Unable to install grafana-agent rpm on FIPS-enabled OS

[kfriedrich123]

What's wrong?

RPM complains about Digest mismatch, while installing grafana-agent on FIPS-installed OS:

# fips-mode-setup --check
FIPS mode is enabled.

# rpm -i grafana-agent-0.34.1-1.amd64.rpm
error: unpacking of archive failed on file /etc/grafana-agent.yaml;649b0319: cpio: Digest mismatch
error: grafana-agent-0.34.1-1.x86_64: install failed

This happens because MD5 is set as the digest singing algorithm, and FIPS prohibits usage of MD5 anywhere:

# rpm -qp --qf "%{filedigestalgo}\n"  grafana-agent-0.34.1-1.amd64.rpm
(none)

(none) here means MD5 , as per https://bugzilla.redhat.com/show_bug.cgi?id=1659053

This is different grafana (not the agent) rpm, which as of grafana/grafana#59510 is now signed with sha256:

# rpm -qp --qf "%{filedigestalgo}\n"  grafana-7.5.15-4.el8.x86_64.rpm
8

Steps to reproduce

1. Download grafana-agent rpm from the upstream repo to a FIPS-enabled OS
2. Attempt to install it with rpm -i grafana-agent-0.34.1-1.amd64.rpm

System information

RHEL 8.8

Software version

grafana-agent-0.34.1-1

Configuration

FIPS enabled

Logs

No response

[kfriedrich123]

As per @rfratto comment in #4268 (comment), packages distributed via rpm.grafana.com are re-signed. I've just tested grafana-agent-0.34.3-1 downloaded from that repo and it still contains the MD5 signature, blocking rollout to our FIPS-enabled machines.