{"action":"created","issue":{"url":"https://api.github.com/repos/bundler/bundler/issues/4989","repository_url":"https://api.github.com/repos/bundler/bundler","labels_url":"https://api.github.com/repos/bundler/bundler/issues/4989/labels{/name}","comments_url":"https://api.github.com/repos/bundler/bundler/issues/4989/comments","events_url":"https://api.github.com/repos/bundler/bundler/issues/4989/events","html_url":"https://github.com/bundler/bundler/issues/4989","id":177112303,"number":4989,"title":"FIPS compatibility","user":{"login":"op-ct","id":8979062,"avatar_url":"https://avatars.githubusercontent.com/u/8979062?v=3","gravatar_id":"","url":"https://api.github.com/users/op-ct","html_url":"https://github.com/op-ct","followers_url":"https://api.github.com/users/op-ct/followers","following_url":"https://api.github.com/users/op-ct/following{/other_user}","gists_url":"https://api.github.com/users/op-ct/gists{/gist_id}","starred_url":"https://api.github.com/users/op-ct/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/op-ct/subscriptions","organizations_url":"https://api.github.com/users/op-ct/orgs","repos_url":"https://api.github.com/users/op-ct/repos","events_url":"https://api.github.com/users/op-ct/events{/privacy}","received_events_url":"https://api.github.com/users/op-ct/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2016-09-15T07:53:41Z","updated_at":"2016-11-30T23:32:02Z","closed_at":"2016-09-19T20:42:13Z","body":"bundler will fail when run in FIPS mode because it uses MD5:\n\n```\n$ bundle\nmd5_dgst.c(80): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode!\nAborted\n```\n\nTwo changes are needed to fix this (mostly in the vendor code):\n- It must be possible to use an alternative to `Digest::MD5.hexdigest` using a cipher that is permitted by FIPS-140-2 (e.g., `Digest::SHA256.hexdigest`).  \n  - This will affect the files:\n    - `lib/bundler/vendor/compact_index_client/lib/compact_index_client/cache.rb`\n    - `lib/bundler/vendor/compact_index_client/lib/compact_index_client/updater.rb`\n    - `lib/bundler/vendor/thor/lib/thor/runner.rb`\n    - `lib/bundler/source/rubygems/remote.rb`\n- `require \"digest/md5\"'`  should not be required by default, since that will also fail on a system with FIPS mode enabled.\n  - This affects the files:\n    - `lib/bundler/vendor/compact_index_client/lib/compact_index_client/cache.rb`\n    - `lib/bundler/vendor/thor/lib/thor/runner.rb`\n"},"comment":{"url":"https://api.github.com/repos/bundler/bundler/issues/comments/264030725","html_url":"https://github.com/bundler/bundler/issues/4989#issuecomment-264030725","issue_url":"https://api.github.com/repos/bundler/bundler/issues/4989","id":264030725,"user":{"login":"trevor-vaughan","id":4982601,"avatar_url":"https://avatars.githubusercontent.com/u/4982601?v=3","gravatar_id":"","url":"https://api.github.com/users/trevor-vaughan","html_url":"https://github.com/trevor-vaughan","followers_url":"https://api.github.com/users/trevor-vaughan/followers","following_url":"https://api.github.com/users/trevor-vaughan/following{/other_user}","gists_url":"https://api.github.com/users/trevor-vaughan/gists{/gist_id}","starred_url":"https://api.github.com/users/trevor-vaughan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trevor-vaughan/subscriptions","organizations_url":"https://api.github.com/users/trevor-vaughan/orgs","repos_url":"https://api.github.com/users/trevor-vaughan/repos","events_url":"https://api.github.com/users/trevor-vaughan/events{/privacy}","received_events_url":"https://api.github.com/users/trevor-vaughan/received_events","type":"User","site_admin":false},"created_at":"2016-11-30T23:32:02Z","updated_at":"2016-11-30T23:32:02Z","body":"@segiddins As a note for the future, providing a link to the following would have saved me a LOT of confusion http://andre.arko.net/2014/03/28/the-new-rubygems-index-format/.\r\n\r\nThat said, where do we go to ask the RubyGems.org people to update that standard to allow the specification of different checksums? They're really easy to document and you could implement multiples to allow systems that can only handle certain checksums to work properly."}}
{"actor":{"display_login":"trevor-vaughan"}}