pulp / pulp/pulp-operator

Can't enable sha224 with sha1

Open
#1,390 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue
Dominant language
Go
Stars
88
Forks
66
Avg merge
53m
Merged PRs (30d)
1

Description

Version
pulp-operator:v1.0.0-beta.4
pulp-operator:v1.0.0-beta.5

Describe the bug
I'm creating rpm repositiries for rhel9 and rhel7.
I successfully uploaded rhel9 repos.

Then, I tried to upload rhel7 repo which is required to add sha1 shecksum in pulp CR which I've done as follow:

spec:
  allowed_content_checksums:
  - sha1

After that I found that some already uploaded artifacts with sha224 were removing, so I stopped pulp-rpm-update-content-checksums pod.
I added sha224 and other to allowed_content_checksums like:

spec:
  allowed_content_checksums:
  - sha224
  - sha256
  - sha512
  - sha1
  - sha384

But handle-artifact-checksums job was not started.
I've got error in pulp-operator-controller-manager logs:

2025-01-15T13:39:44Z	INFO	controller/controller.go:217	Starting workers	{"controller": "pulprestore", "controllerGroup": "repo-manager.pulpproject.org", "controllerKind": "PulpRestore", "worker count": 1}
2025-01-15T13:39:44Z	WARN	repo_manager/precheck.go:276	Checksum sha1 is deprecated by some Pulp plugins, it is not recommended using it in production.
2025-01-15T13:39:44Z	ERROR	repo_manager/precheck.go:271	Checksum sha224 is not valid!
github.com/pulp/pulp-operator/controllers/repo_manager.checkAllowedContentChecksums
	/workspace/controllers/repo_manager/precheck.go:271
github.com/pulp/pulp-operator/controllers/repo_manager.prechecks
	/workspace/controllers/repo_manager/precheck.go:80
github.com/pulp/pulp-operator/controllers/repo_manager.(*RepoManagerReconciler).Reconcile
	/workspace/controllers/repo_manager/controller.go:100
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:116
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:303
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:263
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.3/pkg/internal/controller/controller.go:224

I can return sha224 with removing allowed_content_checksums from pulp CR, and artifacts will be restored. But how I can activate sha1 and sha224?

I see related conversation in https://github.com/pulp/pulp-operator/issues/1060, but I can't found answer to question above.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with controllers/repo_manager/precheck.go around checkAllowedContentChecksums at line 271, then review the related discussion in issue #1060. Reproduce the checksum configuration with both sha1 and sha224 enabled and trace why validation rejects sha224. Done means the CR accepts both checksums and reconciliation starts the checksum-handling job without removing existing artifacts.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.