Task #7960: FIPS and support for ALLOWED_CONTENT_CHECKSUMS
As a user, I do not have md5 and sha1 in ALLOWED_CONTENT_CHECKSUMS by default
Also the CI adjusts this default to remove MD5 from this list, and there are tests which expect that MD5 to be disincluded.
Removing MD5 and SHA1¶
We want to make Pulp secure by default. MD5 is known to be insecure, and therefore it is unsafe for Pulp to allow its use for calculating package integrity by default. SHA-1 is widely believed to be insecure, or will be soon, and should not be allowed by default for the same reason.
- MD5 and SHA1 will no longer be in ALLOWED_CONTENT_CHECKSUMS by default.
- The CI will no longer set this setting as it is not required.
Removes md5 and sha1 from checksum defaults
The md5 and sha1 checksums are not considered secure and therefore should not be included as available hashers for Pulp to perform Artifact integrity checks with.
- Removes them from the default in settings
- Updates the
- Re-applies the plugin_tepmlate to no longer modify the set of allowed checksums in the CI environment.
Please register to edit this issue