Pulp

I think the next step is to get a list of all the Pulp dependencies and then go through each codebase and search for keywords like hashlib and md5. Open any issues if stuff is found.

Billiard: https://github.com/celery/billiard/blob/78a5b4592446466afe1020b49b01918cdeaeb9f0/billiard/connection.py#L795L810

Twine: https://github.com/pypa/twine/blob/7f865141eba1f6f18ace730be0c1a009f9740fa8/twine/package.py#L71

edit: fixed https://github.com/pypa/twine/pull/367

Twisted (maybe. I got a lot of hits): https://github.com/twisted/twisted/search?utf8=%E2%9C%93&q=md5&type=

I think MD5 codepaths in Twisted should be avoidable but we may need some configuration to make sure that happens. Billiard is tricky. It's a fork of the Python stdlib multiprocessing library and the code using md5 is directly copied. They will almost certainly not be willing to change it.

I'm not sure if we will hit it, but if we do, we will need to carry it ourselves and be very careful about it.