Puppet cannot build module on RHEL 7 in FIPS mode (Puppet Guide)

Latest response

From the Puppet Guide last step, 2.10 - Finalizing the Module one cannot build the puppet module named "mymodule" into a package on a current RHEL 7 system running in FIPS mode (i.e. DISA STIG for RHEL 7 security profile selected during installation):

# cd /etc/puppet/modules
# puppet module build mymodule
md5_dgst.c(82): OpenSSL internal error, assertion failed: Digest MD5 forbidden in FIPS mode!
Aborted (core dumped)

Even with "sha256" designated within puppet.conf:

# cat /etc/puppet/puppet.conf | grep -v ^$ | grep -v '#'
[main]
    logdir = /var/log/puppet
    rundir = /var/run/puppet
    ssldir = $vardir/ssl
    digest_algorithm = sha256
    disable_warnings = deprecations
[agent]
    classfile = $vardir/classes.txt
    localconfig = $vardir/localconfig

This does not work on a current RHEL 7.4 system with FIPS (FIPS-140-2) enabled and puppet 3.8.6, because even if "digest_algorithm = sha256" is set within the "[main]" section of puppet.conf, the puppet build/install/uninstall/upgrade actions currently require using an MD5 digest. Note that PUP-4963 "puppet module build" fails on FIPS-enabled system issue was resolved (on 2018-02-15) in Puppet 5.4.0+ by simply failing gracefully to not build or uninstall puppet modules when FIPS is enabled. The process to disable FIPS on RHEL6 or RHEL7 is quite involved.

BW

Responses