[Bug]: RPM Digest Uses Too-Weak Algorithm (not installable via dnf on RHEL and derivatives)

[ferricoxide]

Preconditions (Any important steps we need to know)

Red Hat or related/derived Linux distros with FIPS enabled

Steps to reproduce (How to reproduce what you found step by step)

1. Download latest installation RPM (currently 3.4.2)

2. Attempt to use dnf utility to install:

   # dnf install /tmp/Redis-Insight-linux-x86_64.rpm

3. Installation fails with transaction failure (as follows):

   Dependencies resolved.
   ====================================================================================================================================
    Package                           Architecture                Version                      Repository                         Size
   ====================================================================================================================================
   Installing:
    redisinsight                      x86_64                      3.4.2-1                      @commandline                       87 M
   
   Transaction Summary
   ====================================================================================================================================
   Install  1 Package
   
   Total size: 87 M
   Installed size: 361 M
   Is this ok [y/N]: y
   Downloading Packages:
   Running transaction check
   Transaction check succeeded.
   Running transaction test
   Transaction test succeeded.
   Running transaction
     Preparing        :                                                                                                            1/1
     Installing       : redisinsight-3.4.2-1.x86_64                                                                                1/1
   Error unpacking rpm package redisinsight-3.4.2-1.x86_64
     Verifying        : redisinsight-3.4.2-1.x86_64                                                                                1/1
   
   Failed:
     redisinsight-3.4.2-1.x86_64
   
   Error: Transaction failed
   

4. Re-attempt install with --nogpgcheck flag added.

5. Installation continues to fail

6. Start debugging using rpm -ivh

   # rpm -ivh /tmp/Redis-Insight-linux-x86_64.rpm
   Verifying...                          ################################# [100%]
   Preparing...                          ################################# [100%]
   Updating / installing...
      1:redisinsight-3.4.2-1             ################################# [100%]
   error: unpacking of archive failed on file /opt/Redis Insight/LICENSE.electron.txt;6a0dd175: cpio: Digest mismatch
   error: redisinsight-3.4.2-1.x86_64: install failed

7. Check the RPM's digest algorithm:

   # rpm -qp --qf '%{FILEDIGESTALGO}\n' /tmp/Redis-Insight-linux-x86_64.rpm
   (none)

   Should have returned an 8 — as it does for FIPS-compatible RPMs like the vendor's kernel RPM:

   $ rpm -qp --qf '%{FILEDIGESTALGO}\n' kernel-5.14.0-706.el9.x86_64.rpm
   8

Actual behavior (A short description of what you found)

dnf install <PATH_TO_RPM> fails as noted in the Steps to Reproduce section

Expected behavior (A short description of what you expected to find)

dnf install <PATH_TO_RPM> should succeed, especially with --nogpgcheck enabled

Screenshots (Paste or drag-and-drop a screenshot or a link to a recording)

Additional context (Operating system, version of Redis Insight, Redis database version, Redis module version, database type, connection type, logs, or any other information)

OS: RHEL 9.7 (x86)
Host/hardware: EC2
FIPS-mode: enabled
REDIS Insight Version: 3.4.2

[ferricoxide]

Note, this can be worked around by directly using the rpm command to install, but that causes integration-problems with tools like SaltStack that expect to use dnf. Attempts to tell dnf to ignore the broken digests fail (neither the --nodigest option nor the undocumented --nofiledigest option for the underlying rpm command can be passed through).

[DimoHG]

We merged a fix. Will be available with our next release 🙏

[ferricoxide]

We merged a fix. Will be available with our next release 🙏

Awesome. Thank you. I'll look forward to testing it out when it becomes available. I'm going to see if I can find it, but, in case I don't is there a release-notification I can subscribe to?

[valkirilov]

@ferricoxide we'll ping you here once the release is published 👍