From a9bf629c90ba8b2a23047f457ad926fd5e62b711 Mon Sep 17 00:00:00 2001
From: JonthanaHanh <92574114+JonthanaHanh@users.noreply.github.com>
Date: Tue, 28 Jul 2026 16:56:47 +0700
Subject: [PATCH] fix: add usedforsecurity=False to hashlib.sha1 in
 tui_gateway/server.py (FIPS crash)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The _mcp_rev_hash() function at tui_gateway/server.py:15009 uses hashlib.sha1()
to compute a short revision hash for MCP config changes. On FIPS-enabled
systems (RHEL 8/9, Ubuntu FIPS), this raises ValueError: EVP_DigestInit_ex
disabled for FIPS, crashing the TUI gateway's MCP reload path.

The function is not security-sensitive — it only computes a config fingerprint
for change detection. Adding usedforsecurity=False allows it to run on FIPS
systems, consistent with the existing FIPS fixes in context_compressor.py,
codex_responses_adapter.py, skills_hub.py, and other modules.

Fixes tui_gateway/server.py:15009 (not covered by PR #64808 which only
covered context_compressor + codex_responses_adapter hashlib calls).
---
 tui_gateway/server.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tui_gateway/server.py b/tui_gateway/server.py
index b555504dfe287..9907915eccde4 100644
--- a/tui_gateway/server.py
+++ b/tui_gateway/server.py
@@ -15006,7 +15006,7 @@ def _compute_mcp_rev() -> str:
             sort_keys=True,
             default=str,
         )
-        return hashlib.sha1(rev_src.encode()).hexdigest()[:12]
+        return hashlib.sha1(rev_src.encode(), usedforsecurity=False).hexdigest()[:12]
     except Exception:
         return ""