Move from md5 to sha1 to work on fips-140 enabled systems

lib/ansible/runner/action_plugins/fetch.py

@@ -50,26 +50,40 @@ class ActionModule(object):
         flat = utils.boolean(flat)
         fail_on_missing = options.get('fail_on_missing', False)
         fail_on_missing = utils.boolean(fail_on_missing)
-        validate_md5 = options.get('validate_md5', True)
-        validate_md5 = utils.boolean(validate_md5)
+        validate_checksum = options.get('validate_checksum', None)
+        if validate_checksum is not None:
+            validate_checksum = utils.boolean(validate_checksum)
+        # Alias for validate_checksum (old way of specifying it)
+        validate_md5 = options.get('validate_md5', None)
+        if validate_md5 is not None:
+            validate_md5 = utils.boolean(validate_md5)
+        if validate_md5 is None and validate_checksum is None:
+            # Default
+            validate_checksum = True
+        elif validate_checksum is None:
+            validate_checksum = validate_md5
+        elif validate_md5 is not None and validate_checksum is not None:
+            results = dict(failed=True, msg="validate_checksum and validate_md5 cannot both be specified")
+            return ReturnData(conn, result=results)
+
         if source is None or dest is None:
             results = dict(failed=True, msg="src and dest are required")
             return ReturnData(conn=conn, result=results)
 
         source = conn.shell.join_path(source)
 
-        # calculate md5 sum for the remote file
-        remote_md5 = self.runner._remote_md5(conn, tmp, source)
+        # calculate checksum for the remote file
+        remote_checksum = self.runner._remote_checksum(conn, tmp, source)
 
         # use slurp if sudo and permissions are lacking
         remote_data = None
-        if remote_md5 in ('1', '2') or self.runner.sudo:
+        if remote_checksum in ('1', '2') or self.runner.sudo:
             slurpres = self.runner._execute_module(conn, tmp, 'slurp', 'src=%s' % source, inject=inject)
             if slurpres.is_successful():
                 if slurpres.result['encoding'] == 'base64':
                     remote_data = base64.b64decode(slurpres.result['content'])
                 if remote_data is not None:
-                    remote_md5 = utils.md5s(remote_data)
+                    remote_checksum = utils.checksum_s(remote_data)
                 # the source path may have been expanded on the
                 # target system, so we compare it here and use the
                 # expanded version if it's different
@@ -101,23 +115,23 @@ class ActionModule(object):
 
         # these don't fail because you may want to transfer a log file that possibly MAY exist
         # but keep going to fetch other log files
-        if remote_md5 == '0':
+        if remote_checksum == '0':
             result = dict(msg="unable to calculate the md5 sum of the remote file", file=source, changed=False)
             return ReturnData(conn=conn, result=result)
-        if remote_md5 == '1':
+        if remote_checksum == '1':
             if fail_on_missing:
                 result = dict(failed=True, msg="the remote file does not exist", file=source)
             else:
                 result = dict(msg="the remote file does not exist, not transferring, ignored", file=source, changed=False)
             return ReturnData(conn=conn, result=result)
-        if remote_md5 == '2':
+        if remote_checksum == '2':
             result = dict(msg="no read permission on remote file, not transferring, ignored", file=source, changed=False)
             return ReturnData(conn=conn, result=result)
 
-        # calculate md5 sum for the local file
-        local_md5 = utils.md5(dest)
+        # calculate checksum for the local file
+        local_checksum = utils.checksum(dest)
 
-        if remote_md5 != local_md5:
+        if remote_checksum != local_checksum:
             # create the containing directories, if needed
             if not os.path.isdir(os.path.dirname(dest)):
                 os.makedirs(os.path.dirname(dest))
@@ -129,13 +143,27 @@ class ActionModule(object):
                 f = open(dest, 'w')
                 f.write(remote_data)
                 f.close()
-            new_md5 = utils.md5(dest)
-            if validate_md5 and new_md5 != remote_md5:
-                result = dict(failed=True, md5sum=new_md5, msg="md5 mismatch", file=source, dest=dest, remote_md5sum=remote_md5)
+            new_checksum = utils.secure_hash(dest)
+            # For backwards compatibility.  We'll return None on FIPS enabled
+            # systems
+            try:
+                new_md5 = utils.md5(dest)
+            except ValueError:
+                new_md5 = None
+
+            if validate_checksum and new_checksum != remote_checksum:
+                result = dict(failed=True, md5sum=new_md5, msg="checksum mismatch", file=source, dest=dest, remote_md5sum=None, checksum=new_checksum, remote_checksum=remote_checksum)
                 return ReturnData(conn=conn, result=result)
-            result = dict(changed=True, md5sum=new_md5, dest=dest, remote_md5sum=remote_md5)
+            result = dict(changed=True, md5sum=new_md5, dest=dest, remote_md5sum=None, checksum=new_checksum, remote_checksum=remote_checksum)
             return ReturnData(conn=conn, result=result)
         else:
-            result = dict(changed=False, md5sum=local_md5, file=source, dest=dest)
+            # For backwards compatibility.  We'll return None on FIPS enabled
+            # systems
+            try:
+                local_md5 = utils.md5(dest)
+            except ValueError:
+                local_md5 = None
+
+            result = dict(changed=False, md5sum=local_md5, file=source, dest=dest, checksum=local_checksum)
             return ReturnData(conn=conn, result=result)