Commit ea76f3c2 authored by Vasilii Iakliushin's avatar Vasilii Iakliushin

Use SHA256 fingerprint instead of MD5 for LFS token secret

Contributes to https://gitlab.com/gitlab-org/gitlab/-/issues/355878

**Problem**

FIPS restricted environments don't support MD5 fingerprints. LFS
secrets based on MD5 fingerpritn won't work there.

**Solution**

Use SHA256 fingerprint as a base for secret generation.

Changelog: changed
parent bbc989ca
......@@ -99,7 +99,7 @@ module Gitlab
case actor
when DeployKey, Key
# Since fingerprint is based on the public key, let's take more bytes from attr_encrypted_db_key_base
actor.fingerprint.delete(':').first(16) + Settings.attr_encrypted_db_key_base_32
actor.fingerprint_sha256.first(16) + Settings.attr_encrypted_db_key_base_32
when User
# Take the last 16 characters as they're more unique than the first 16
actor.id.to_s + actor.encrypted_password.last(16) + Settings.attr_encrypted_db_key_base.first(16)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment