Story #8258: As an installer user, I don't have special FIPS detection - Pulp

Actions

Send by e-mail Copy link

Story #8258

closed

Task #7960: FIPS and support for ALLOWED_CONTENT_CHECKSUMS

As an installer user, I don't have special FIPS detection

Added by bmbouter almost 4 years ago. Updated almost 4 years ago.

Status:

CLOSED - CURRENTRELEASE

Priority:

Normal

Assignee:

gerrod

Category:

Installer - Moved to GitHub issues

Sprint/Milestone:

3.11.0

Start date:

Due date:

% Done:

100%

Estimated time:

Platform Release:

Groomed:

Sprint Candidate:

Tags:

Sprint:

Sprint 92

Quarter:

Description

Motivation¶

The installer's FIPS features are described here. This is problematic in a few ways.

Pulp is on the hook to rebase the django-forked-and-patched everytime upstream Django puts out a CVE release. This puts Pulp on the critical path for CVE releases, which is not a good arrangement.
Users are using bits in production that aren't available on PyPI. This is unusual
The installer adjusts the value for ALLOWED_CONTENT_CHECKSUMS instead of letting pulpcore's default prevail. With 3.11 md5 and sha-1 are being removed, so the installer should no longer adjust this.

Solution¶

Remove the FIPS docs page.
Remove the installer codepaths related to FIPS
No longer install the branched checkout https://github.com/mdellweg/django/tree/fips and instead receive Django from PyPI as usual.
Provide some documented instructions for dev environments on the django and pulpcore patches they need to apply for dev environments (since the installer will no longer do this). (Consider putting into pulp_devel role, or depending on vars like pulp_source_dir.)

Related issues

Actions

Copy link

Updated by bmbouter almost 4 years ago

Description updated (diff)

Actions

Copy link

Updated by bmbouter almost 4 years ago

Tracker changed from Issue to Story
Category set to Installer - Moved to GitHub issues
% Done set to 0
Severity deleted (~~2. Medium~~)
Triaged deleted (No)

Actions

Copy link

Updated by ggainey almost 4 years ago

Suggestion from 19-FEB FIPS checkin: arrange to apply the pulpcore md5-is-useful-sometimes patch, only in the CI/test environment/role

Actions

Copy link

Updated by ggainey almost 4 years ago

Suggestion: dev-role (only) delivers branched/patched django

Actions

Copy link

Updated by mdepaulo@redhat.com almost 4 years ago

Description updated (diff)

Actions

Copy link

Updated by ipanova@redhat.com almost 4 years ago

Sprint/Milestone set to 3.11.0

Actions

Copy link

Updated by daviddavis almost 4 years ago

I think we could run these commands in the dev and test environments to patch django:

django_location=$(pip show django | grep Location | cut -d' ' -f2)
sed -i 's/hashlib.md5()/hashlib.md5(usedforsecurity=False)/' "$django_location/django/db/backends/utils.py"

Actions

Copy link

Updated by bmbouter almost 4 years ago

daviddavis wrote:

I think we could run these commands in the dev and test environments to patch django:
django_location=$(pip show django | grep Location | cut -d' ' -f2)
sed -i 's/hashlib.md5()/hashlib.md5(usedforsecurity=False)/' "$django_location/django/db/backends/utils.py"

For a dev and test environment, I'm +1 to this.

Actions

Copy link

Updated by daviddavis almost 4 years ago

The django fips fork lives at https://github.com/pulp/django/tree/fips. We should remove this repo as part of this work.

Actions

Copy link

#10

Updated by gerrod almost 4 years ago

Assignee set to gerrod

Actions

Copy link

#11

Updated by ipanova@redhat.com almost 4 years ago

Status changed from NEW to ASSIGNED
Sprint set to Sprint 91

Actions

Copy link

#12

Updated by fao89 almost 4 years ago

- name: Patch Django
  shell: >-
    django_location=$({{ pulp_install_dir }}/bin/pip show django | grep Location | cut -d' ' -f2)
    sed -i 's/hashlib.md5()/hashlib.md5(usedforsecurity=False)/' "$django_location/django/db/backends/utils.py"