Re: ReportLab fails with ValueError on FIPS enabled systems

--===============5515113217211401485==
Content-Type: multipart/alternative; boundary="0000000000001ee34c063afe0527"

--0000000000001ee34c063afe0527
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Marius, I believe Python 3.8 is now EOL and 3.9 is soon to follow.

On Mon, 28 Jul 2025 at 12:00, Marius Gedminas <[email protected]> wrote:

> Sun, Jun 29, 2025 at 08:13:59PM -0400, Martin Renters via reportlab-users
> ra=C5=A1=C4=97:
> >   File "//opt/dftoolkit/lib/python3.9/site-packages/reportlab/pdfbase/
> > pdfdoc.py", line 137, in __init__
> >
> >     sig =3D self.signature =3D md5()
> >
> > ValueError: [digital envelope routines] unsupported
> >
> > Most of the uses of MD5, aside from the use in the actual PDF encryptio=
n,
> > appear not to be security related. In Python 3.9, the hashlib functions
> can be
> > passed a keyword argument called =E2=80=98usedforsecurity=E2=80=99 (def=
aulting to True)
> that
> > can be set to False if the hash algorithm isn=E2=80=99t used for securi=
ty
> purposes.
> > This allows the use of MD5 hashes even on FIPS enabled systems and allo=
ws
> > ReportLab to successfully generate PDFs. Passing this keyword argument
> on the
> > older Python 3.6.8 doesn=E2=80=99t cause any ill effects.
>
> Meanwhile Python 3.8.18 complains:
>
>   TypeError: 'usedforsecurity' is an invalid keyword argument for
> openssl_md5()
>
> in
> /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/report=
lab/pdfbase/pdfdoc.py
> line 137, which is
>
>   sig =3D self.signature =3D md5(usedforsecurity=3DFalse)
>
> (I'm translating pytest's default rich traceback that dumps the source
> of the entire PDFDocument.__init__ into something that can be pasted
> into an email.)
>
> Is Python 3.8 still supported?  https://pypi.org/project/reportlab/ says
> both
>
>    Requires: Python <4, >=3D3.7
>
> and also omits 3.8 from the classifiers, which is a bit ambiguous.
>
> Oh, I see 3.8 is EOL upstream, so I suppose I'll just drop it from my
> test matrix.
>
> Marius Gedminas
> --
> I used to (somewhat) sneer at people who describe themselves thus: "I
> program
> HTML". Then I tried to make a web-site look as I wanted it to (ie. not
> grotesquely ugly), wow - perhaps they were onto something. Some think
> there is
> a pile of broken mess in our desktop, but at least you know where you are
> with
> a GtkHBox.
>                 -- Michael Meeks
> _______________________________________________
> reportlab-users mailing list
> [email protected]
> https://pairlist2.pair.net/mailman/listinfo/reportlab-users
>


--=20
Robin Becker

--0000000000001ee34c063afe0527
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Marius, I believe Python 3.8 is now EOL and 3.9 is soon=
 to follow.</div><br><div class=3D"gmail_quote gmail_quote_container"><div =
dir=3D"ltr" class=3D"gmail_attr">On Mon, 28 Jul 2025 at 12:00, Marius Gedmi=
nas &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:=
<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8=
ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Sun, Jun 29, 20=
25 at 08:13:59PM -0400, Martin Renters via reportlab-users ra=C5=A1=C4=97:<=
br>
&gt;=C2=A0 =C2=A0File &quot;//opt/dftoolkit/lib/python3.9/site-packages/rep=
ortlab/pdfbase/<br>
&gt; pdfdoc.py&quot;, line 137, in __init__<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0sig =3D self.signature =3D md5()<br>
&gt; <br>
&gt; ValueError: [digital envelope routines] unsupported<br>
&gt; <br>
&gt; Most of the uses of MD5, aside from the use in the actual PDF encrypti=
on,<br>
&gt; appear not to be security related. In Python 3.9, the hashlib function=
s can be<br>
&gt; passed a keyword argument called =E2=80=98usedforsecurity=E2=80=99 (de=
faulting to True) that<br>
&gt; can be set to False if the hash algorithm isn=E2=80=99t used for secur=
ity purposes.<br>
&gt; This allows the use of MD5 hashes even on FIPS enabled systems and all=
ows<br>
&gt; ReportLab to successfully generate PDFs. Passing this keyword argument=
 on the<br>
&gt; older Python 3.6.8 doesn=E2=80=99t cause any ill effects.<br>
<br>
Meanwhile Python 3.8.18 complains:<br>
<br>
=C2=A0 TypeError: &#39;usedforsecurity&#39; is an invalid keyword argument =
for openssl_md5()<br>
<br>
in /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/repor=
tlab/pdfbase/pdfdoc.py line 137, which is<br>
<br>
=C2=A0 sig =3D self.signature =3D md5(usedforsecurity=3DFalse)<br>
<br>
(I&#39;m translating pytest&#39;s default rich traceback that dumps the sou=
rce<br>
of the entire PDFDocument.__init__ into something that can be pasted<br>
into an email.)<br>
<br>
Is Python 3.8 still supported?=C2=A0 <a href=3D"https://pypi.org/project/re=
portlab/" rel=3D"noreferrer" target=3D"_blank">https://pypi.org/project/rep=
ortlab/</a> says<br>
both<br>
<br>
=C2=A0 =C2=A0Requires: Python &lt;4, &gt;=3D3.7 <br>
<br>
and also omits 3.8 from the classifiers, which is a bit ambiguous.<br>
<br>
Oh, I see 3.8 is EOL upstream, so I suppose I&#39;ll just drop it from my<b=
r>
test matrix.<br>
<br>
Marius Gedminas<br>
-- <br>
I used to (somewhat) sneer at people who describe themselves thus: &quot;I =
program<br>
HTML&quot;. Then I tried to make a web-site look as I wanted it to (ie. not=
<br>
grotesquely ugly), wow - perhaps they were onto something. Some think there=
 is<br>
a pile of broken mess in our desktop, but at least you know where you are w=
ith<br>
a GtkHBox.<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Michael Meeks<br=
>
_______________________________________________<br>
reportlab-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">r=
[email protected]</a><br>
<a href=3D"https://pairlist2.pair.net/mailman/listinfo/reportlab-users" rel=
=3D"noreferrer" target=3D"_blank">https://pairlist2.pair.net/mailman/listin=
fo/reportlab-users</a><br>
</blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si=
gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature">Ro=
bin Becker<br></div>

--0000000000001ee34c063afe0527--

--===============5515113217211401485==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline