[Bug]: RPM Digest Uses Too-Weak Algorithm (not installable via dnf on RHEL and derivatives)
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 8.8k
- Forks
- 491
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 49
Description
Preconditions (Any important steps we need to know)
Red Hat or related/derived Linux distros with FIPS enabled
Steps to reproduce (How to reproduce what you found step by step)
-
Download latest installation RPM (currently 3.4.2)
-
Attempt to use
dnfutility to install:# dnf install /tmp/Redis-Insight-linux-x86_64.rpm -
Installation fails with transaction failure (as follows):
Dependencies resolved. ==================================================================================================================================== Package Architecture Version Repository Size ==================================================================================================================================== Installing: redisinsight x86_64 3.4.2-1 @commandline 87 M Transaction Summary ==================================================================================================================================== Install 1 Package Total size: 87 M Installed size: 361 M Is this ok [y/N]: y Downloading Packages: Running transaction check Transaction check succeeded. Running transaction test Transaction test succeeded. Running transaction Preparing : 1/1 Installing : redisinsight-3.4.2-1.x86_64 1/1 Error unpacking rpm package redisinsight-3.4.2-1.x86_64 Verifying : redisinsight-3.4.2-1.x86_64 1/1 Failed: redisinsight-3.4.2-1.x86_64 Error: Transaction failed -
Re-attempt install with
--nogpgcheckflag added. -
Installation continues to fail
-
Start debugging using
rpm -ivh# rpm -ivh /tmp/Redis-Insight-linux-x86_64.rpm Verifying... ################################# [100%] Preparing... ################################# [100%] Updating / installing... 1:redisinsight-3.4.2-1 ################################# [100%] error: unpacking of archive failed on file /opt/Redis Insight/LICENSE.electron.txt;6a0dd175: cpio: Digest mismatch error: redisinsight-3.4.2-1.x86_64: install failed -
Check the RPM's digest algorithm:
# rpm -qp --qf '%{FILEDIGESTALGO}\n' /tmp/Redis-Insight-linux-x86_64.rpm (none)Should have returned an
8— as it does for FIPS-compatible RPMs like the vendor's kernel RPM:$ rpm -qp --qf '%{FILEDIGESTALGO}\n' kernel-5.14.0-706.el9.x86_64.rpm 8
Actual behavior (A short description of what you found)
dnf install <PATH_TO_RPM> fails as noted in the Steps to Reproduce section
Expected behavior (A short description of what you expected to find)
dnf install <PATH_TO_RPM> should succeed, especially with --nogpgcheck enabled
Screenshots (Paste or drag-and-drop a screenshot or a link to a recording)
Additional context (Operating system, version of Redis Insight, Redis database version, Redis module version, database type, connection type, logs, or any other information)
OS: RHEL 9.7 (x86)
Host/hardware: EC2
FIPS-mode: enabled
REDIS Insight Version: 3.4.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the RPM artifact with the rpm -qp commands shown in the issue and then locate the release or packaging entry point that produces it. Reproduce the failure on RHEL 9.7 with FIPS enabled using dnf or rpm. Done means the generated RPM reports digest algorithm 8 and installs successfully, including with --nogpgcheck.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- build-system, release
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100