gh-136547: fix hashlib_helper for blocking and requesting digests (#136762)

- Fix `hashlib_helper.block_algorithm` where the dummy functions were incorrectly defined.
- Rename `hashlib_helper.HashAPI` to `hashlib_helper.HashInfo` and add more helper methods.
- Simplify `hashlib_helper.requires_*()` functions.
- Rewrite some private helpers in `hashlib_helper`.
- Remove `find_{builtin,openssl}_hashdigest_constructor()` as they are no more needed and were
  not meant to be public in the first place.
- Fix some tests in `test_hashlib` when FIPS mode is on.
This commit is contained in:
Bénédikt Tran 2025-07-20 14:32:35 +02:00 committed by GitHub
parent cc81b4e501
commit c504f62fe2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 579 additions and 310 deletions

View file

@ -545,13 +545,17 @@ def check(self, name, data, hexdigest, shake=False, **kwargs):
def check_file_digest(self, name, data, hexdigest):
hexdigest = hexdigest.lower()
try:
hashlib.new(name)
except ValueError:
# skip, algorithm is blocked by security policy.
return
digests = [name]
digests.extend(self.constructors_to_test[name])
digests = []
for digest in [name, *self.constructors_to_test[name]]:
try:
if callable(digest):
digest(b"")
else:
hashlib.new(digest)
except ValueError:
# skip, algorithm is blocked by security policy.
continue
digests.append(digest)
with tempfile.TemporaryFile() as f:
f.write(data)