不能在启用FIPS的RHEL 8上构建角9项目

Question

我们需要使用角度为9的RHEL 8，默认情况下RHEL 8已启用FIPS。当尝试构建一个有角度的9应用程序时，请获得下面的错误。尝试过设置FIPS=0，但它扰乱了许多java库。在RHEL 7中，我们可以将FIPS=0设置为构建，但不能使用RHEL 8。

我相信这是因为它使用的是md5哈希算法，这是不符合FIPS的。

• 如果是这样的话，如何选择不同的哈希算法?如果没有，如何在启用FIPS的情况下成功构建？

Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
    at new Hash (internal/crypto/hash.js:46:19)
    at Object.createHash (crypto.js:115:10)
    at NgccConfiguration.computeHash (/home/b73134/displays/amp-workspace/node_modules/@angular/compiler-cli/ngcc/src/packages/configuration.js:216:29)
    at new NgccConfiguration (/home/b73134/displays/amp-workspace/node_modules/@angular/compiler-cli/ngcc/src/packages/configuration.js:108:30)
    at Object.mainNgcc (/home/b73134/displays/amp-workspace/node_modules/@angular/compiler-cli/ngcc/src/main.js:46:22)
    at /home/b73134/displays/amp-workspace/node_modules/@angular/compiler-cli/ngcc/main-ngcc.js:34:53
    at step (/home/b73134/displays/amp-workspace/node_modules/tslib/tslib.js:141:27)
    at Object.next (/home/b73134/displays/amp-workspace/node_modules/tslib/tslib.js:122:57)
    at /home/b73134/displays/amp-workspace/node_modules/tslib/tslib.js:115:75
    at new Promise (<anonymous>)

Openssl版本

OpenSSL 1.1.1g FIPS  21 Apr 2020

角CLI信息

Angular CLI: 9.1.5
Node: 14.15.0
OS: linux x64

Angular: 9.1.6
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router
Ivy Workspace: Yes

Package                            Version
------------------------------------------------------------
@angular-devkit/architect          0.901.12
@angular-devkit/build-angular      0.901.5
@angular-devkit/build-ng-packagr   0.901.13
@angular-devkit/build-optimizer    0.901.5
@angular-devkit/build-webpack      0.901.5
@angular-devkit/core               9.1.12
@angular-devkit/schematics         9.1.12
@angular/cdk                       9.2.4
@angular/cli                       9.1.5
@angular/flex-layout               9.0.0-beta.31
@angular/material                  9.2.4
@angular/material-moment-adapter   <error>
@ngtools/webpack                   9.1.5
@schematics/angular                9.1.12
@schematics/update                 0.901.5
ng-packagr                         9.1.5
rxjs                               6.6.2
typescript                         3.8.3
webpack                            4.42.0

Answer 1

问题是角/Webpack，默认情况下，是使用md4/md5，因为它的散列算法在FIPS环境中不受支持。我不得不使用自定义webpack设置来设置哈希算法。在某些项目中，webpack自己对md4/md5进行了硬编码，在这些情况下，我不得不一起注释掉配置。

我所做的一切都是为了工作

安装--保存-dev @angular-builders/custom-webpack@9.2.0

• create文件"custom-webpack.config.js"

• update angular.json以使用custom-webpack.config.js

更新angular.json以使用自定义-webPack.config.js

"architect": {
  "build": {
    "builder": "@angular-builders/custom-webpack:browser",
    "options": {
        "customWebpackConfig": {
          "path": "./custom-webpack.config.js"
        ",
        ...

  "serve": {
    "builder": "@angular-builders/custom-webpack:dev-server",
    ...

  "test": {
    "builder": "@angular-builders/custom-webpack:karma",

custom-webpack.config.js

const webpack = require('webpack')

module.exports = {
  plugins: [
    new webpack.HashedModuleIdsPlugin({
      hashFunction: 'sha256'
    })
  ],
  output: {
    hashFunction: 'sha256',
  },
  optimization: {
    concatenateModules: false // Hardcoded to md4, have to disable
  }
}

更新angular.json生产配置。这两个项目是硬编码到md4/md5在webpack，所以我不得不关闭它。

• "outputHashing"："none"
• Remove条目"extractCss"

Answer 2

node_modules/webpack中有许多JS文件是硬编码到md4的。为了绕过这些文件，下载补丁包模块，它在node_modules中创建更新文件的补丁文件，并将它们应用于npm安装、更新等。