Repository: create-react-app
Issue: build fails when FIPS is enabled
Labels: needs triage,issue: bug report

### Describe the bug
The command `npm run build` (see bellow) fails when FIPS is enabled.

### Did you try recovering your dependencies?
N/A 
* Without FIPS it works (with the same dependencies)
* I have just launched `npm init react-app my-app` and then `npm run build` - no other changes. 

### Which terms did you search for in User Guide?
* All sections in `troubleshooting` starting with `npm run build`
* Creating a Production Build

### Environment

```
~projects/cra-test $ npx create-react-app --info
npx: installed 67 in 18.893s

Environment Info:

  current version of create-react-app: 4.0.3
  running from /root/.npm/_npx/1641/lib/node_modules/create-react-app

  System:
    OS: Linux 4.18 Red Hat Enterprise Linux 8.3 (Ootpa)
    CPU: (1) x64 Intel Core Processor (Skylake, IBRS)
  Binaries:
    Node: 12.18.2 - /usr/bin/node
    Yarn: Not Found
    npm: 6.14.13 - /usr/local/bin/npm
  Browsers:
    Chrome: Not Found
    Firefox: Not Found
  npmPackages:
    react: Not Found
    react-dom: Not Found
    react-scripts: Not Found
  npmGlobalPackages:
    create-react-app: Not Found
```

### Steps to reproduce
1. Check fips mode
```
~projects/cra-test $ fips-mode-setup --check
FIPS mode is enabled.
```

2. Init app
```
~projects/cra-test $ npm init react-app my-app
npx: installed 67 in 5.748s
...
Happy hacking!
```

3. Build app
```
~projects/cra-test $ cd my-app
~projects/cra-test/my-app master $ npm run build

> my-app@0.1.0 build /root/projects/cra-test/my-app
> react-scripts build

Creating an optimized production build...
Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
    at new Hash (internal/crypto/hash.js:48:19)
    at Object.createHash (crypto.js:111:10)
    at module.exports (/root/projects/cra-test/my-app/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:417:16)
    at handleParseError (/root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:471:10)
    at /root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:503:5
    at /root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:358:12
    at /root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:373:3
    at iterateNormalLoaders (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:214:10)
    at iterateNormalLoaders (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:221:10)
    at /root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:236:3
    at runSyncOrAsync (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:130:11)
    at iterateNormalLoaders (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:232:2)
    at Array.<anonymous> (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:205:4)
    at Storage.finished (/root/projects/cra-test/my-app/node_modules/enhanced-resolve/lib/CachedInputFileSystem.js:55:16)
    at /root/projects/cra-test/my-app/node_modules/enhanced-resolve/lib/CachedInputFileSystem.js:91:9
/root/projects/cra-test/my-app/node_modules/react-scripts/scripts/build.js:19
  throw err;
  ^

Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
    at new Hash (internal/crypto/hash.js:48:19)
    at Object.createHash (crypto.js:111:10)
    at module.exports (/root/projects/cra-test/my-app/node_modules/webpack/lib/util/createHash.js:135:53)
    at NormalModule._initBuildHash (/root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:417:16)
    at /root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:452:10
    at /root/projects/cra-test/my-app/node_modules/webpack/lib/NormalModule.js:323:13
    at /root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:367:11
    at /root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:233:18
    at context.callback (/root/projects/cra-test/my-app/node_modules/loader-runner/lib/LoaderRunner.js:111:13)
    at /root/projects/cra-test/my-app/node_modules/babel-loader/lib/index.js:59:103 {
  library: 'digital envelope routines',
  function: 'EVP_DigestInit_ex',
  reason: 'disabled for FIPS',
  code: 'ERR_OSSL_EVP_DISABLED_FOR_FIPS'
}
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! my-app@0.1.0 build: `react-scripts build`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the my-app@0.1.0 build script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-07-16T15_49_57_944Z-debug.log
```



### Expected behavior
Successful build.

### Actual behavior
See reproducer above.


### Reproducible demo
N/A - build fails on unchanged generated sources.

### Additional info
After inspection of traceback and some debuging I found that problem is with `md4` algorithm used form `node_modules/webpack/lib/util/createHash.js`. I patched installed `node_modules/webpack` a bit:
* changed `md4` to `sha256` everywhere
* added log to `node_modules/webpack/lib/util/createHash.js` (to show that this place no longer causes the issue)
```javascript
console.log(`---> algorithm: ${algorithm}`);
```

