Merge pull request #1133 from sameerforge/topic/sameerkh/fips140-md5-without-enforcement

Allow non-approved MD5 use under GODEBUG=fips140=only

Author: sameerforge

.github/workflows/golangci-lint.yml

@@ -16,11 +16,11 @@ jobs:
         with:
           fetch-depth: '0'
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@v9
         with:
-          version: v2.4
+          version: v2.12.2
           args: -v

go.mod

@@ -1,21 +1,21 @@
 module carvel.dev/kapp
 
-go 1.25.10
+go 1.26.5
 
 require (
 	carvel.dev/kapp-controller v0.59.8
-	carvel.dev/ytt v0.54.0
+	carvel.dev/ytt v0.55.2
 	github.com/cppforlife/cobrautil v0.0.0-20221130162803-acdfead391ef
 	github.com/cppforlife/color v1.9.1-0.20200716202919-6706ac40b835
 	github.com/cppforlife/go-cli-ui v0.0.0-20220520125801-e45d9169a663
 	github.com/cppforlife/go-patch v0.0.0-20240118020416-2147782e467b
 	github.com/google/go-cmp v0.7.0
-	github.com/hashicorp/go-version v1.6.0
+	github.com/hashicorp/go-version v1.7.0
 	github.com/k14s/difflib v0.0.0-20240118055029-596a7a5585c3
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/openshift/crd-schema-checker v0.0.0-20240404194209-35a9033b1d11
-	github.com/spf13/cobra v1.9.1
-	github.com/spf13/pflag v1.0.6
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	golang.org/x/net v0.47.0
 	gopkg.in/yaml.v2 v2.4.0

go.sum

@@ -2,10 +2,10 @@ carvel.dev/kapp-controller v0.59.8 h1:Uib5kAIUB7V1Q0ydNf8SzscIIjrn8a0pbXp/StljDt
 carvel.dev/kapp-controller v0.59.8/go.mod h1:+UtZDKStv8Z7rKuTmE8rgVwGHN3Rg1wRG0i5DFxmbE4=
 carvel.dev/vendir v0.45.3 h1:crIwlGpsdvABTiUM71IbAaanavyET7+FhnI8hrd3x3U=
 carvel.dev/vendir v0.45.3/go.mod h1:ulOigkUjXfCYidNbHqNAtEf0MFnuwG4jhoEqG2giOnU=
-carvel.dev/ytt v0.54.0 h1:adVCwHnAL9cLMYdJZnJG/ax1W1mTYYSmAwIF57NBsfk=
-carvel.dev/ytt v0.54.0/go.mod h1:KB0zsBE4RnIbJfY0aScl2X22lbL61iO6Er6aOhX1M04=
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
-github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+carvel.dev/ytt v0.55.2 h1:stQ3bevnqf8o8dVWpgT+lmTCoe9DNHz3LV/Jmskk7T0=
+carvel.dev/ytt v0.55.2/go.mod h1:C7g1xDPF0SwLTFZisaHFJYbYfKHi+AU7JFTBX9mLSbM=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
@@ -74,8 +74,8 @@ github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db h1:097atOisP2aRj7vFgY
 github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAxS5dIdcRluK6cSGGPlZynqzFM8NdvU144=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
+github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
@@ -150,10 +150,11 @@ github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR
 github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
-github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
-github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
-github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
-github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU=
+github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=

pkg/kapp/diff/ops_diff.go

@@ -4,6 +4,7 @@
 package diff
 
 import (
+	"crypto/fips140"
 	"crypto/md5"
 	"fmt"
 
@@ -15,8 +16,16 @@ type OpsDiff patch.Ops
 
 func (l OpsDiff) HasChanges() bool { return len(l) > 0 }
 
+// MinimalMD5 is a non-security convenience hash used to key/dedup diffs; it
+// is not used for authentication or integrity verification.
+// WithoutEnforcement lets it run under GODEBUG=fips140=only, which otherwise
+// panics on any non-approved primitive regardless of how it's used.
 func (l OpsDiff) MinimalMD5() string {
-	return fmt.Sprintf("%x", md5.Sum([]byte(l.MinimalString())))
+	var sum [md5.Size]byte
+	fips140.WithoutEnforcement(func() {
+		sum = md5.Sum([]byte(l.MinimalString()))
+	})
+	return fmt.Sprintf("%x", sum)
 }
 
 func (l OpsDiff) FullString() string { return "" }

pkg/kapp/diff/text_diff.go

@@ -4,6 +4,7 @@
 package diff
 
 import (
+	"crypto/fips140"
 	"crypto/md5"
 	"fmt"
 	"strings"
@@ -34,8 +35,16 @@ func (l TextDiff) HasChanges() bool {
 	return false
 }
 
