From e9cc151ebe818137e8700faa7f431f0bd19cf63d Mon Sep 17 00:00:00 2001 From: Kush Gupta Date: Mon, 9 Mar 2026 21:58:38 -0400 Subject: [PATCH] Fix pulp_hashlib.new() on FIPS systems Pass usedforsecurity=False to hashlib.new() since all hashes produced by this wrapper are used for content addressing (storage paths, dedup, manifest IDs), never for cryptographic security. closes #7434 Signed-off-by: Kush Gupta Made-with: Cursor --- CHANGES/7434.bugfix | 1 + pulpcore/app/pulp_hashlib.py | 1 + 2 files changed, 2 insertions(+) create mode 100644 CHANGES/7434.bugfix diff --git a/CHANGES/7434.bugfix b/CHANGES/7434.bugfix new file mode 100644 index 00000000000..2e2b3cd3016 --- /dev/null +++ b/CHANGES/7434.bugfix @@ -0,0 +1 @@ +Added ``usedforsecurity=False`` to ``pulp_hashlib.new()`` so FIPS-disallowed algorithms used for content addressing no longer raise ``UnsupportedDigestmodError``. diff --git a/pulpcore/app/pulp_hashlib.py b/pulpcore/app/pulp_hashlib.py index 604709b4daa..3e40081e8d2 100644 --- a/pulpcore/app/pulp_hashlib.py +++ b/pulpcore/app/pulp_hashlib.py @@ -33,4 +33,5 @@ def new(name, *args, **kwargs): "setting" ).format(name) ) + kwargs.setdefault("usedforsecurity", False) return the_real_hashlib.new(name, *args, **kwargs)