GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-118224: Load default OpenSSL provider for nonsecurity algorithms by xnox · Pull Request #118236 · python/cpython

Conversation

@xnox

@xnox xnox commented Apr 24, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

When OpenSSL is configured to only load "base+fips" providers into the Null library context, md5 might not be available at all. In such cases currently CPython fallsback to internal hashlib implementation is there is one - as there might not be if one compiles python with --with-builtin-hashlib-hashes=blake2. With this change "default" provider is attempted to be loaded to access nonsecurity hashes.

It is FedRAMP/FIPS compliance by-pass. This issue may allow using md5 without specifying "usedforsecurity=False" on systems otherwise configured to be in FIPS-mode only. And is the primary reason why documentation mentions that certain distributions of python remove md5 module altogether.

  • Issue: Fallback md5 is used, when trying hard to only use OpenSSL #118224

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@xnox
pythongh-118224: Load default OpenSSL provider for nonsecurity algori…
c8adf9e
…thms

When OpenSSL is configured to only load "base+fips" providers into the
Null library context, md5 might not be available at all. In such cases
currently CPython fallsback to internal hashlib implementation is
there is one - as there might not be if one compiles python with
--with-builtin-hashlib-hashes=blake2. With this change "default"
provider is attempted to be loaded to access nonsecurity hashes.
@ghost

ghost commented Apr 24, 2024 •
edited by ghost
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot mentioned this pull request Apr 24, 2024
Fallback md5 is used, when trying hard to only use OpenSSL #118224
Open
@bedevere-app

bedevere-app Bot commented Apr 24, 2024

Copy link
Copy Markdown

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app bedevere-app Bot added the awaiting review label Apr 24, 2024
@bedevere-app

bedevere-app Bot commented Apr 24, 2024

Copy link
Copy Markdown

GH-118238 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Apr 24, 2024

Copy link
Copy Markdown

GH-118239 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@bedevere-app

bedevere-app Bot commented Apr 24, 2024

Copy link
Copy Markdown

GH-118240 is a backport of this pull request to the 3.10 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox
xnox force-pushed the fix-nodefault-md5 branch from 7a5adff to 092ab97 Compare April 24, 2024 21:47
@xnox
Add blurb
a47a53f
@xnox
xnox force-pushed the fix-nodefault-md5 branch from 092ab97 to a47a53f Compare April 24, 2024 22:29
@bedevere-app

bedevere-app Bot commented Apr 25, 2024

Copy link
Copy Markdown

GH-118264 is a backport of this pull request to the 3.9 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nineteendo

nineteendo commented Apr 25, 2024

Copy link
Copy Markdown
Contributor

Could you also configure pre-commit? https://devguide.python.org/getting-started/setup-building/#install-pre-commit

xnox reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox

xnox commented May 7, 2024

Copy link
Copy Markdown
Author

Could you also configure pre-commit? https://devguide.python.org/getting-started/setup-building/#install-pre-commit

@nineteendo is there something in particular that you have noticed that pre-commit should have caught?

I have now setup pre-commit, redid the commits and the checks executed and resulted in exactly the same commit, without any diff / warnings / comments.

Is my .c code style incorrect and pre-commit not catching it?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nineteendo

nineteendo commented May 7, 2024

Copy link
Copy Markdown
Contributor

This workflow failed: https://github.com/python/cpython/actions/runs/8823736225/job/24224829127#step:4:142
But I can't find the commit where it failed. Do you remember replacing the backticks?

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox

xnox commented May 7, 2024 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Author

This workflow failed: https://github.com/python/cpython/actions/runs/8823736225/job/24224829127#step:4:142 But I can't find the commit where it failed. Do you remember replacing the backticks?

yes, after the initial blurb-it there was comment about single ticks; which i replaced with double backticks and rewrote all commits in all branches/backports.

Is double-backticks appropriate formatting for the NEWS entry as currently seen on https://github.com/python/cpython/pull/118236/files ?

ps. maybe the blurb-it service needs pre-commit checking / checks for single backticks.

nineteendo reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox

xnox commented May 7, 2024

Copy link
Copy Markdown
Author

note, the up to date re-runs of actions are all passing on this pull request.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nineteendo

nineteendo commented May 7, 2024

Copy link
Copy Markdown
Contributor

and rewrote all commits in all branches/backports.

Did you do a rebase or delete the old branch? Because I can't find that commit.

Is double-backticks appropriate formatting

Looks like it, '``--[^`]+``' is used 294 times, and '``--[^`]+=[^`]+``' 25 times.

maybe the blurb-it service needs pre-commit checking / checks for single backticks.

Yeah, I was thinking that too.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox

xnox commented May 7, 2024

Copy link
Copy Markdown
Author

and rewrote all commits in all branches/backports.

Did you do a rebase or delete the old branch? Because I can't find that commit.

rebase, all commits are documented in this PR. If you use web-ui or extensive API, you can see these mentions:

@xnox xnox force-pushed the fix-nodefault-md5 branch from 7a5adff to 092ab97
2 weeks ago

@xnox force-pushed the fix-nodefault-md5 branch from 092ab97 to a47a53f
2 weeks ago

You can click on those commits to still see them dangling and not part of any branch or pull request.

7a5adff was the blurb-it service generated entry.

a47a53f is the current state of this pull request, which was fixed-up with double backticks.

nineteendo reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox

xnox commented Nov 26, 2024

Copy link
Copy Markdown
Author

a better design is available in:

  • gh-127298: When in FIPS mode ensure builtin hashes check for usedforsecurity=False #127301
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@xnox xnox closed this Nov 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@xnox @nineteendo
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.