+// MinimalMD5 is a non-security convenience hash used to key/dedup diffs; it
+// is not used for authentication or integrity verification.
+// WithoutEnforcement lets it run under GODEBUG=fips140=only, which otherwise
+// panics on any non-approved primitive regardless of how it's used.
 func (l TextDiff) MinimalMD5() string {
-	return fmt.Sprintf("%x", md5.Sum([]byte(l.MinimalString())))
+	var sum [md5.Size]byte
+	fips140.WithoutEnforcement(func() {
+		sum = md5.Sum([]byte(l.MinimalString()))
+	})
+	return fmt.Sprintf("%x", sum)
 }
 
 func (l TextDiff) MinimalString() string { return l.String(false) }

pkg/kapp/resources/association_label.go

@@ -4,6 +4,7 @@
 package resources
 
 import (
+	"crypto/fips140"
 	"crypto/md5"
 	"fmt"
 
@@ -25,7 +26,17 @@ func NewAssociationLabel(resource Resource) AssociationLabel {
 
 func (a AssociationLabel) v1Value() string {
 	// max 63 char for label values
-	key := fmt.Sprintf("%x", md5.Sum([]byte(NewUniqueResourceKey(a.resource).String())))
+	//
+	// MD5 here is a non-security convenience hash used to keep the label
+	// value short and stable; it is not used for authentication or
+	// integrity verification. WithoutEnforcement lets this run under
+	// GODEBUG=fips140=only, which otherwise panics on any non-approved
+	// primitive regardless of how it's used.
+	var sum [md5.Size]byte
+	fips140.WithoutEnforcement(func() {
+		sum = md5.Sum([]byte(NewUniqueResourceKey(a.resource).String()))
+	})
+	key := fmt.Sprintf("%x", sum)
 	return kappAssociationLabelV1 + "." + key
 }
 

vendor/carvel.dev/ytt/pkg/yamlmeta/internal/yaml.v2/emitterc.go

@@ -127,16 +127,22 @@ func yamlEmitterEmit(emitter *yamlEmitterT, event *yamlEventT) bool {
 		yamlEventDelete(event)
 		emitter.eventsHead++
 	}
+
+	// if eventsHead is caught up, then reset events back to empty to reduce allocations
+	if emitter.eventsHead > 0 && emitter.eventsHead == len(emitter.events) {
+		emitter.events = emitter.events[:0]
+		emitter.eventsHead = 0
+	}
+
 	return true
 }
 
 // Check if we need to accumulate more events before emitting.
 //
 // We accumulate extra
-//  - 1 event for DOCUMENT-START
-//  - 2 events for SEQUENCE-START
-//  - 3 events for MAPPING-START
-//
+//   - 1 event for DOCUMENT-START
+//   - 2 events for SEQUENCE-START
+//   - 3 events for MAPPING-START
 func yamlEmitterNeedMoreEvents(emitter *yamlEmitterT) bool {
 	if emitter.eventsHead == len(emitter.events) {
 		return true

vendor/carvel.dev/ytt/pkg/yttlibrary/md5.go

@@ -4,6 +4,7 @@
 package yttlibrary
 
 import (
+	"crypto/fips140"
 	"crypto/md5"
 	"fmt"
 
@@ -35,5 +36,16 @@ func (b md5Module) Sum(thread *starlark.Thread, f *starlark.Builtin, args starla
 		return starlark.None, err
 	}
 
-	return starlark.String(fmt.Sprintf("%x", md5.Sum([]byte(val)))), nil
+	// MD5 is not a FIPS 140-3 approved algorithm. This function is a general
+	// value-hashing convenience (e.g. for cache keys or dedup), not used for
+	// authentication or integrity verification, so it is safe to compute
+	// even under strict FIPS 140-3-only enforcement (GODEBUG=fips140=only).
+	// Without this, building with the native Go FIPS 140-3 module and
+	// running with fips140=only would panic on any call to md5.sum().
+	var sum [md5.Size]byte
+	fips140.WithoutEnforcement(func() {
+		sum = md5.Sum([]byte(val))
+	})
+
+	return starlark.String(fmt.Sprintf("%x", sum)), nil
 }