puppetlabs/puppet — pull request #2453 by jaredjennings (2014-03-19 21:31:39+00:00)
Title: Add parser function digest, that calculates a checksum using the configured `digest_algorithm`

This patch adds the `digest` function to the Puppet language. The `md5` function exists in Puppet presently, but fails on FIPS 140-2 compliant systems. `digest` uses whatever digest algorithm puppet.conf says should be used for files to calculate a checksum.

Just as with puppetlabs#2452, migration concerns are not dealt with: if the `digest_algorithm` setting changes from `md5` to `sha256`, and the manifest specifies that the `digest` of something should be equal to some literal MD5 checksum, it will suddenly be unequal. But if the manifest were to compare the `digest`s of two things instead, that would continue to work seamlessly across transitions, where comparing the `md5`s would begin to cause errors when FIPS 140-2 compliance is enforced.