Skip to content

plugins: remove DriverNetwork.Hash method - #28342

Merged
tgross merged 1 commit into
mainfrom
nmd1658-fips-builds-drivernetwork-spec
Jul 31, 2026
Merged

tgross merged 1 commit into
mainfrom
nmd1658-fips-builds-drivernetwork-spec

Conversation

@tgross

@tgross tgross commented Jul 30, 2026 •

Copy link
Copy Markdown
Member

As part of a project to make FIPS-140 compliant binaries available for Nomad Enterprise customers, we intend to use the Go Cryptographic Module. In GODEBUG=fips140=only mode ("enforcing"), the md5 hash function is disallowed and will panic the agent if you try to call md5.New().

The DriverNetwork object is used only by the docker driver and we never use the Hash function in Nomad. The method was originally introduced in v0.6.0, (ref 4117c8b) where it was used as part of an optimization meant to reduce writes to the client state database. When the client was reworked in 0.9 it was moved into the plugins package, where it no longer had a purpose.

Unfortunately this method is exposed to external drivers that import the plugins/drivers package even though this isn't a tagged released package intended for import. (Including our own external drivers.) I've reviewed all known community drivers for use of this method, and none of them use it. I considered switching this to a SHA256 hash, but that would silently break private plugins we don't know about, as opposed to removing the Hash() method and breaking them at compile time, which should be an easily fixed situation. Another alterative would be to leave the method in place because it's not going to be called inside our binary and therefore safe for FIPS builds, but that's just asking for trouble by having someone use it later.

Remove the unused method.

Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140

Contributor Checklist

  • Changelog Entry If this PR changes user-facing behavior, please generate and add a
    changelog entry using the make cl command.
  • Testing n/a
  • Documentation n/a
  • LLM Usage n/a

Reviewer Checklist

  • Backport Labels Please add the correct backport labels as described by the internal
    backporting document.
  • Commit Type Ensure the correct merge method is selected which should be "squash and merge"
    in the majority of situations. The main exceptions are long-lived feature branches or merges where
    history should be preserved.
  • Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
    within the public repository.
  • If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

As part of a project to make FIPS-140 compliant binaries available for Nomad
Enterprise customers, we intend to use the Go Cryptographic Module. In
`GODEBUG=fips140=only` mode ("enforcing"), the md5 hash function is disallowed
and will panic the agent if you try to call `md5.New()`.

The `DriverNetwork` object is used only by the `docker` driver and we never use
the `Hash` function in Nomad. The method was originally introduced in v0.6.0,
(ref 4117c8b) where it was used as part of an optimization meant to reduce
writes to the client state database. When the client was reworked in 0.9 it was
moved into the plugins package, where it no longer had a purpose.

Unfortunately this method is exposed to external drivers that import the
`plugins/drivers` package even though this isn't a tagged released package
intended for import. (Including our own external drivers.) I've reviewed all
known community drivers for use of this method, and none of them use it. I
considered switching this to a SHA256 hash, but that would silently break
private plugins we don't know about, as opposed to removing the `Hash()` method
and breaking them at compile time, which should be an easily fixed
situation. Another alterative would be to leave the method in place because it's
not going to be called inside our binary and therefore safe for FIPS builds, but
that's just asking for trouble by having someone use it later.

Remove the unused method.

Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140
@tgross
tgross force-pushed the nmd1658-fips-builds-drivernetwork-spec branch from 66ddfbc to c57a354 Compare July 30, 2026 23:45
@tgross tgross added backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/ent/1.11.x+ent backport to 1.11.x+ent release line backport/2.0.x backport to 2.0.x release line labels Jul 30, 2026
@tgross
tgross marked this pull request as ready for review July 30, 2026 23:49
@tgross
tgross requested review from a team as code owners July 30, 2026 23:49

@jrasell jrasell left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@tgross
tgross merged commit ea84975 into main Jul 31, 2026
53 of 54 checks passed
@tgross
tgross deleted the nmd1658-fips-builds-drivernetwork-spec branch July 31, 2026 12:34
schmichael pushed a commit to vercel/nomad that referenced this pull request Sep 25, 2026
As part of a project to make FIPS-140 compliant binaries available for Nomad
Enterprise customers, we intend to use the Go Cryptographic Module. In
`GODEBUG=fips140=only` mode ("enforcing"), the md5 hash function is disallowed
and will panic the agent if you try to call `md5.New()`.

The `DriverNetwork` object is used only by the `docker` driver and we never use
the `Hash` function in Nomad. The method was originally introduced in v0.6.0,
(ref 4117c8b) where it was used as part of an optimization meant to reduce
writes to the client state database. When the client was reworked in 0.9 it was
moved into the plugins package, where it no longer had a purpose.

Unfortunately this method is exposed to external drivers that import the
`plugins/drivers` package even though this isn't a tagged released package
intended for import. (Including our own external drivers.) I've reviewed all
known community drivers for use of this method, and none of them use it. I
considered switching this to a SHA256 hash, but that would silently break
private plugins we don't know about, as opposed to removing the `Hash()` method
and breaking them at compile time, which should be an easily fixed
situation. Another alterative would be to leave the method in place because it's
not going to be called inside our binary and therefore safe for FIPS builds, but
that's just asking for trouble by having someone use it later.

Remove the unused method.

Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140

This branch was successfully deployed

1 active deployment
Preview — c57a3548 Deployed Jul 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/ent/1.10.x+ent backport to 1.10.x+ent release line backport/ent/1.11.x+ent backport to 1.11.x+ent release line backport/2.0.x backport to 2.0.x release line theme/tech-debt type/enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants