Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

export_requirements fails on FIPS-enabled systems #1226

Open
ejbolt opened this issue Aug 16, 2024 · 0 comments
Open

export_requirements fails on FIPS-enabled systems #1226

ejbolt opened this issue Aug 16, 2024 · 0 comments

Comments

@ejbolt
Copy link

ejbolt commented Aug 16, 2024

We're testing our project on FIPS-enabled systems, and currently when we execute poetry run nox, we get the following error:

nox > Session test-3.11 raised exception UnsupportedDigestmodError('[digital envelope routines] unsupported')
Traceback (most recent call last):
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox/sessions.py", line 995, in execute
    self.func(session)
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox/_decorators.py", line 86, in __call__
    return self.func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox_poetry/sessions.py", line 43, in wrapper
    function(proxy, *_args, **_kwargs)
  File "/builds/test/test/noxfile.py", line 43, in test
    s.install(
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox_poetry/sessions.py", line 292, in install
    return self.poetry.install(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox_poetry/sessions.py", line 147, in install
    requirements = self.export_requirements()
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/test/.cache/pypoetry/virtualenvs/test-4pXmM19U-py3.11/lib/python3.11/site-packages/nox_poetry/sessions.py", line 224, in export_requirements
    digest = hashlib.blake2b(lockdata).hexdigest()
             ^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
nox > Session test-3.11 failed.

This is due to blake2b not being a FIPS-compliant algorithm.

From what I can see, this could be solved by changing the algorithm to sha256 or another compliant algorithm, or setting usedforsecurity=False. As I understand it, this hashing is just used to check that the exported requirements.txt hasn't changed, so it would be fine to set the second option. Could this be done? We love this integration and it makes our testing and integration much easier.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant