Use usedforsecurity=False when calling hashlib.blake2b to avoid crashing on FIPS enabled systems

[simonw]

As reported here:

• Use of md5 hash causes FIPS error, requires usedforsecurity=False simonw/datasette#2270

Pint currently uses the hashlib.blake2b hashing function:

pint/pint/_vendor/flexparser.py

Lines 1118 to 1123 in 3cc2d36

	_hasher: ty.Callable[
	[
	bytes,
	],
	HasherProtocol,
	] = hashlib.blake2b

On systems with FIPS enabled (I only just learned about these today, see my notes here) this will result in a runtime error that looks something like this:

ValueError: [digital envelope routines] unsupported

The fix as-of Python 3.9 is to pass usedforsecurity=False to the hashlib.blake2b constructor, documented here.

To continue supporting Python 3.8 you can use the pattern I demonstrate in https://til.simonwillison.net/python/md5-fips

def md5_not_usedforsecurity(s):
    try:
        return hashlib.md5(s.encode("utf8"), usedforsecurity=False).hexdigest()
    except TypeError:
        # For Python 3.8 which does not support usedforsecurity=False
        return hashlib.md5(s.encode("utf8")).hexdigest()

[simonw]

Looks like 3.8 isn't supported anyway:

pint/pyproject.toml

Line 29 in 3cc2d36

requires-python = ">=3.9"

[hgrecco]

This has been fixed in flexparser and the fix will be moved into pint.

Also Pint follows NEP29. Next version of Pint will be released in Apr/May and the Minimum Python and Numpy versions will be 3.10+ and 1.23+.

[hgrecco]

This has been fixed.