Repository navigation
NodeJS fails to build in a FIPS enabled environment #60202
Description
Version
22.18.0
Platform
aarch64
Subsystem
No response
What steps will reproduce the bug?
Build NodeJS with FIPS enabled in OpenSSL
How often does it reproduce? Is there a required condition?
Always
What is the expected behavior? Why is that the expected behavior?
It should build
What do you see instead?
nodejs> configure flags: --prefix=/nix/store/rwwvz67w598d3x4xy7izahrlf901i6m5-nodejs-22.18.0 --ninja --with-intl=system-icu --openssl-use-def-ca-store --no-cross-compiling --dest-os=linux --dest-cpu=arm64 --shared-libuv --shared-libuv-libpath=/nix/store/kfl342rjfdazskkj91q42j7a4a7n6qr1-libuv-1.51.0/lib --shared-openssl --shared-openssl-libpath=/nix/store/sv79v56z2bwbbgqhd4j3xvyfwrahwq0a-openssl-3.5.1/lib --shared-sqlite --shared-sqlite-libpath=/nix/store/7p4wg5ymgkfpzmhmrhyzc4k7dxz213ym-sqlite-3.50.2/lib --shared-zlib --shared-zlib-libpath=/nix/store/ig768bxaswpmyajrrldicxp6nlh454xg-zlib-1.3.1/lib
nodejs> Traceback (most recent call last):
nodejs> File "/build/node-v22.18.0/configure.py", line 2428, in <module>
nodejs> run_gyp(gyp_args)
nodejs> ~~~~~~~^^^^^^^^^^
nodejs> File "/build/node-v22.18.0/tools/gyp_node.py", line 52, in run_gyp
nodejs> rc = gyp.main(args)
nodejs> File "/build/node-v22.18.0/tools/gyp/pylib/gyp/__init__.py", line 692, in main
nodejs> return gyp_main(args)
nodejs> File "/build/node-v22.18.0/tools/gyp/pylib/gyp/__init__.py", line 677, in gyp_main
nodejs> generator.GenerateOutput(flat_list, targets, data, params)
nodejs> ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
nodejs> File "/build/node-v22.18.0/tools/gyp/pylib/gyp/generator/ninja.py", line 2957, in GenerateOutput
nodejs> GenerateOutputForConfig(
nodejs> ~~~~~~~~~~~~~~~~~~~~~~~^
nodejs> target_list, target_dicts, data, params, config_name
nodejs> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
nodejs> )
nodejs> ^
nodejs> File "/build/node-v22.18.0/tools/gyp/pylib/gyp/generator/ninja.py", line 2808, in GenerateOutputForConfig
nodejs> hash_for_rules = hashlib.md5(qualified_target_for_hash).hexdigest()
nodejs> ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
nodejs> _hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
Additional information
No response
Activity
richardlau commentedon Oct 10, 2025
This is coming out of gyp-next and seems to be specific to the ninja generator (i.e. it probably doesn't occur with
make), https://github.com/nodejs/gyp-next/blob/7d6189bf2b98183e06cd0e008efa1d41e23c1738/pylib/gyp/generator/ninja.py#L2806RossComputerGuy commentedon Oct 10, 2025
tools/gyp/pylib/gyp/generator/make.pydoes has 1 occurrence of usinghashlib.sha1()which will not work with FIPS. However, I am using Ninja so that is not applicable to my build environment.richardlau commentedon Jan 23, 2026
nodejs/gyp-next#329 replaces the md5 and sha1 hashes with sha256.