Skip to content

Fix gitaly-ruby problem with fips

Quang-Minh Nguyen requested to merge qmnguyen0711/fix-fips-problem into master

Gitaly's master is recently broken: https://gitlab.com/gitlab-org/gitaly/-/jobs/3236566469. Ruby sidecar is having a problem when building in FIPS mode. The root cause comes from a weird behavior that Digest::SHA1 is not required by default when building in FIPS mode. Labkit patches SHAx implementation of Digest by OpenSSL version. It does not require 'digest/sha1' explicitly. In Remove Wiki* in ruby sidecar - Part 2 (!4954 - merged), we remove gollum gems. Those gems required SHA1 somewhere implicitly. I injected some debug log in a test build to make this problem exposed: https://gitlab.com/gitlab-org/gitaly/-/jobs/3236704604#L1522.

Screenshot_2022-10-27_at_20.56.08

This fix should be submitted to Labkit upstream after this problem is resolved temporarily.

Edited by Quang-Minh Nguyen

Merge request reports