- TypeScript
- Star
- 66.2k
- Fork
- 10k
- Merge trung bình
- 1 ngày 3 giờ
- Pull request đã merge (30 ngày)
- 52
Mô tả
### Have you read the Contributing Guidelines on issues?
- [x] I have read the [Contributing Guidelines on issues](https://github.com/facebook/docusaurus/blob/main/CONTRIBUTING.md#issues).
### Prerequisites
- [x] I'm using the latest version of Docusaurus.
- [x] I have tried the `npm run clear` or `yarn clear` command.
- [x] I have tried `rm -rf node_modules yarn.lock package-lock.json` and re-installing packages.
- [x] I have tried creating a repro with https://new.docusaurus.io.
- [x] I have read the console error message carefully (if applicable).
### Description
I have a requirement to build my Docusaurus website in a FIPS compliant container. Currently it is not possible as Docusaurus [hardcodes the use of the md5 algorithm](https://github.com/facebook/docusaurus/blob/main/packages/docusaurus-utils/src/hashUtils.ts) .
Could it be possible to use another hashing algorithm that is [compliant to FIPS 140-2](https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexa.pdf) (or a customisable one) like sha256?
Are you only using md5 a hashing function or does it have some cryptographic use also?
I attempted to use [patch-package](https://www.npmjs.com/package/patch-package) to modify my node_modules & replace md5 with sha256 in the hashUtils module. This wasn't successful and resulted in further issues i was unable to debug.
### Reproducible demo
https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic
### Steps to reproduce
The repro uses a publicly available .FIPS image. If you have access to [Chainguard](https://images.chainguard.dev/directory/image/node-fips/overview) there are images available from them that could be substituted into the dockerfile FROM clause.
Clone the repro & navigate to the example.
`cd examples/classic`
Build the dockerfile
`docker build -t fips-repro --no-cache=true .`
### Expected behavior
I would like to think Docusaurus could be built in a FIPS compliant manner with either an applicable algorthim used or a customisable option to replace md5.
### Actual behavior
Attempting to build the site in the FIPS enabled container ends up with a long stacktrace.
```shell
/opt/app-root/src # npm run build
> docusaurus@0.0.0 build
> docusaurus build
[ERROR] Error: Docusaurus could not load module at path "/opt/app-root/src/docusaurus.config.js"
Cause: error:0308010C:digital envelope routines::unsupported
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:36:15)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1)
at async loadContext (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/site.js:39:97)
at async getLocalesToBuild (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:55:21)
at async Command.build (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:29:21)
at async Promise.all (index 0)
at async runCLI (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/cli.js:56:5)
at async file:///opt/app-root/src/node_modules/@docusaurus/core/bin/docusaurus.mjs:44:3 {
[cause]: Error: error:0308010C:digital envelope routines::unsupported
at new Hash (node:internal/crypto/hash:68:19)
at createHash (node:crypto:138:10)
at md5 (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:242165)
at opts.transform.Object.assign.Object.assign.Object.assign.legacy (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:246878)
at transform (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:247408)
at evalModule (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:250828)
at jiti (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:249841)
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:33:16)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1) {
opensslErrorStack: [
'error:03000086:digital envelope routines::initialization error'
],
library: 'digital envelope routines',
reason: 'unsupported',
code: 'ERR_OSSL_EVP_UNSUPPORTED'
}
}
[INFO] Docusaurus version: 3.7.0
Node version: v20.11.1
```
### Your environment
- Public source code: https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic
- Docusaurus version used: 3.7.0
- Environment name and version (e.g. Chrome 89, Node.js 16.4): Docker FIPS image, Node v20.11.1
- Operating system and version (e.g. Ubuntu 20.04.2 LTS): Ubuntu 20.x
### Self-service
- [ ] I'd be willing to fix this bug myself.
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.