Now, the build the build has moved on but then failed anyway:
```
~projects/cra-test/my-app master $ npm run build

> my-app@0.1.0 build /root/projects/cra-test/my-app
> react-scripts build

Creating an optimized production build...
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
---> algorithm: sha256
Failed to compile.

./src/index.js
Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
    at Generator.next (<anonymous>)
    at new Promise (<anonymous>)
    at Generator.next (<anonymous>)


npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! my-app@0.1.0 build: `react-scripts build`
npm ERR! Exit status 1
npm ERR! 
npm ERR! Failed at the my-app@0.1.0 build script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-07-16T16_48_35_749Z-debug.log
```
Content of the mentioned log:
```
~projects/cra-test/my-app master $ cat /root/.npm/_logs/2021-07-16T16_48_35_749Z-debug.log
0 info it worked if it ends with ok
1 verbose cli [ '/usr/bin/node', '/usr/local/bin/npm', 'run', 'build' ]
2 info using npm@6.14.13
3 info using node@v12.18.2
4 verbose run-script [ 'prebuild', 'build', 'postbuild' ]
5 info lifecycle my-app@0.1.0~prebuild: my-app@0.1.0
6 info lifecycle my-app@0.1.0~build: my-app@0.1.0
7 verbose lifecycle my-app@0.1.0~build: unsafe-perm in lifecycle true
8 verbose lifecycle my-app@0.1.0~build: PATH: /usr/local/lib/node_modules/npm/node_modules/npm-lifecycle/node-gyp-bin:/root/projects/cra-test/my-app/node_modules/.bin:/root/.pyenv/bin:/root/.local/bin:/root/bin:/root/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/root/.fzf/bin:/root/bin:/root/bin:/root/bin:/root/n/bin
9 verbose lifecycle my-app@0.1.0~build: CWD: /root/projects/cra-test/my-app
10 silly lifecycle my-app@0.1.0~build: Args: [ '-c', 'react-scripts build' ]
11 silly lifecycle my-app@0.1.0~build: Returned: code: 1  signal: null
12 info lifecycle my-app@0.1.0~build: Failed to exec build script
13 verbose stack Error: my-app@0.1.0 build: `react-scripts build`
13 verbose stack Exit status 1
13 verbose stack     at EventEmitter.<anonymous> (/usr/local/lib/node_modules/npm/node_modules/npm-lifecycle/index.js:332:16)
13 verbose stack     at EventEmitter.emit (events.js:315:20)
13 verbose stack     at ChildProcess.<anonymous> (/usr/local/lib/node_modules/npm/node_modules/npm-lifecycle/lib/spawn.js:55:14)
13 verbose stack     at ChildProcess.emit (events.js:315:20)
13 verbose stack     at maybeClose (internal/child_process.js:1021:16)
13 verbose stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:286:5)
14 verbose pkgid my-app@0.1.0
15 verbose cwd /root/projects/cra-test/my-app
16 verbose Linux 4.18.0-240.el8.x86_64
17 verbose argv "/usr/bin/node" "/usr/local/bin/npm" "run" "build"
18 verbose node v12.18.2
19 verbose npm  v6.14.13
20 error code ELIFECYCLE
21 error errno 1
22 error my-app@0.1.0 build: `react-scripts build`
22 error Exit status 1
23 error Failed at the my-app@0.1.0 build script.
23 error This is probably not a problem with npm. There is likely additional logging output above.
```

When I disable fips, the build succeeds even with this webpack patch:
```
~projects/cra-test/my-app master $ npm run build
                                                                                                                                                                                                                                                                                                                                                                             
> my-app@0.1.0 build /root/projects/cra-test/my-app
> react-scripts build

Creating an optimized production build...
---> algorithm: sha256
... many same logs ...
---> algorithm: sha256
Compiled successfully.

File sizes after gzip:

  41.34 KB  build/static/js/2.36039d57.chunk.js
  1.63 KB   build/static/js/3.63ff497a.chunk.js
  1.17 KB   build/static/js/runtime-main.8ef7d874.js
  591 B     build/static/js/main.00df6db0.chunk.js
  557 B     build/static/css/main.1390b692.chunk.css

The project was built assuming it is hosted at /.
You can control this with the homepage field in your package.json.

The build folder is ready to be deployed.
You may serve it with a static server:

  npm install -g serve
  serve -s build

Find out more about deployment here:

  https://cra.link/deployment

```
So, it looks like there is something that is not compliant with FIPS besides webpack.