RHEL 9 CUDA repo: nvidia-container-toolkit package missing SHA256 digest

Accelerated Computing DGX (non-Spark) User Forum
,
1

The nvidia-container-toolkit package and its dependencies in the RHEL 9 CUDA x86_64 repo (specified in the nvidia-dgx-9.repo file) aren’t built with SHA256 digests and therefore get an error when trying to install on a FIPS-compliant DGX-1 system:

$ sudo dnf install nvidia-container-toolkit
<... truncated ...>
Error: Transaction test error:
  package nvidia-container-toolkit-base-1.17.8-1.x86_64 does not verify: no digest
  package libnvidia-container1-1.17.8-1.x86_64 does not verify: no digest
  package libnvidia-container-tools-1.17.8-1.x86_64 does not verify: no digest
  package nvidia-container-toolkit-1.17.8-1.x86_64 does not verify: no digest

Inspecting the rpm file, it appears to only have a SHA1 digest, which isn’t sufficient for FIPS compliance:

$ rpm -K -v nvidia-container-toolkit-1.17.8-1.x86_64.rpm
nvidia-container-toolkit-1.17.8-1.x86_64.rpm:
    Header V4 RSA/SHA512 Signature, key ID d42d0685: OK
    Header SHA1 digest: OK
    Payload SHA256 digest: NOTFOUND
    Payload SHA256 ALT digest: NOTFOUND
    V4 RSA/SHA512 Signature, key ID d42d0685: OK
    MD5 digest: NOTFOUND

Appreciate any assistance with getting these built to a higher security standard, to avoid insecure workarounds.

2

Thanks for reporting that @mrybc . We’ve created a bug to track this, and see if we can switch to or add SHA256 digests to the RHEL repo files. I’ll report back here when the update gets pushed to the repo.

In the meantime, if this is blocking you, please make a support case with NVIDIA Enterprise Support - they can help navigate fix.

ScottE

1 Like
3

Thanks @ScottEllis.

We have admin access to our systems so it’s not blocking. Workaround is to temporarily disable RPM digest checks by setting %_pkgverify_level none (documentation in /usr/lib/rpm/macros), after which the packages install fine.

That’s obviously not ideal, so thanks for creating a bug report.

4

Hello, just following up to confirm that this is still an issue with the latest1.18.0-1 update of the nvidia-container-toolkit package.