[release/8.0] Use SHA256 for RPM digest

[NikolaMilosavljevic]

Backport of #52664

FIPS compliance blocks installation of RPM packages that use MD5 digest algorithm. We use fpm tool which defaults to MD5 digests. The fix is to specify SHA256 instead.

The fix was made in arcade with dotnet/arcade#14269, installer fix is in dotnet/installer#17933

This is the same fix that was made by many other RPM package owners, for instance: https://github.com/influxdata/telegraf

[ghost]

Hi @NikolaMilosavljevic. If this is not a tell-mode PR, please make sure to follow the instructions laid out in the servicing process document.
Otherwise, please add tell-mode label.

[ghost]

Hey @dotnet/aspnet-build, looks like this PR is something you want to take a look at.

[ghost]

Hi @NikolaMilosavljevic. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge.

To learn more about how to prepare a servicing PR click here.

[ghost]

Hi @NikolaMilosavljevic. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.

[NikolaMilosavljevic]

This was approved for servicing.

[NikolaMilosavljevic]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).

[NikolaMilosavljevic]

@wtgodbe do you know why Source-Build (Managed) would fail with yarn errors, like the following?

2024-01-07T03:48:31.2333268Z     error [email protected]: The engine "node" is incompatible with this module. Expected version "^14 || ^16 || ^17 || ^18 || ^19". Got "20.9.0"
2024-01-07T03:48:31.2413366Z     error Found incompatible module.

My change does not affect source-build.

[NikolaMilosavljevic]

@wtgodbe do you know why Source-Build (Managed) would fail with yarn errors, like the following?

2024-01-07T03:48:31.2333268Z     error [email protected]: The engine "node" is incompatible with this module. Expected version "^14 || ^16 || ^17 || ^18 || ^19". Got "20.9.0"
2024-01-07T03:48:31.2413366Z     error Found incompatible module.

My change does not affect source-build.

It seems that NodeJS projects are being built in verification builds and that's what's causing the failure. Other recent PRs are failing with the same issue, i.e. #53213

Curiously, there was one recent PR that had all successful checks (including source-build). Verification builds for that PR did not build NodeJS projects - #53147

cc @MackinnonBuck

@wtgodbe, since this failure is unrelated to my changes, can you merge this PR? We do not want to merge the other related PR for backport to release/6.0.

[wtgodbe]

since this failure is unrelated to my changes, can you merge this PR? We do not want to merge the other related PR for backport to release/6.0.

I'd be more comfortable merging after @MackinnonBuck takes a look. Branches are open for another week, so we have some time.

Out of curiosity, why do we want this PR but not the 6.0 one?

[MackinnonBuck]

It looks like we fixed a similar build issue in main here. I'm going to try backporting the change to release/8.0 and see if that fixes these problems. I initially pushed it as a commit here but figured it would be better to test it separately first. Sorry for the noise!

[MackinnonBuck]

#53220

[NikolaMilosavljevic]

since this failure is unrelated to my changes, can you merge this PR? We do not want to merge the other related PR for backport to release/6.0.

I'd be more comfortable merging after @MackinnonBuck takes a look. Branches are open for another week, so we have some time.

Out of curiosity, why do we want this PR but not the 6.0 one?

cc @leecow

We'd like to minimize potential for breaking some customers on .NET 6.0. That release could be targeting some older distros that might not support sha256 rpm digest. While that is not very likely, it would be a breaking change if it happened.

[NikolaMilosavljevic]

@wtgodbe @MackinnonBuck after rebasing the PR, source-build leg is passing, but there are issues in tests, which run on Windows. Since we know that my changes are unrelated and needed for February release, can this PR be merged?