Re: ReportLab fails with ValueError on FIPS enabled systems

--===============1335555707204631266==
Content-Type: multipart/alternative; boundary="000000000000e3526b063afe3271"

--000000000000e3526b063afe3271
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Can we say that Pythons are "pining for the Fjords"?

On Mon, 28 Jul 2025 at 15:22, Robin Becker <[email protected]> wrote:

> Hi Marius, I believe Python 3.8 is now EOL and 3.9 is soon to follow.
>
> On Mon, 28 Jul 2025 at 12:00, Marius Gedminas <[email protected]> wrote:
>
>> Sun, Jun 29, 2025 at 08:13:59PM -0400, Martin Renters via reportlab-user=
s
>> ra=C5=A1=C4=97:
>> >   File "//opt/dftoolkit/lib/python3.9/site-packages/reportlab/pdfbase/
>> > pdfdoc.py", line 137, in __init__
>> >
>> >     sig =3D self.signature =3D md5()
>> >
>> > ValueError: [digital envelope routines] unsupported
>> >
>> > Most of the uses of MD5, aside from the use in the actual PDF
>> encryption,
>> > appear not to be security related. In Python 3.9, the hashlib function=
s
>> can be
>> > passed a keyword argument called =E2=80=98usedforsecurity=E2=80=99 (de=
faulting to True)
>> that
>> > can be set to False if the hash algorithm isn=E2=80=99t used for secur=
ity
>> purposes.
>> > This allows the use of MD5 hashes even on FIPS enabled systems and
>> allows
>> > ReportLab to successfully generate PDFs. Passing this keyword argument
>> on the
>> > older Python 3.6.8 doesn=E2=80=99t cause any ill effects.
>>
>> Meanwhile Python 3.8.18 complains:
>>
>>   TypeError: 'usedforsecurity' is an invalid keyword argument for
>> openssl_md5()
>>
>> in
>> /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/repor=
tlab/pdfbase/pdfdoc.py
>> line 137, which is
>>
>>   sig =3D self.signature =3D md5(usedforsecurity=3DFalse)
>>
>> (I'm translating pytest's default rich traceback that dumps the source
>> of the entire PDFDocument.__init__ into something that can be pasted
>> into an email.)
>>
>> Is Python 3.8 still supported?  https://pypi.org/project/reportlab/ says
>> both
>>
>>    Requires: Python <4, >=3D3.7
>>
>> and also omits 3.8 from the classifiers, which is a bit ambiguous.
>>
>> Oh, I see 3.8 is EOL upstream, so I suppose I'll just drop it from my
>> test matrix.
>>
>> Marius Gedminas
>> --
>> I used to (somewhat) sneer at people who describe themselves thus: "I
>> program
>> HTML". Then I tried to make a web-site look as I wanted it to (ie. not
>> grotesquely ugly), wow - perhaps they were onto something. Some think
>> there is
>> a pile of broken mess in our desktop, but at least you know where you ar=
e
>> with
>> a GtkHBox.
>>                 -- Michael Meeks
>> _______________________________________________
>> reportlab-users mailing list
>> [email protected]
>> https://pairlist2.pair.net/mailman/listinfo/reportlab-users
>>
>
>
> --
> Robin Becker
> _______________________________________________
> reportlab-users mailing list
> [email protected]
> https://pairlist2.pair.net/mailman/listinfo/reportlab-users
>


