Re: ReportLab fails with ValueError on FIPS enabled systems

--===============3556603404332653534==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="ip5u4yehn5m7dmnr"
Content-Disposition: inline


--ip5u4yehn5m7dmnr
Content-Type: text/plain; protected-headers=v1; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Subject: Re: [reportlab-users] ReportLab fails with ValueError on FIPS
 enabled systems
MIME-Version: 1.0

Sun, Jun 29, 2025 at 08:13:59PM -0400, Martin Renters via reportlab-users r=
a=C5=A1=C4=97:
>   File "//opt/dftoolkit/lib/python3.9/site-packages/reportlab/pdfbase/
> pdfdoc.py", line 137, in __init__
>=20
>     sig =3D self.signature =3D md5()
>=20
> ValueError: [digital envelope routines] unsupported
>=20
> Most of the uses of MD5, aside from the use in the actual PDF encryption,
> appear not to be security related. In Python 3.9, the hashlib functions c=
an be
> passed a keyword argument called =E2=80=98usedforsecurity=E2=80=99 (defau=
lting to True) that
> can be set to False if the hash algorithm isn=E2=80=99t used for security=
 purposes.
> This allows the use of MD5 hashes even on FIPS enabled systems and allows
> ReportLab to successfully generate PDFs. Passing this keyword argument on=
 the
> older Python 3.6.8 doesn=E2=80=99t cause any ill effects.

Meanwhile Python 3.8.18 complains:

  TypeError: 'usedforsecurity' is an invalid keyword argument for openssl_m=
d5()

in /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/repor=
tlab/pdfbase/pdfdoc.py line 137, which is

  sig =3D self.signature =3D md5(usedforsecurity=3DFalse)

(I'm translating pytest's default rich traceback that dumps the source
of the entire PDFDocument.__init__ into something that can be pasted
into an email.)

Is Python 3.8 still supported?  https://pypi.org/project/reportlab/ says
both

   Requires: Python <4, >=3D3.7=20

and also omits 3.8 from the classifiers, which is a bit ambiguous.

Oh, I see 3.8 is EOL upstream, so I suppose I'll just drop it from my
test matrix.

Marius Gedminas
--=20
I used to (somewhat) sneer at people who describe themselves thus: "I progr=
am
HTML". Then I tried to make a web-site look as I wanted it to (ie. not
grotesquely ugly), wow - perhaps they were onto something. Some think there=
 is
a pile of broken mess in our desktop, but at least you know where you are w=
ith
a GtkHBox.
                -- Michael Meeks

--ip5u4yehn5m7dmnr
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQSBIa0y8AqAlHSKbNCRV0Rd56bXjwUCaIdYTgAKCRCRV0Rd56bX
j9ZbAJ4y+DOJiRSUSs5IJqUYJiFo9Z8TQACfQf+yaRWtz/YhWFFSS2UZFyDT1pE=
=2DOm
-----END PGP SIGNATURE-----

--ip5u4yehn5m7dmnr--

--===============3556603404332653534==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline