Project

General

Profile

Actions
Copy link

Bug #38118

open

FIPS-enabled deployment fails with Rails 7

Added by Evgeni Golov about 1 month ago. Updated 23 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
Security
Target version:
Katello 4.16.0
Difficulty:
Triaged:
Yes
Bugzilla link:
Pull request:
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

# foreman-installer --scenario katello --tuning development
2024-12-20 08:37:17 [NOTICE] [root] Loading installer configuration. This will take some time.
2024-12-20 08:37:20 [NOTICE] [root] Running installer with log based terminal output at level NOTICE.
2024-12-20 08:37:20 [NOTICE] [root] Use -l to set the terminal output log level to ERROR, WARN, NOTICE, INFO, or DEBUG. See --full-help for definitions.
2024-12-20 08:37:21 [NOTICE] [checks] System checks passed
2024-12-20 08:38:44 [NOTICE] [configure] Starting system configuration.
2024-12-20 08:40:13 [NOTICE] [configure] 250 configuration steps out of 1330 steps complete.
2024-12-20 08:40:21 [NOTICE] [configure] 500 configuration steps out of 1332 steps complete.
2024-12-20 08:40:45 [NOTICE] [configure] 750 configuration steps out of 1337 steps complete.
2024-12-20 08:40:48 [NOTICE] [configure] 1000 configuration steps out of 1360 steps complete.
2024-12-20 08:41:08 [ERROR ] [configure] '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
2024-12-20 08:41:08 [ERROR ] [configure] /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]/returns: change from 'notrun' to ['0'] failed: '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
2024-12-20 08:41:18 [ERROR ] [configure] /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]: Failed to call refresh: '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
2024-12-20 08:41:18 [ERROR ] [configure] /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]: '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
2024-12-20 08:42:29 [NOTICE] [configure] 1250 configuration steps out of 1360 steps complete.
2024-12-20 08:42:55 [NOTICE] [configure] System configuration has finished.

Error 1: Puppet Exec resource 'foreman-rake-db:migrate' failed. Logs:
  /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]
    Adding autorequire relationship with User[foreman]
    Starting to evaluate the resource (1108 of 1360)
    Failed to call refresh: '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
    '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
    Evaluated in 24.95 seconds
  Exec[foreman-rake-db:migrate](provider=posix)
    Executing check '/usr/sbin/foreman-rake db:abort_if_pending_migrations'
    Executing '/usr/sbin/foreman-rake db:migrate'
    Executing check '/usr/sbin/foreman-rake db:abort_if_pending_migrations'
    Executing '/usr/sbin/foreman-rake db:migrate'
  /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]/unless
    rake aborted!
    OpenSSL::Digest::DigestError: Digest initialization failed: initialization error
    /usr/share/gems/gems/activesupport-7.0.8.7/lib/active_support/digest.rb:18:in `hexdigest'
    /usr/share/gems/gems/angular-rails-templates-1.2.2/lib/angular-rails-templates/engine.rb:44:in `block in <class:Engine>'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `instance_exec'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `block in run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:17:in `benchmark'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `run'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:61:in `block in run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:60:in `run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:372:in `initialize!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `public_send'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `method_missing'
    /usr/share/foreman/config/environment.rb:5:in `<top (required)>'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    /usr/share/gems/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'
    /usr/share/gems/gems/zeitwerk-2.6.18/lib/zeitwerk/kernel.rb:34:in `require'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:348:in `require_environment!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:506:in `block in run_tasks_blocks'
    /usr/share/gems/gems/rake-13.0.3/exe/rake:27:in `<top (required)>'
    Tasks: TOP => db:abort_if_pending_migrations => db:load_config => environment
    (See full trace by running task with --trace)
    rake aborted!
    OpenSSL::Digest::DigestError: Digest initialization failed: initialization error
    /usr/share/gems/gems/activesupport-7.0.8.7/lib/active_support/digest.rb:18:in `hexdigest'
    /usr/share/gems/gems/angular-rails-templates-1.2.2/lib/angular-rails-templates/engine.rb:44:in `block in <class:Engine>'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `instance_exec'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `block in run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:17:in `benchmark'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `run'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:61:in `block in run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:60:in `run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:372:in `initialize!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `public_send'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `method_missing'
    /usr/share/foreman/config/environment.rb:5:in `<top (required)>'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    /usr/share/gems/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'
    /usr/share/gems/gems/zeitwerk-2.6.18/lib/zeitwerk/kernel.rb:34:in `require'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:348:in `require_environment!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:506:in `block in run_tasks_blocks'
    /usr/share/gems/gems/rake-13.0.3/exe/rake:27:in `<top (required)>'
    Tasks: TOP => db:abort_if_pending_migrations => db:load_config => environment
    (See full trace by running task with --trace)
  /Stage[main]/Foreman::Database/Foreman::Rake[db:migrate]/Exec[foreman-rake-db:migrate]/returns
    rake aborted!
    OpenSSL::Digest::DigestError: Digest initialization failed: initialization error
    /usr/share/gems/gems/activesupport-7.0.8.7/lib/active_support/digest.rb:18:in `hexdigest'
    /usr/share/gems/gems/angular-rails-templates-1.2.2/lib/angular-rails-templates/engine.rb:44:in `block in <class:Engine>'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `instance_exec'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `block in run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:17:in `benchmark'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `run'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:61:in `block in run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:60:in `run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:372:in `initialize!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `public_send'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `method_missing'
    /usr/share/foreman/config/environment.rb:5:in `<top (required)>'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    /usr/share/gems/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'
    /usr/share/gems/gems/zeitwerk-2.6.18/lib/zeitwerk/kernel.rb:34:in `require'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:348:in `require_environment!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:506:in `block in run_tasks_blocks'
    /usr/share/gems/gems/rake-13.0.3/exe/rake:27:in `<top (required)>'
    Tasks: TOP => db:migrate => db:load_config => environment
    (See full trace by running task with --trace)
    change from 'notrun' to ['0'] failed: '/usr/sbin/foreman-rake db:migrate' returned 1 instead of one of [0]
    rake aborted!
    OpenSSL::Digest::DigestError: Digest initialization failed: initialization error
    /usr/share/gems/gems/activesupport-7.0.8.7/lib/active_support/digest.rb:18:in `hexdigest'
    /usr/share/gems/gems/angular-rails-templates-1.2.2/lib/angular-rails-templates/engine.rb:44:in `block in <class:Engine>'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `instance_exec'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:32:in `run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `block in run'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:17:in `benchmark'
    /usr/share/foreman/config/initializers/0_print_time_spent.rb:45:in `run'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:61:in `block in run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/initializable.rb:60:in `run_initializers'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:372:in `initialize!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `public_send'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/railtie.rb:226:in `method_missing'
    /usr/share/foreman/config/environment.rb:5:in `<top (required)>'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    <internal:/usr/share/rubygems/rubygems/core_ext/kernel_require.rb>:85:in `require'
    /usr/share/gems/gems/polyglot-0.3.5/lib/polyglot.rb:65:in `require'
    /usr/share/gems/gems/zeitwerk-2.6.18/lib/zeitwerk/kernel.rb:34:in `require'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:348:in `require_environment!'
    /usr/share/gems/gems/railties-7.0.8.7/lib/rails/application.rb:506:in `block in run_tasks_blocks'
    /usr/share/gems/gems/rake-13.0.3/exe/rake:27:in `<top (required)>'
    Tasks: TOP => db:migrate => db:load_config => environment
    (See full trace by running task with --trace)

1 error was detected during installation.
Please address the errors and re-run the installer to ensure the system is properly configured.
Failing to do so is likely to result in broken functionality.
Actions
Copy link
 #1

Updated by Ewoud Kohl van Wijngaarden about 1 month ago

  • Project changed from Foreman to Katello
  • Category deleted (Rails)

This is an issue with a dependency that only Katello uses, so moving this.

I actually had a look at this when I updated this. We recently updated angular-rails-templates to 1.2.2 which includes the patch we needed (https://github.com/pitr/angular-rails-templates/pull/158), so I dropped the patch we applied in packaging:

https://github.com/theforeman/foreman-packaging/pull/11490

Then I had a look at the Rails core and it has this odd line that still mentions MD5: https://github.com/rails/rails/blob/21cbbebb6e9add7da9c07f319ee50fbf408af353/activesupport/lib/active_support/digest.rb#L9

This should be overridden by loading the 7.0 defaults, which we do here: https://github.com/theforeman/foreman/blob/bc2dbbf8d90a69536586fafcd1014022be32da34/config/application.rb#L83

That should set the digest to SHA256: https://github.com/rails/rails/blob/21cbbebb6e9add7da9c07f319ee50fbf408af353/railties/lib/rails/application/configuration.rb#L227

And we noticed that it was changed in Katello because we needed to re-record the fixtures: https://github.com/Katello/katello/pull/11155.

So I'm not quite sure why this fails. Perhaps something with Rails 7 changed in the loading order so it hashes something before the settings are loaded?

I wonder why angular-rails-templates sets the asset version in the first place because sprockets should already use the contents of a file to bust the caches. It could also just put the raw values in the version string instead of hashing.

Actions
Copy link
 #2

Updated by Ewoud Kohl van Wijngaarden about 1 month ago

Answering my own question why it's hashed: the last argument is all the options so if any options change, it should bust the caches.

Actions
Copy link
 #3

Updated by Quinn James 24 days ago

  • Category set to Security
  • Target version set to Katello 4.16.0
  • Triaged changed from No to Yes
Actions
Copy link
 #4

Updated by Oleh Fedorenko 23 days ago

It seems angular-rails-templates refers to ActiveSupport::Digest before main application (or maybe even Rails itself) configures it. Trying locally to move that block into an initializer that runs much later seems to make ActiveSupport::Digest.hash_digest_class return SHA256 instead of MD5.

Actions
Copy link

Also available in: Atom PDF