[Bug]: system.assets generated hash uses md5(), which fails with PostgreSQL 18.4/OpenSSL FIPS

Preflight Checklist

• I could not find an existing issue for this behavior.

ZITADEL Version

Observed with ghcr.io/zitadel/zitadel:v4.11.0; current main still appears to create the same schema in cmd/setup/02.go.

Environment

• PostgreSQL 18.4
• OpenSSL-backed PostgreSQL build
• OpenSSL/FIPS policy active in the PostgreSQL runtime

Current Behavior

system.assets.hash is generated with md5(data):

hash TEXT GENERATED ALWAYS AS (md5(data)) STORED

When PostgreSQL 18.4 is running with an OpenSSL/FIPS policy that disables MD5, any insert/import into system.assets fails while computing the generated column.

Example error:

ERROR: could not compute MD5 hash: unsupported

This affected importing/exporting ZITADEL assets. A dump that inserts only these columns fails because PostgreSQL still computes the generated hash column:

INSERT INTO system.assets (
  instance_id,
  asset_type,
  resource_owner,
  name,
  content_type,
  data,
  updated_at
) VALUES (...);

The issue can be reproduced directly with:

select md5('abc'::bytea);

Under the affected PostgreSQL 18.4/OpenSSL FIPS runtime this returns:

ERROR: could not compute MD5 hash: unsupported

Expected Behavior

ZITADEL's database schema should avoid non-FIPS crypto primitives when running in FIPS-capable/FIPS-required environments, or provide a migration/configuration path for the asset hash column.

For example, system.assets.hash could use a FIPS-compatible digest such as SHA-256:

hash TEXT GENERATED ALWAYS AS (encode(sha256(data), 'hex')) STORED

A local rollback-only test using this expression allowed the same asset import to succeed.

Steps to Reproduce

1. Run PostgreSQL 18.4 with OpenSSL/FIPS policy active so MD5 is unsupported.
2. Create/run ZITADEL with the default system.assets schema.
3. Insert or import any asset row into system.assets.
4. Observe the insert fail while computing md5(data).

Additional Context

Recent ZITADEL versions include application/runtime FIPS work, including FIPS defaults for password and secret hashers, but the database schema for system.assets.hash still uses md5(data) on current main as of commit 14874d654.