Repository navigation
plugins: remove DriverNetwork.Hash method - #28342
Merged
Merged
Conversation
As part of a project to make FIPS-140 compliant binaries available for Nomad
Enterprise customers, we intend to use the Go Cryptographic Module. In
`GODEBUG=fips140=only` mode ("enforcing"), the md5 hash function is disallowed
and will panic the agent if you try to call `md5.New()`.
The `DriverNetwork` object is used only by the `docker` driver and we never use
the `Hash` function in Nomad. The method was originally introduced in v0.6.0,
(ref 4117c8b) where it was used as part of an optimization meant to reduce
writes to the client state database. When the client was reworked in 0.9 it was
moved into the plugins package, where it no longer had a purpose.
Unfortunately this method is exposed to external drivers that import the
`plugins/drivers` package even though this isn't a tagged released package
intended for import. (Including our own external drivers.) I've reviewed all
known community drivers for use of this method, and none of them use it. I
considered switching this to a SHA256 hash, but that would silently break
private plugins we don't know about, as opposed to removing the `Hash()` method
and breaking them at compile time, which should be an easily fixed
situation. Another alterative would be to leave the method in place because it's
not going to be called inside our binary and therefore safe for FIPS builds, but
that's just asking for trouble by having someone use it later.
Remove the unused method.
Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140
tgross
force-pushed
the
nmd1658-fips-builds-drivernetwork-spec
branch
from
July 30, 2026 23:45
66ddfbc to
c57a354
Compare
tgross
marked this pull request as ready for review
July 30, 2026 23:49
5 of 8 tasks
schmichael
pushed a commit
to vercel/nomad
that referenced
this pull request
Sep 25, 2026
As part of a project to make FIPS-140 compliant binaries available for Nomad
Enterprise customers, we intend to use the Go Cryptographic Module. In
`GODEBUG=fips140=only` mode ("enforcing"), the md5 hash function is disallowed
and will panic the agent if you try to call `md5.New()`.
The `DriverNetwork` object is used only by the `docker` driver and we never use
the `Hash` function in Nomad. The method was originally introduced in v0.6.0,
(ref 4117c8b) where it was used as part of an optimization meant to reduce
writes to the client state database. When the client was reworked in 0.9 it was
moved into the plugins package, where it no longer had a purpose.
Unfortunately this method is exposed to external drivers that import the
`plugins/drivers` package even though this isn't a tagged released package
intended for import. (Including our own external drivers.) I've reviewed all
known community drivers for use of this method, and none of them use it. I
considered switching this to a SHA256 hash, but that would silently break
private plugins we don't know about, as opposed to removing the `Hash()` method
and breaking them at compile time, which should be an easily fixed
situation. Another alterative would be to leave the method in place because it's
not going to be called inside our binary and therefore safe for FIPS builds, but
that's just asking for trouble by having someone use it later.
Remove the unused method.
Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As part of a project to make FIPS-140 compliant binaries available for Nomad Enterprise customers, we intend to use the Go Cryptographic Module. In
GODEBUG=fips140=onlymode ("enforcing"), the md5 hash function is disallowed and will panic the agent if you try to callmd5.New().The
DriverNetworkobject is used only by thedockerdriver and we never use theHashfunction in Nomad. The method was originally introduced in v0.6.0, (ref 4117c8b) where it was used as part of an optimization meant to reduce writes to the client state database. When the client was reworked in 0.9 it was moved into the plugins package, where it no longer had a purpose.Unfortunately this method is exposed to external drivers that import the
plugins/driverspackage even though this isn't a tagged released package intended for import. (Including our own external drivers.) I've reviewed all known community drivers for use of this method, and none of them use it. I considered switching this to a SHA256 hash, but that would silently break private plugins we don't know about, as opposed to removing theHash()method and breaking them at compile time, which should be an easily fixed situation. Another alterative would be to leave the method in place because it's not going to be called inside our binary and therefore safe for FIPS builds, but that's just asking for trouble by having someone use it later.Remove the unused method.
Ref: https://hashicorp.atlassian.net/browse/NMD-1658
Ref: https://go.dev/doc/security/fips140
Ref: https://go.dev/blog/fips140
Contributor Checklist
changelog entry using the
make clcommand.Reviewer Checklist
backporting document.
in the majority of situations. The main exceptions are long-lived feature branches or merges where
history should be preserved.
within the public repository.
Changes to Security Controls
Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.