Azure CLI installation fails on FIPS enabled Linux systems

[one-kash]

Description of Feature or Work Requested

Azure CLI install fails on Linux machines (such as RHEL, Ubuntu) when FIPS is enabled on those machines.

went through all of the documentation and none of these talk about CLI being FIPS compliant.. Is that an identified issue?

few docs link below:

https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-linux?pivots=apt

https://docs.microsoft.com/en-us/azure/compliance/offerings/offering-fips-140-2

https://docs.microsoft.com/en-us/cpp/linux/set-up-fips-compliant-secure-remote-linux-development?view=msvc-170

Minimum API Version Required

Swagger Link

Target Date

[jiasli]

Azure CLI install fails on Linux machines (such as RHEL, Ubuntu) when FIPS is enabled on those machines.

Could you share the error message you got?

[archoversight]

RHEL 8.4:

# dnf install azure-cli
Azure CLI                                                                                                                                         27 MB/s |  22 MB     00:00
Last metadata expiration check: 0:00:08 ago on Tue 14 Dec 2021 05:36:39 PM UTC.
Dependencies resolved.
=================================================================================================================================================================================
 Package                                   Architecture                           Version                                        Repository                                 Size
=================================================================================================================================================================================
Installing:
 azure-cli                                 x86_64                                 2.31.0-1.el7                                   azure-cli                                  48 M

Transaction Summary
=================================================================================================================================================================================
Install  1 Package

Total download size: 48 M
Installed size: 662 M
Is this ok [y/N]: y
Downloading Packages:
azure-cli-2.31.0-1.el7.x86_64.rpm                                                                                                                 35 MB/s |  48 MB     00:01
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                             35 MB/s |  48 MB     00:01
Running transaction check
Transaction check succeeded.
Running transaction test
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.
Error: Transaction test error:
  package azure-cli-2.31.0-1.el7.x86_64 does not verify: no digest

The problem is due the fact that the azure-cli is only signed with a SHA1 digest, which is not acceptable on FIPS enabled systems:

# rpm --checksig --verbose azure-cli-2.31.0-1.el7.x86_64.rpm
azure-cli-2.31.0-1.el7.x86_64.rpm:
    Header V4 RSA/SHA256 Signature, key ID be1229cf: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: NOTFOUND
    V4 RSA/SHA256 Signature, key ID be1229cf: OK
    MD5 digest: NOTFOUND

Please update the digest method used while building to use SHA256 instead.

Here's a resource I've used in the past when re-packaging open source software: https://www.starlab.io/blog/adding-sha256-digests-to-rpms

[aghassemlouei]

Jiashuo Li (@jiasli) does the output provided by Arch Oversight (@archoversight) help? He's linked to how to repack the rpm.

[jiasli]

Alijohn Ghassemlouei (@aghassemlouei), I am sorry but supporting FIPS is not on our roadmap yet. We will consider it in following semesters.

[archoversight]

As a heads up, newer versions of rpm-build would automatically use the right signatures/hash functions, which was reverted in this PR:

#11325

[aghassemlouei]

I've gone ahead and opened up #20852 as updating ARG tag=centos8 would most likely not be accepted by the maintainers in the following file given #11325 reverted CentOS related changes:

https://github.com/Azure/azure-cli/blob/dev/scripts/release/rpm/Dockerfile.centos#L1