pulp_hashlib.new() fails on FIPS systems for non-security hashes

[kush-gupt]

Version: main (0e52cd7)

Bug: pulp_hashlib.new() calls hashlib.new() without usedforsecurity=False, raising UnsupportedDigestmodError on FIPS-enabled systems when ALLOWED_CONTENT_CHECKSUMS includes md5 or sha1.

Expected: Non-security content-addressing hashes should pass usedforsecurity=False to hashlib.new().

[kush-gupt]

Confirmed on FIPS RHEL 9.7 + Satellite 6.18

Tested on a DISA STIG-hardened RHEL 9.7 VM (FIPS 140-3 enabled at install, SELinux enforcing, fapolicyd enforcing) running Satellite 6.18.

Default ALLOWED_CONTENT_CHECKSUMS includes md5 and sha1. Pushing a container image via podman push triggered:

hashers[algorithm] = getattr(hashlib, algorithm)()
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported

Manifest upload returned HTTP 500. After adding kwargs.setdefault("usedforsecurity", False) to pulp_hashlib.new() and switching receive_artifact() to use it (pulp/pulp_container#2256), the same push returned HTTP 201.

[kush-gupt]

Closing as not needed — Satellite already handles this downstream with an md5-specific usedforsecurity=False patch in pulp_hashlib. The actual bug was in pulp_container's receive_artifact() bypassing pulp_hashlib entirely (pulp/pulp_container#2256).