Project

Profile

Help

Actions
Send by e-mail Copy link

Story #8246

closed

Task #7960: FIPS and support for ALLOWED_CONTENT_CHECKSUMS

As a user, I do not have md5 and sha1 in ALLOWED_CONTENT_CHECKSUMS by default

Added by bmbouter almost 4 years ago. Updated over 3 years ago.

Status:
CLOSED - CURRENTRELEASE
Priority:
Normal
Assignee:
bmbouter
Category:
-
Sprint/Milestone:
3.11.0
Start date:
Due date:
% Done:

100%

Estimated time:
Platform Release:
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Sprint 90
Quarter:

Description

Current State

Currently the ALLOWED_CONTENT_CHECKSUMS contains ["md5", "sha1", "sha224", "sha256", "sha384", "sha512"] in the settings file.

Also the CI adjusts this default to remove MD5 from this list, and there are tests which expect that MD5 to be disincluded.

Removing MD5 and SHA1

We want to make Pulp secure by default. MD5 is known to be insecure, and therefore it is unsafe for Pulp to allow its use for calculating package integrity by default. SHA-1 is widely believed to be insecure, or will be soon, and should not be allowed by default for the same reason.

Future State

  • MD5 and SHA1 will no longer be in ALLOWED_CONTENT_CHECKSUMS by default.
  • The CI will no longer set this setting as it is not required.
Actions
Send by e-mail Copy link

Also available in: Atom PDF