facebook / facebook/docusaurus

FIPS Compatibility Issue

Đang mở
#10,963 6 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
TypeScript
Star
66.2k
Fork
10k
Merge trung bình
1 ngày 3 giờ
Pull request đã merge (30 ngày)
52

Mô tả

### Have you read the Contributing Guidelines on issues?

- [x] I have read the [Contributing Guidelines on issues](https://github.com/facebook/docusaurus/blob/main/CONTRIBUTING.md#issues).

### Prerequisites

- [x] I'm using the latest version of Docusaurus.
- [x] I have tried the `npm run clear` or `yarn clear` command.
- [x] I have tried `rm -rf node_modules yarn.lock package-lock.json` and re-installing packages.
- [x] I have tried creating a repro with https://new.docusaurus.io.
- [x] I have read the console error message carefully (if applicable).

### Description

I have a requirement to build my Docusaurus website in a FIPS compliant container. Currently it is not possible as Docusaurus [hardcodes the use of the md5 algorithm](https://github.com/facebook/docusaurus/blob/main/packages/docusaurus-utils/src/hashUtils.ts) .

Could it be possible to use another hashing algorithm that is [compliant to FIPS 140-2](https://csrc.nist.gov/files/pubs/fips/140-2/upd2/final/docs/fips1402annexa.pdf) (or a customisable one) like sha256?

Are you only using md5 a hashing function or does it have some cryptographic use also?

I attempted to use [patch-package](https://www.npmjs.com/package/patch-package) to modify my node_modules & replace md5 with sha256 in the hashUtils module. This wasn't successful and resulted in further issues i was unable to debug.

### Reproducible demo

https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic

### Steps to reproduce

The repro uses a publicly available .FIPS image. If you have access to [Chainguard](https://images.chainguard.dev/directory/image/node-fips/overview) there are images available from them that could be substituted into the dockerfile FROM clause.

Clone the repro & navigate to the example.

`cd examples/classic`

Build the dockerfile

`docker build -t fips-repro --no-cache=true .`

### Expected behavior

I would like to think Docusaurus could be built in a FIPS compliant manner with either an applicable algorthim used or a customisable option to replace md5.

### Actual behavior

Attempting to build the site in the FIPS enabled container ends up with a long stacktrace.

```shell
/opt/app-root/src # npm run build

> docusaurus@0.0.0 build
> docusaurus build

[ERROR] Error: Docusaurus could not load module at path "/opt/app-root/src/docusaurus.config.js"
Cause: error:0308010C:digital envelope routines::unsupported
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:36:15)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1)
at async loadContext (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/site.js:39:97)
at async getLocalesToBuild (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:55:21)
at async Command.build (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/build/build.js:29:21)
at async Promise.all (index 0)
at async runCLI (/opt/app-root/src/node_modules/@docusaurus/core/lib/commands/cli.js:56:5)
at async file:///opt/app-root/src/node_modules/@docusaurus/core/bin/docusaurus.mjs:44:3 {
[cause]: Error: error:0308010C:digital envelope routines::unsupported
at new Hash (node:internal/crypto/hash:68:19)
at createHash (node:crypto:138:10)
at md5 (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:242165)
at opts.transform.Object.assign.Object.assign.Object.assign.legacy (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:246878)
at transform (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:247408)
at evalModule (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:250828)
at jiti (/opt/app-root/src/node_modules/jiti/dist/jiti.js:1:249841)
at loadFreshModule (/opt/app-root/src/node_modules/@docusaurus/utils/lib/moduleUtils.js:33:16)
at loadSiteConfig (/opt/app-root/src/node_modules/@docusaurus/core/lib/server/config.js:36:62)
at async Promise.all (index 1) {
opensslErrorStack: [
'error:03000086:digital envelope routines::initialization error'
],
library: 'digital envelope routines',
reason: 'unsupported',
code: 'ERR_OSSL_EVP_UNSUPPORTED'
}
}
[INFO] Docusaurus version: 3.7.0
Node version: v20.11.1
```

### Your environment

- Public source code: https://github.com/bendudz/docusaurus/tree/fips-repro/examples/classic
- Docusaurus version used: 3.7.0
- Environment name and version (e.g. Chrome 89, Node.js 16.4): Docker FIPS image, Node v20.11.1
- Operating system and version (e.g. Ubuntu 20.04.2 LTS): Ubuntu 20.x

### Self-service

- [ ] I'd be willing to fix this bug myself.

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.