Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

joblib.hash calls fail on FIPS-140-mode RHEL systems #1150

Open
bernstei opened this issue Oct 8, 2024 · 0 comments
Open

joblib.hash calls fail on FIPS-140-mode RHEL systems #1150

bernstei opened this issue Oct 8, 2024 · 0 comments

Comments

@bernstei
Copy link

bernstei commented Oct 8, 2024

RHEL (and clones, such as Rocky) can be put in FIPS mode, which restricts non-FIPS-140 compliant cryptographic settings. This, it turns out, includes md5 hashes, and it's apparently disabled some very low level, so calls to joblib.hash() in umap_.py lead to errors like

  File "/home/cluster/bernstei/.local/lib/python3.9/site-packages/umap/umap_.py", line 2822, in fit                              
    self._input_hash = joblib.hash(self._raw_data)
  File "/home/Software/python/system/extra/lib/python3.9/site-packages/joblib/hashing.py", line 263, in hash                     
    hasher = NumpyHasher(hash_name=hash_name, coerce_mmap=coerce_mmap)                                                           
  File "/home/Software/python/system/extra/lib/python3.9/site-packages/joblib/hashing.py", line 169, in __init__                 
    Hasher.__init__(self, hash_name=hash_name)
  File "/home/Software/python/system/extra/lib/python3.9/site-packages/joblib/hashing.py", line 59, in __init__                  
    self._hash = hashlib.new(hash_name)
  File "/usr/lib64/python3.9/hashlib.py", line 170, in __hash_new                                                                
    return __get_builtin_constructor(name)(data)
  File "/usr/lib64/python3.9/hashlib.py", line 86, in __get_builtin_constructor                                                  
    raise ValueError('unsupported hash type ' + name + '(in FIPS mode)')                                                         
ValueError: unsupported hash type md5(in FIPS mode)

Using joblib.hash(..., hash_name="sha1") appears to be sufficient to fix it, but I really don't know what you'd consider a good mechanism for controlling this at the umap level, or even whether you think it's an important enough use case to be worth addressing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant