# File with http(s) source fails on FIPS system when server only provides MD5 checksum

## The problem

On a FIPS-enabled system, a file resource with an http(s) source failed when the server only provided MD5 checksum headers (X-Checksum-Md5 or Content-MD5). Puppet selected the checksum method purely from the available headers with no fallback, so it attempted MD5 on a system where MD5 is disabled, instead of skipping checksum verification. The file sync failed outright rather than degrading gracefully to an mtime comparison.

## The verified fix

Fixed upstream in PR #9405. Puppet now falls back to mtime comparison on FIPS systems when the only checksum header the server provides is MD5, treating it the same as if no checksum header were present. Upgrade past the version containing that fix. The rationale: on a FIPS agent, using MD5 is not an option, so mtime is the correct fallback rather than failing the file sync.
Source: https://github.com/puppetlabs/puppet/issues/9375