`GODEBUG=fips140=only` Importing `github.com/vmware/govmomi/simulator` panics

[michel-laterman]

Tests that import github.com/vmware/govmomi/simulator will panic when loading if GODEBUG=fips140=only is set.

This is due to SHA-1 usage in simulator/vpx

govmomi/simulator/vpx/service_content.go

Line 32 in 8d78f54

InstanceUuid: uuid.NewSHA1(uuid.NameSpaceOID, uuid.NodeID()).String(),

This failure is also present when running unit tests for simulator:

simulator|main ⇒ GODEBUG=fips140=only go test ./...
panic: crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode

goroutine 1 [running]:
crypto/sha1.(*digest).checkSum(0x10145ca80?)
	/usr/local/go/src/crypto/sha1/sha1.go:160 +0x180
crypto/sha1.(*digest).Sum(0x140000928c0, {0x0, 0x0, 0x0})
	/usr/local/go/src/crypto/sha1/sha1.go:154 +0x6c
github.com/google/uuid.NewHash({0x10167d000, 0x140000928c0}, {0x6b, 0xa7, 0xb8, 0x12, 0x9d, 0xad, 0x11, 0xd1, ...}, ...)
	/Users/mlaterman/go/pkg/mod/github.com/google/uuid@v1.6.0/hash.go:37 +0xbc
github.com/google/uuid.NewSHA1({0x6b, 0xa7, 0xb8, 0x12, 0x9d, 0xad, 0x11, 0xd1, 0x80, 0xb4, ...}, ...)
	/Users/mlaterman/go/pkg/mod/github.com/google/uuid@v1.6.0/hash.go:58 +0x98
github.com/vmware/govmomi/simulator/vpx.init()
	/Users/mlaterman/git/govmomi/simulator/vpx/service_content.go:32 +0x2d8
FAIL	github.com/vmware/govmomi/simulator	0.521s
?   	github.com/vmware/govmomi/simulator/esx	[no test files]
?   	github.com/vmware/govmomi/simulator/internal	[no test files]
?   	github.com/vmware/govmomi/simulator/vpx	[no test files]
FAIL

[github-actions]

Howdy 🖐   michel-laterman ! Thank you for your interest in this project. We value your feedback and will respond soon.

If you want to contribute to this project, please make yourself familiar with the CONTRIBUTION guidelines.

[michel-laterman]

Note that even if that UUID is changed using GODEBUG=fips140=only will still result in a failure:

simulator|main⚡ ⇒ GODEBUG=fips140=only go test ./...
--- FAIL: TestClusterESX (0.01s)
panic: crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode [recovered]
	panic: crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode

goroutine 23 [running]:
testing.tRunner.func1.2({0x1058066c0, 0x105b2b1d0})
	/usr/local/go/src/testing/testing.go:1734 +0x1ac
testing.tRunner.func1()
	/usr/local/go/src/testing/testing.go:1737 +0x334
panic({0x1058066c0?, 0x105b2b1d0?})
	/usr/local/go/src/runtime/panic.go:787 +0x124
crypto/sha1.Sum({0x14000326700?, 0x0?, 0x0?})
	/usr/local/go/src/crypto/sha1/sha1.go:273 +0x104
github.com/vmware/govmomi/vim25/soap.ThumbprintSHA1(0x34b?)
	/Users/mlaterman/git/govmomi/vim25/soap/client.go:404 +0x34
github.com/vmware/govmomi/object.(*HostCertificateInfo).FromCertificate(0x14000452bc0, 0x1400009c608)
	/Users/mlaterman/git/govmomi/object/host_certificate_info.go:49 +0x118
github.com/vmware/govmomi/object.(*HostCertificateInfo).FromPEM(0x14000452bc0, {0x1400001e500?, 0x49b?, 0x0?})
	/Users/mlaterman/git/govmomi/object/host_certificate_info.go:68 +0x68
github.com/vmware/govmomi/simulator.(*HostCertificateManager).InstallServerCertificate(0x140003a6090, 0x140000e8000?, 0x14000452e68)
	/Users/mlaterman/git/govmomi/simulator/host_certificate_manager.go:53 +0x94
github.com/vmware/govmomi/simulator.NewHostCertificateManager(...)
	/Users/mlaterman/git/govmomi/simulator/host_certificate_manager.go:41
github.com/vmware/govmomi/simulator.NewHostSystem(_, {{{{{...}, {...}, {...}}, {0x0, 0x0, 0x0}, {0x0, 0x0, 0x0}}, ...}, ...})
	/Users/mlaterman/git/govmomi/simulator/host_system.go:99 +0x82c
github.com/vmware/govmomi/simulator.CreateDefaultESX(0x140003a8780, 0x105b2d560?)
	/Users/mlaterman/git/govmomi/simulator/host_system.go:427 +0x5c
github.com/vmware/govmomi/simulator.NewServiceInstance(_, {{}, {{0x1054bfd42, 0x6}, {0x1054c9c2e, 0xe}, {0x0, 0x0}}, {{0x1054d02be, 0x11}, ...}, ...}, ...)
	/Users/mlaterman/git/govmomi/simulator/service_instance.go:36 +0x190
github.com/vmware/govmomi/simulator.TestClusterESX(0x14000103880)
	/Users/mlaterman/git/govmomi/simulator/cluster_compute_resource_test.go:26 +0x90
testing.tRunner(0x14000103880, 0x105b270b0)
	/usr/local/go/src/testing/testing.go:1792 +0xe4
created by testing.(*T).Run in goroutine 1
	/usr/local/go/src/testing/testing.go:1851 +0x374
FAIL	github.com/vmware/govmomi/simulator	0.452s
?   	github.com/vmware/govmomi/simulator/esx	[no test files]
?   	github.com/vmware/govmomi/simulator/internal	[no test files]
?   	github.com/vmware/govmomi/simulator/vpx	[no test files]
FAIL

[dougm]

Thanks @michel-laterman , can you review and try out #3775 ?

[michel-laterman]

Thanks! Your PR fixes the issues that we have.

[michel-laterman]

@dougm, is there an eta for a new patch or minor version release?