From b6b15b2a0acdbabc4e94db6e5391feff05344650 Mon Sep 17 00:00:00 2001
From: Tomasz Szuba <tszuba@box.com>
Date: Mon, 18 Dec 2023 13:50:10 +0100
Subject: [PATCH] Switch md5 to sha256

For FIPS compliance

Signed-off-by: Tomasz Szuba <tszuba@box.com>
---
 .changeset/fast-tables-hammer.md                 | 7 +++++++
 .changeset/funny-rings-fry.md                    | 8 ++++++++
 packages/backend-common/src/cache/CacheClient.ts | 2 +-
 packages/cli/config/jest.js                      | 2 +-
 packages/cli/config/jestSucraseTransform.js      | 2 +-
 packages/cli/config/jestYamlTransform.js         | 2 +-
 6 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/fast-tables-hammer.md
 create mode 100644 .changeset/funny-rings-fry.md

diff --git a/.changeset/fast-tables-hammer.md b/.changeset/fast-tables-hammer.md
new file mode 100644
index 0000000000..9ed5915073
--- /dev/null
+++ b/.changeset/fast-tables-hammer.md
@@ -0,0 +1,7 @@
+---
+'@backstage/cli': patch
+---
+
+Use sha256 instead of md5 in build script cache key calculation
+
+Makes it possible to build on FIPS nodejs.
diff --git a/.changeset/funny-rings-fry.md b/.changeset/funny-rings-fry.md
new file mode 100644
index 0000000000..66daec0ffb
--- /dev/null
+++ b/.changeset/funny-rings-fry.md
@@ -0,0 +1,8 @@
+---
+'@backstage/backend-common': patch
+---
+
+Use sha256 instead of md5 for hash key calculation in caches
+
+This can have a side effect of invalidating caches (when cache key was >250 characters)
+This improves compliance with FIPS nodejs
diff --git a/packages/backend-common/src/cache/CacheClient.ts b/packages/backend-common/src/cache/CacheClient.ts
index 24ee7ac455..aba62558d4 100644
--- a/packages/backend-common/src/cache/CacheClient.ts
+++ b/packages/backend-common/src/cache/CacheClient.ts
@@ -88,6 +88,6 @@ export class DefaultCacheClient implements CacheService {
       return wellFormedKey;
     }
 
-    return createHash('md5').update(candidateKey).digest('base64');
+    return createHash('sha256').update(candidateKey).digest('base64');
   }
 }
diff --git a/packages/cli/config/jest.js b/packages/cli/config/jest.js
index 4a8bf9694f..584a31c672 100644
--- a/packages/cli/config/jest.js
+++ b/packages/cli/config/jest.js
@@ -219,7 +219,7 @@ async function getProjectConfig(targetPath, extraConfig) {
   // If no explicit id was configured, generated one based on the configuration.
   if (!config.id) {
     const configHash = crypto
-      .createHash('md5')
+      .createHash('sha256')
       .update(version)
       .update(Buffer.alloc(1))
       .update(JSON.stringify(config.transform))
diff --git a/packages/cli/config/jestSucraseTransform.js b/packages/cli/config/jestSucraseTransform.js
index 64e7307cab..349b6a1d58 100644
--- a/packages/cli/config/jestSucraseTransform.js
+++ b/packages/cli/config/jestSucraseTransform.js
@@ -70,7 +70,7 @@ function createTransformer(config) {
   };
 
   const getCacheKey = sourceText => {
-    return createHash('md5')
+    return createHash('sha256')
       .update(sourceText)
       .update(Buffer.alloc(1))
       .update(sucrasePkg.version)
diff --git a/packages/cli/config/jestYamlTransform.js b/packages/cli/config/jestYamlTransform.js
index 1235f8a4b7..84d1d9838c 100644
--- a/packages/cli/config/jestYamlTransform.js
+++ b/packages/cli/config/jestYamlTransform.js
@@ -25,7 +25,7 @@ function createTransformer(config) {
 
   const getCacheKey = sourceText => {
     return crypto
-      .createHash('md5')
+      .createHash('sha256')
       .update(sourceText)
       .update(Buffer.alloc(1))
       .update(JSON.stringify(config))