Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix detection of FIPS mode for blake2b #879

Merged
merged 3 commits into from Feb 28, 2022
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog/879.bugfix.rst
@@ -0,0 +1 @@
Improve detection of disabled BLAKE2 hashing due to FIPS mode.
5 changes: 3 additions & 2 deletions tests/test_package.py
Expand Up @@ -307,9 +307,10 @@ def test_fips_hash_manager_md5(monkeypatch):
assert hasher.hexdigest() == hashes


def test_fips_hash_manager_blake2(monkeypatch):
@pytest.mark.parametrize("exception_class", [TypeError, ValueError])
def test_fips_hash_manager_blake2(exception_class, monkeypatch):
"""Generate hexdigest without BLAKE2 when hashlib is using FIPS mode."""
replaced_blake2b = pretend.raiser(ValueError("fipsmode"))
replaced_blake2b = pretend.raiser(exception_class("fipsmode"))
monkeypatch.setattr(package_file.hashlib, "blake2b", replaced_blake2b)

filename = "tests/fixtures/twine-1.5.0-py2.py3-none-any.whl"
Expand Down
2 changes: 1 addition & 1 deletion twine/package.py
Expand Up @@ -268,7 +268,7 @@ def __init__(self, filename: str) -> None:
self._blake_hasher = None
try:
self._blake_hasher = hashlib.blake2b(digest_size=256 // 8)
except ValueError:
except (ValueError, TypeError):
# FIPS mode disables blake2
pass

Expand Down