Theia should work on a FIPS-compliant system

[azatsarynnyy]

Bug Description:

When running in a FIPS-compliant environment, Theia fails with:

...
2020-08-13 16:26:00.637 root ERROR Request getHostStoragePath failed with error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS Params: Error: error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
    at new Hash (internal/crypto/hash.js:33:18)
    at Object.createHash (crypto.js:101:10)
    at PluginPathsServiceImpl.<anonymous> (/home/theia/node_modules/@theia/plugin-ext/lib/main/node/paths/plugin-paths-service.js:158:58)
    at step (/home/theia/node_modules/@theia/plugin-ext/lib/main/node/paths/plugin-paths-service.js:57:23)
    at Object.next (/home/theia/node_modules/@theia/plugin-ext/lib/main/node/paths/plugin-paths-service.js:38:53)
    at fulfilled (/home/theia/node_modules/@theia/plugin-ext/lib/main/node/paths/plugin-paths-service.js:29:58)
...

Frontend is loaded partially:

Steps to Reproduce:

Run Theia in a FIPS-compliant environment.

Additional Information

• Operating System: Red Hat Enterprise Linux 8.2
• Theia Version: 1.4.0

FIPS (Federal Information Processing Standard) 140-2 ensures that cryptographic tools implement their algorithms properly.
When Linux is running in FIPS mode, it switches all the core crypto components to work with FIPS-approved algorithms only (e.g., AES, SHA2-256, RSA). All non-approved (weak) algorithms are blocked (e.g. MD5).

Eclipse Theia uses NodeJS crypto module which is a wrapper for OpenSSL cryptographic functions. There are places in the code where both MD5 and SHA256 algorithms are used:

theia/dev-packages/electron/electron-ffmpeg-lib.js

Line 33 in 51e4c70

const sha256 = crypto.createHash('sha256');

theia/packages/plugin-ext/src/main/node/paths/plugin-paths-service.ts

Line 87 in 51e4c70

return crypto.createHash('md5').update(rootsStr).digest('hex');

The use of MD5 is disallowed in any FIPS-compliant system, thus the Linux kernel (and OpenSSL) will not make it available when a system is running in a FIPS mode.

Possible solution

To fix that, I propose to replace using weak MD5 with the FIPS-approved SHA256 algorithm.