FIPS issue when upgrading cluster from CentOS7 to CentOS8 and erlang 20 -> 23

[bdoyle0182]

Hi,

I'm trying to upgrade a cluster to use centos8 instead of centos7 and upgrade the underlying erlang from 20 to 23. The couchdb version is 3.2.0.

When trying to start couchdb I consistently get this error even after tweaking a few things under the hood on the installation.

{"Kernel pid terminated",application_controller,"{application_start_failure,couch_epi,{{shutdown,{failed_to_start_child,\"couch_epi|chttpd_auth|keeper\",{notsup,[{crypto,notsup_to_error,1,[{file,\"crypto.erl\"},{line,2571}]},{couch_epi_util,hash,1,[{file,\"src/couch_epi_util.erl\"},{line,25}]},{couch_epi_functions,data,1,[{file,\"src/couch_epi_functions.erl\"},{line,33}]},{couch_epi_module_keeper,do_reload_if_updated,1,[{file,\"src/couch_epi_module_keeper.erl\"},{line,116}]},{gen_server,init_it,2,[{file,\"gen_server.erl\"},{line,417}]},{gen_server,init_it,6,[{file,\"gen_server.erl\"},{line,385}]},{proc_lib,init_p_do_apply,3,[{file,\"proc_lib.erl\"},{line,226}]}]}}},{couch_epi_app,start,[normal,[]]}}}"}

which led me to this old issue #1445 and then this documentation about FIPS mode https://docs.couchdb.org/en/3.2.2-docs/install/troubleshooting.html#fips-mode.

I'm not sure where that --erlang-md5 is supposed to be set whether somewhere on the installation or when starting the couchdb process. I've tried adding it to starting couchdb like so /bin/couchdb --erlang-md5 and still get the same issue. Or if the issue could be something else entirely. Any help would be greatly appreciated.

[nickva]

-erlang-md5 is a configure option.

./configure --dev --erlang-md5
make
make release

So you'd have to grab the tgz release source file and then ./configure it and build it.

If you happen to use docker you can build in there we have a CI image we use to build packages:

docker pull apache/couchdbci-centos:7-erlang-24.3.4.7

[bdoyle0182]

yes I forgot to mention I'm building from source already so familiar with ./configure. Is the --dev flag needed? Thank you though this is what I was looking for I will test this out!

[bdoyle0182]

that worked thank you very much!

I think the documentation could be updated for that troubleshooting step on where that flag needs to go in the installation from source.

[nickva]

--dev is to avoid building Fauxton and docs. I was just using it as a habit since it shortens the compile time.

But if you really don't use Fauxton or don't need docs, you can try building it that way as well.

[big-r81]

@bdoyle0182
Would you like to open a PR and add a fix for the documentation, because you knows best what needs to be changed in the docs?