Error installing on FIPS compliant nodejs after pnpm 9.x upgrade about pnpm HOT 5 OPEN

These are the available FIPS compliant hashing algorithms crypto.getHashes() reports.

[
  'RSA-SHA1',
  'RSA-SHA1-2',
  'RSA-SHA224',
  'RSA-SHA256',
  'RSA-SHA3-224',
  'RSA-SHA3-256',
  'RSA-SHA3-384',
  'RSA-SHA3-512',
  'RSA-SHA384',
  'RSA-SHA512',
  'RSA-SHA512/224',
  'RSA-SHA512/256',
  'id-rsassa-pkcs1-v1_5-with-sha3-224',
  'id-rsassa-pkcs1-v1_5-with-sha3-256',
  'id-rsassa-pkcs1-v1_5-with-sha3-384',
  'id-rsassa-pkcs1-v1_5-with-sha3-512',
  'sha1',
  'sha1WithRSAEncryption',
  'sha224',
  'sha224WithRSAEncryption',
  'sha256',
  'sha256WithRSAEncryption',
  'sha3-224',
  'sha3-256',
  'sha3-384',
  'sha3-512',
  'sha384',
  'sha384WithRSAEncryption',
  'sha512',
  'sha512-224',
  'sha512-224WithRSAEncryption',
  'sha512-256',
  'sha512-256WithRSAEncryption',
  'sha512WithRSAEncryption',
  'shake128',
  'shake256',
  'ssl3-sha1'
]

from pnpm.

We are FIPS compliant for our production images and this issue remains a blocker for us to use pnpm. There are refrences to createHash("md5") in various places which fail, given md5 is not a crypto compliant algorithm.

from pnpm.

I'm running into this too right now, but on pnpm-8, so I don’t believe this is a new thing.

from pnpm.

A workaround is to invoke pnpm through a wrapper script. This is what I'm doing

#!/usr/bin/env node
const crypto = require('node:crypto');
const path = require('node:path');

function monkeyPatch() {
  const originalCreateHash = crypto.createHash;

  function createHashInterceptMD5(...argv) {
    if (argv[0] === 'md5') {
      argv[0] = 'sha1';
    }
    return originalCreateHash(...argv);
  }

  crypto.createHash = createHashInterceptMD5;
}

monkeyPatch();

// Update this path to match your circumstances
require(path.join(__dirname, 'node_modules/.bin/pnpm'));

Using another algorithm doesn't seem to hurt. I think it might effectively invalidate the pnpm store from before invoking with this wrapper. That's not a problem for my situation since I am unable to invoke pnpm without this on FIPS machines.

If a fix eventually makes its way into pnpm, it is worth considering making the hashing algorithm configurable and leave md5 as the default. Users who are lucky enough to not work on FIPS machines can keep using md5 and have their stores/caches keep working. FIPS users would have an escape hatch now, and more in the future if the algorithm they pick becomes unavailable.

from pnpm.

I think having lock files with configurable hash algorithms would be bad, compared to the one time pain of incrementing the lock file version and forcing everyone onto a better algorithm.

Thanks for the moneypatch code though. I sure hope this gets fixed.

from pnpm.