md5 fails when OpenSSL FIPS is enabled

[lhupfeldt]

Attemting to build documentation on a Redhat Linux with SSL FIPS enabled, results in the following error:

File .../sphinx/builders/html/__init__.py", line 80, in get_stable_hash return md5(str(obj).encode()).hexdigest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

Environment info

• OS: Redhat Linux 7.8 - FIPS enabled
• Python version: 3.6.8
• Sphinx version: v3.0.3

The md5 algorithm is considered insecure and is not allowed by FIPS. A workaround is to supply the argument 'usedforsecurity=False' to the md5 call. Another solution would be changing the hash algorithm.
The 'usedforsecurity' is not supported on all platforms, so would have to be wrapped in a try/except.

There seems to be no workaround for this issue other than a systemwide disabling of FIPS, which I cannot do, so changing the caching code in sphinx seems like the only solution.

[lhupfeldt]

Support for this flag should become part of the standard python hashlib module: python/cpython#16044

[stratakis]

Noting here that as of Python 3.9, Python upstream supports the usedforsecurity=False keyword argument: python/cpython@7cad53e