--=20
Andy Robinson
Managing Director, ReportLab

--000000000000e3526b063afe3271
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">Can we say that Pythons are &quot;pining =
for the Fjords&quot;?</div><br><div class=3D"gmail_quote gmail_quote_contai=
ner"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, 28 Jul 2025 at 15:22, Ro=
bin Becker &lt;<a href=3D"mailto:[email protected]">[email protected]</=
a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><d=
iv dir=3D"ltr">Hi Marius, I believe Python 3.8 is now EOL and 3.9 is soon t=
o follow.</div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gma=
il_attr">On Mon, 28 Jul 2025 at 12:00, Marius Gedminas &lt;<a href=3D"mailt=
o:[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br></=
div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bor=
der-left:1px solid rgb(204,204,204);padding-left:1ex">Sun, Jun 29, 2025 at =
08:13:59PM -0400, Martin Renters via reportlab-users ra=C5=A1=C4=97:<br>
&gt;=C2=A0 =C2=A0File &quot;//opt/dftoolkit/lib/python3.9/site-packages/rep=
ortlab/pdfbase/<br>
&gt; pdfdoc.py&quot;, line 137, in __init__<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0sig =3D self.signature =3D md5()<br>
&gt; <br>
&gt; ValueError: [digital envelope routines] unsupported<br>
&gt; <br>
&gt; Most of the uses of MD5, aside from the use in the actual PDF encrypti=
on,<br>
&gt; appear not to be security related. In Python 3.9, the hashlib function=
s can be<br>
&gt; passed a keyword argument called =E2=80=98usedforsecurity=E2=80=99 (de=
faulting to True) that<br>
&gt; can be set to False if the hash algorithm isn=E2=80=99t used for secur=
ity purposes.<br>
&gt; This allows the use of MD5 hashes even on FIPS enabled systems and all=
ows<br>
&gt; ReportLab to successfully generate PDFs. Passing this keyword argument=
 on the<br>
&gt; older Python 3.6.8 doesn=E2=80=99t cause any ill effects.<br>
<br>
Meanwhile Python 3.8.18 complains:<br>
<br>
=C2=A0 TypeError: &#39;usedforsecurity&#39; is an invalid keyword argument =
for openssl_md5()<br>
<br>
in /opt/hostedtoolcache/Python/3.8.18/x64/lib/python3.8/site-packages/repor=
tlab/pdfbase/pdfdoc.py line 137, which is<br>
<br>
=C2=A0 sig =3D self.signature =3D md5(usedforsecurity=3DFalse)<br>
<br>
(I&#39;m translating pytest&#39;s default rich traceback that dumps the sou=
rce<br>
of the entire PDFDocument.__init__ into something that can be pasted<br>
into an email.)<br>
<br>
Is Python 3.8 still supported?=C2=A0 <a href=3D"https://pypi.org/project/re=
portlab/" rel=3D"noreferrer" target=3D"_blank">https://pypi.org/project/rep=
ortlab/</a> says<br>
both<br>
<br>
=C2=A0 =C2=A0Requires: Python &lt;4, &gt;=3D3.7 <br>
<br>
and also omits 3.8 from the classifiers, which is a bit ambiguous.<br>
<br>
Oh, I see 3.8 is EOL upstream, so I suppose I&#39;ll just drop it from my<b=
r>
test matrix.<br>
<br>
Marius Gedminas<br>
-- <br>
I used to (somewhat) sneer at people who describe themselves thus: &quot;I =
program<br>
HTML&quot;. Then I tried to make a web-site look as I wanted it to (ie. not=
<br>
grotesquely ugly), wow - perhaps they were onto something. Some think there=
 is<br>
a pile of broken mess in our desktop, but at least you know where you are w=
ith<br>
a GtkHBox.<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Michael Meeks<br=
>
_______________________________________________<br>
reportlab-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">r=
[email protected]</a><br>
<a href=3D"https://pairlist2.pair.net/mailman/listinfo/reportlab-users" rel=
=3D"noreferrer" target=3D"_blank">https://pairlist2.pair.net/mailman/listin=
fo/reportlab-users</a><br>
</blockquote></div><div><br clear=3D"all"></div><br><span class=3D"gmail_si=
gnature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature">Ro=
bin Becker<br></div>
_______________________________________________<br>
reportlab-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">r=
[email protected]</a><br>
<a href=3D"https://pairlist2.pair.net/mailman/listinfo/reportlab-users" rel=
=3D"noreferrer" target=3D"_blank">https://pairlist2.pair.net/mailman/listin=
fo/reportlab-users</a><br>
</blockquote></div><div><br clear=3D"all"></div><div><br></div><span class=
=3D"gmail_signature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_s=
ignature"><div dir=3D"ltr">Andy Robinson<br>Managing Director, ReportLab<br=
><br></div></div></div>

--000000000000e3526b063afe3271--

--===============1335555707204631266==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline