redis / redis/RedisInsight

[Bug]: RPM Digest Uses Too-Weak Algorithm (not installable via dnf on RHEL and derivatives)

Open
#5,950 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
8.8k
Forks
491
Avg merge
1d 22h
Merged PRs (30d)
49

Description

Preconditions (Any important steps we need to know)

Red Hat or related/derived Linux distros with FIPS enabled

Steps to reproduce (How to reproduce what you found step by step)

  1. Download latest installation RPM (currently 3.4.2)

  2. Attempt to use dnf utility to install:

    # dnf install /tmp/Redis-Insight-linux-x86_64.rpm
    
  3. Installation fails with transaction failure (as follows):

    
    Dependencies resolved.
    ====================================================================================================================================
     Package                           Architecture                Version                      Repository                         Size
    ====================================================================================================================================
    Installing:
     redisinsight                      x86_64                      3.4.2-1                      @commandline                       87 M
    
    Transaction Summary
    ====================================================================================================================================
    Install  1 Package
    
    Total size: 87 M
    Installed size: 361 M
    Is this ok [y/N]: y
    Downloading Packages:
    Running transaction check
    Transaction check succeeded.
    Running transaction test
    Transaction test succeeded.
    Running transaction
      Preparing        :                                                                                                            1/1
      Installing       : redisinsight-3.4.2-1.x86_64                                                                                1/1
    Error unpacking rpm package redisinsight-3.4.2-1.x86_64
      Verifying        : redisinsight-3.4.2-1.x86_64                                                                                1/1
    
    Failed:
      redisinsight-3.4.2-1.x86_64
    
    Error: Transaction failed
    
    
  4. Re-attempt install with --nogpgcheck flag added.

  5. Installation continues to fail

  6. Start debugging using rpm -ivh

    # rpm -ivh /tmp/Redis-Insight-linux-x86_64.rpm
    Verifying...                          ################################# [100%]
    Preparing...                          ################################# [100%]
    Updating / installing...
       1:redisinsight-3.4.2-1             ################################# [100%]
    error: unpacking of archive failed on file /opt/Redis Insight/LICENSE.electron.txt;6a0dd175: cpio: Digest mismatch
    error: redisinsight-3.4.2-1.x86_64: install failed
    
  7. Check the RPM's digest algorithm:

    # rpm -qp --qf '%{FILEDIGESTALGO}\n' /tmp/Redis-Insight-linux-x86_64.rpm
    (none)
    

    Should have returned an 8 — as it does for FIPS-compatible RPMs like the vendor's kernel RPM:

    $ rpm -qp --qf '%{FILEDIGESTALGO}\n' kernel-5.14.0-706.el9.x86_64.rpm
    8
    

Actual behavior (A short description of what you found)

dnf install <PATH_TO_RPM> fails as noted in the Steps to Reproduce section

Expected behavior (A short description of what you expected to find)

dnf install <PATH_TO_RPM> should succeed, especially with --nogpgcheck enabled

Screenshots (Paste or drag-and-drop a screenshot or a link to a recording)

Additional context (Operating system, version of Redis Insight, Redis database version, Redis module version, database type, connection type, logs, or any other information)

OS: RHEL 9.7 (x86)
Host/hardware: EC2
FIPS-mode: enabled
REDIS Insight Version: 3.4.2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the RPM artifact with the rpm -qp commands shown in the issue and then locate the release or packaging entry point that produces it. Reproduce the failure on RHEL 9.7 with FIPS enabled using dnf or rpm. Done means the generated RPM reports digest algorithm 8 and installs successfully, including with --nogpgcheck.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
build-system, release
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.