support FIPS 140-2 compliant digest calls

lib/fetchers/local.rb

@@ -2,6 +2,8 @@
 # author: Dominik Richter
 # author: Christoph Hartmann
 
+require 'openssl'
+
 module Fetchers
   class Local < Inspec.fetcher(1)
     name 'local'
@@ -65,7 +67,8 @@ def cache_key
 
     def sha256
       return nil if File.directory?(@target)
-      @archive_shasum ||= Digest::SHA256.hexdigest File.read(@target)
+      @archive_shasum ||=
+        OpenSSL::Digest::SHA256.digest(File.read(@target)).unpack('H*')[0]
     end
 
     def resolved_source

lib/fetchers/url.rb

@@ -3,7 +3,7 @@
 # author: Christoph Hartmann
 
 require 'uri'
-require 'digest'
+require 'openssl'
 require 'tempfile'
 require 'open-uri'
 
@@ -101,7 +101,7 @@ def to_s
 
     def sha256
       file = @archive_path || temp_archive_path
-      Digest::SHA256.hexdigest File.read(file)
+      OpenSSL::Digest::SHA256.digest(File.read(file)).unpack('H*')[0]
     end
 
     def file_type_from_remote(remote)

lib/inspec/dependencies/cache.rb

@@ -1,5 +1,4 @@
 # encoding: utf-8
-require 'digest'
 require 'fileutils'
 
 module Inspec

lib/inspec/dependencies/requirement.rb

@@ -1,7 +1,6 @@
 # encoding: utf-8
 require 'inspec/cached_fetcher'
 require 'inspec/dependencies/dependency_set'
-require 'digest'
 
 module Inspec
   #

lib/inspec/plugins/fetcher.rb

@@ -3,7 +3,6 @@
 # author: Christoph Hartmann
 require 'utils/plugin_registry'
 require 'inspec/file_provider'
-require 'digest'
 
 module Inspec
   module Plugins

lib/inspec/profile.rb

@@ -4,7 +4,7 @@
 # author: Christoph Hartmann
 
 require 'forwardable'
-require 'digest'
+require 'openssl'
 require 'inspec/polyfill'
 require 'inspec/cached_fetcher'
 require 'inspec/file_provider'
@@ -406,7 +406,7 @@ def sha256
       # get all dependency checksums
       deps = Hash[locked_dependencies.list.map { |k, v| [k, v.profile.sha256] }]
 
-      res = Digest::SHA256.new
+      res = OpenSSL::Digest::SHA256.new
       files = source_reader.tests.to_a + source_reader.libraries.to_a +
               source_reader.data_files.to_a +
               [['inspec.yml', source_reader.metadata.content]] +
@@ -415,7 +415,7 @@ def sha256
       files.sort { |a, b| a[0] <=> b[0] }
            .map { |f| res << f[0] << "\0" << f[1] << "\0" }
 
-      res.hexdigest
+      res.digest.unpack('H*')[0]
     end
 
     private