RPM fail to install on RHEL systems that have FIPS enabled

[gmcharlt]

We're working with a site that has Koha + Zebra installed on a RHEL9 system. They turned on FIPS after the initial installation, and are now getting errors like this when they try to install updated RPMs:

Error unpacking rpm package idzebra-2.0-2.2.10-1.indexdata.x86_64
  Upgrading        : yaz-5.37.0-1.indexdata.x86_64                                                                                              7/14 
error: unpacking of archive failed on file /etc/logrotate.d/zebrasrv;698a338e: cpio: Digest mismatch
error: idzebra-2.0-2.2.10-1.indexdata.x86_64: install failed

It looks like that the problem affects not just idzebra, but the other Yaz packages that are needed by Koha.

Some searching suggests that building the RPMs with SHA256 digests should fix the problem on FIPS-enabled systems. Would it be possible to make that change for all RPMs that you distribute?

[adamdickmeiss]

We created libyaz5-5.37.0-2.indexdata with sha256 for file digest ; otherwise same as libyaz5-5.37.0-1.indexdata. If that works for you, we'll build the rest.

[gmcharlt]

Thanks! I've asked our client to do a quick test; if I don't hear back from them, I'll plan on doing a quick test myself later this week.

[adamdickmeiss]

We tested with a FIPS-enabled system (Rocky Linux 10), and we were unable to reproduce this error for any of the packages (older yaz, idzebra, etc)