Task #3644: Go through other python dependencies and find FIPS incompatibilities - Pulp

Actions

Send by e-mail Copy link

Task #3644

closed

Story #3637: As a user, I can run pulp in a FIPS-enabled environment

Go through other python dependencies and find FIPS incompatibilities

Added by daviddavis almost 6 years ago. Updated about 5 years ago.

Status:

CLOSED - COMPLETE

Priority:

Normal

Assignee:

Category:

Sprint/Milestone:

Start date:

Due date:

% Done:

Estimated time:

Platform Release:

Groomed:

Sprint Candidate:

Tags:

Pulp 2

Sprint:

Quarter:

Actions

Copy link

Updated by daviddavis almost 6 years ago

I think the next step is to get a list of all the Pulp dependencies and then go through each codebase and search for keywords like hashlib and md5. Open any issues if stuff is found.

Actions

Copy link

Updated by daviddavis almost 6 years ago

Sprint set to Sprint 37

Actions

Copy link

Updated by dalley almost 6 years ago

Status changed from NEW to ASSIGNED
Assignee set to dalley

Actions

Copy link

Updated by dalley almost 6 years ago

Billiard: https://github.com/celery/billiard/blob/78a5b4592446466afe1020b49b01918cdeaeb9f0/billiard/connection.py#L795L810

Actions

Copy link

Updated by dalley almost 6 years ago

Twine: https://github.com/pypa/twine/blob/7f865141eba1f6f18ace730be0c1a009f9740fa8/twine/package.py#L71

edit: fixed https://github.com/pypa/twine/pull/367

Twisted (maybe. I got a lot of hits): https://github.com/twisted/twisted/search?utf8=%E2%9C%93&q=md5&type=

Actions

Copy link

Updated by dalley almost 6 years ago

I think MD5 codepaths in Twisted should be avoidable but we may need some configuration to make sure that happens. Billiard is tricky. It's a fork of the Python stdlib multiprocessing library and the code using md5 is directly copied. They will almost certainly not be willing to change it.

I'm not sure if we will hit it, but if we do, we will need to carry it ourselves and be very careful about it.

Actions

Copy link