gh-127298: When in FIPS mode ensure builtin hashes check for usedforsecurity=False by xnox · Pull Request #127301 · python/cpython · GitHub

github.com

Tin mới

xnox:hashlib-builtin-fips-check

GitHub CopilotWrite better code with AI

GitHub Copilot appDirect agents from issue to merge

ActionsAutomate any workflow

CodespacesInstant dev environments

IssuesPlan and track work

Code ReviewManage code changes

Code QualityEnforce quality at merge

GitHub Advanced SecurityFind and fix vulnerabilities

Code securitySecure your code as you build

Secret protectionStop leaks before they start

View all use cases

Financial services

View all industries

Software Development

GitHub SponsorsFund open source developers

Copilot for BusinessEnterprise-grade AI features

Premium SupportEnterprise-grade 24/7 support

Pull requests 2.6k

Security and quality 0

Ensure builtin hashlib implementations honor usedforsecurity=True when _hashlib is in FIPS mode #127298

[3.12] gh-118224: Load default OpenSSL provider for nonsecurity algorithms (GH-118236) #118238

gh-118224: Load default OpenSSL provider for nonsecurity algorithms #118236

https://github.com/aiidateam/aiida-core/blob/f74adb94cc1e8439c8076f563ec112466fdd174b/src/aiida/common/hashing.py#L78

The built-in algorithms are based on HACL* and are therefore formally verified implementations. So I'm not entirely sure we can say that they are entirely FIPS unapproved (except that some algorithms, whatever their imem

🔨 test-with-buildbots

View reviewed changes

Learn more about hiding disruptive comments

The reason will be displayed to describe this comment to others. Learn more.

fix python fips detection and blocking of blake2

chainguard-dev/internal-dev#11886

: When in FIPS mode ensure builtin hashes check for us…

use != 0 rather than == 1 and update a comment.

Update the NEWS to reflect reality.

address _some_ correctness details in the test.

avoid repeated calls, reword comment.

Update 2024-11-26-16-31-40.gh-issue-127298.jqYJvn.rst

avoid rerunning test in refleak hunting mode.

Change to spawn _test_hashlib_fips from test_hashlib with an env.

Use subTest to id the algorithm.

remove the no longer appropriate mention from ssltests.

fix subTest context manager nesting.

Use null provider, which is guaranteed to have nothing

github-actions Bot commented Apr 20, 2026

This PR is stale because it has been open for 30 days with no activity.

[TRTLLMINF-191][infra] Use native pytest capture for S3 logs NVIDIA/TensorRT-LLM#16739