Use of `hashlib.sha1` causes issue in FIPS build about flask

[davidism]

Wait nevermind, the traceback is for Flask-Session but you're pointing at Flask code in the link. So the problem is that the default of sha1 causes hashlib to raise an error before it's possible to override that, so even if the user wants to choose something other than the default they can't do that in time.

[davidism]

Already reported to cachelib: pallets-eco/cachelib#361

[davidism]

Looking into this more, only MD5 is called out as not being available in FIPS mode: https://docs.python.org/3/library/hashlib.html#hash-algorithms. Has this changed recently to include SHA-1? If so, you should report that to Python as well to update the documentation to reflect what FIPS actually does.

I found this announcement https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm which states that FIPS 180-5 will be released by 2030, but I can't find anything detailing how you'd get a FIPS build of OpenSSL that doesn't support SHA-1 today. I need some more info on how OpenSSL/Python is being built, because it looks like the build is different than what FIPS actually requires.