Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add usedforsecurity=False to usage of md5 for FIPS mode #4317

Open
agemuend opened this issue Aug 9, 2023 · 1 comment
Open

Add usedforsecurity=False to usage of md5 for FIPS mode #4317

agemuend opened this issue Aug 9, 2023 · 1 comment
Milestone

Comments

@agemuend
Copy link

agemuend commented Aug 9, 2023

When trying to install easybuild on FIPS mode system, I get the following message:

File "/[...]/[...]/eb_tmp/lib/python3.6/site-packages/easybuild/tools/filetools.py", line 129, in
CHECKSUM_TYPE_MD5: lambda p: calc_block_checksum(p, hashlib.md5()),
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS

Apparently hashlib offers a named parameter called usedforsecurity for exactly this case, allowing the use of md5 even on security enabled systems: https://docs.python.org/3/library/hashlib.html

@boegel boegel added this to the 4.x milestone Aug 15, 2023
@Micket
Copy link
Contributor

Micket commented May 3, 2024

Slight problem; usedforsecurity is new in python 3.9 and even with EB 5.0 we still allow back to python 3.6 compatibility.

I'm surprised this is triggered in python when that code is just defining a lambda function in a dictionary. It hasn't actually ever called hashlib.md5 yet.
We could restructure this code a bit to avoid that, like moving the md5 stuff into it's own function maybe is enough? Then the error would only occur if we actually tried to compute an md5sum, which I don't think we ever do in the main easyconfig repos.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants