DigestAuth class definition crashes on FIPS-enforced Python (hashlib.md5 unavailable)

[mwatkins-ld]

On FIPS-enforced Python images, hashlib.md5 is not registered as a module attribute. This prevents httpx2 from being imported because DigestAuth references hashlib.md5 as a class-level attribute:

https://github.com/pydantic/httpx2/blob/main/src/httpx2/httpx2/_auth.py#L171-L172

# httpx2/_auth.py
class DigestAuth(Auth):
    _ALGORITHM_TO_HASH_FUNCTION: dict[str, typing.Callable[[bytes], _Hash]] = {
        "MD5": hashlib.md5,          # <-- AttributeError on FIPS images without md5 support
        "MD5-SESS": hashlib.md5,
        ...
    }

Since this is evaluated at class definition time, it crashes when the module is imported, regardless of whether DigestAuth is ever used.

Reproduction

On a FIPS-enforced Python image:

$ python -c "import httpx2"

File "httpx2/_auth.py", line 169, in <module>
  class DigestAuth(Auth):
File "httpx2/_auth.py", line 171, in DigestAuth
  "MD5": hashlib.md5,
         ^^^^^^^^^^^
AttributeError: module 'hashlib' has no attribute 'md5'

Suggested fix

Conditionally register MD5 so the class defines without error on FIPS systems:

_ALGORITHM_TO_HASH_FUNCTION: dict[str, typing.Callable[[bytes], _Hash]] = {
    "SHA": hashlib.sha1,
    "SHA-SESS": hashlib.sha1,
    "SHA-256": hashlib.sha256,
    "SHA-256-SESS": hashlib.sha256,
    "SHA-512": hashlib.sha512,
    "SHA-512-SESS": hashlib.sha512,
}
if hasattr(hashlib, "md5"):
    _ALGORITHM_TO_HASH_FUNCTION["MD5"] = hashlib.md5
    _ALGORITHM_TO_HASH_FUNCTION["MD5-SESS"] = hashlib.md5

This preserves full MD5 Digest Auth support on non-FIPS systems while allowing httpx2 to be imported on FIPS-enforced environments. Users who attempt MD5 Digest Auth on a FIPS system would get a clear KeyError at runtime rather than the entire library being unimportable.

Even though Python 3.9 added support to hashlib usedForSecurity kwarg
False indicates that the hashing algorithm is not used in a security context, e.g. as a non-cryptographic one-way compression function. this does not feel like the correct fix since this is used in a security context for authentication and not strictly for checksums, cache keys, or some other non-security related functionality.

Current Workaround

We currently use a sitecustomize.py that stubs hashlib.md5 with a function that raises ValueError if called:

import hashlib

def _fips_unavailable_md5(*args, **kwargs):
    raise ValueError("md5 is not available in FIPS mode")

if not hasattr(hashlib, "md5"):
    hashlib.md5 = _fips_unavailable_md5

This prevents the import crash but is a workaround we'd prefer not to do this because it requires explanations on why it appears like an unapproved algorithm is being stubbed.

[mwatkins-ld]

PR: #1130