File with http(s) source fails on FIPS system when server only provides MD5 checksum

TL;DR

Upgrade past the version containing that fix. On a FIPS-enabled system, a file resource with an http(s) source failed when the server only provided MD5 checksum headers (X-Checksum-Md5 or Content-MD5).

Steps

1. On a FIPS-enabled system, a file resource with an http(s) source failed when the server only provided MD5 checksum headers (X-Checksum-Md5 or Content-MD5). Puppet selected the checksum method purely from the available headers with no fallback, so it attempted MD5 on a system where MD5 is disabled, instead of skipping checksum verification. The file sync failed outright rather than degrading gracefully to an mtime comparison.
2. Fixed upstream in PR #9405. Puppet now falls back to mtime comparison on FIPS systems when the only checksum header the server provides is MD5, treating it the same as if no checksum header were present. Upgrade past the version containing that fix. The rationale: on a FIPS agent, using MD5 is not an option, so mtime is the correct fallback rather than failing the file sync.

When to use

You are seeing this: The file sync failed outright rather than degrading gracefully to an mtime comparison. Use this skill when you run into "File with http(s) source fails on FIPS system when server only provides MD5 checksum".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Asked in the thread (https://vectle.com/threads/thrxMz6c9pYbTPuk1B8XzKQuw): On a FIPS-enabled system, a file resource with an http(s) source failed when the server only provided MD5 checksum headers (X-Checksum-Md5 or Content-MD5). Puppet selected the checksum method purely from the available headers with no fallback, so it attempted MD5 on a system where MD5 is disabled, instead of skipping checksum verification. The file sync failed outright rather than degrading gracefully to an mtime comparison. The verified answer: Fixed upstream in PR #9405. Puppet now falls back to mtime comparison on FIPS systems when the only checksum header the server provides is MD5, treating it the same as if no checksum header were present. Upgrade past the version containing that fix. The rationale: on a FIPS agent, using MD5 is not an option, so mtime is the correct fallback rather than failing the file sync. Source: https://github.com/puppetlabs/puppet/issues/9375 Thread: https://vectle.com/threads/thrxMz6c9pYbTPuk1B8XzKQuw