Skip to content

Commit

Permalink
Fix jschneier#1469 Use a different checksum calculation method to run…
Browse files Browse the repository at this point in the history
… in FIPS env

Python 3.10 and later versions rely on OpenSSL 1.1.1 or newer, which includes FIPS-compliance checks.

MD5 is not an approved algorithm in FIPS mode, so attempting to instantiate self.blob.download_to_file(self._file) will fail when the system is running in FIPS mode.

The change configures the `download_to_file` function to use an alternative algorithm provided by gcloud storage SDK - 'crc32c' - for checksum calculation.
Configurable checksumming is available in the google-storage lib since v1.31.0.
  • Loading branch information
markesha authored and markesha committed Nov 18, 2024
1 parent f029e50 commit 6e033f6
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 2 deletions.
2 changes: 1 addition & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ dropbox = [
"dropbox>=7.2.1",
]
google = [
"google-cloud-storage>=1.27",
"google-cloud-storage>=1.31",
]
libcloud = [
"apache-libcloud",
Expand Down
1 change: 1 addition & 0 deletions storages/backends/gcloud.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import gzip
import io
import inspect
import mimetypes
from datetime import timedelta
from tempfile import SpooledTemporaryFile
Expand Down
2 changes: 1 addition & 1 deletion tests/test_gcloud.py
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ def test_open_read_num_bytes(self):
self.filename, chunk_size=None
)

f.blob.download_to_file = lambda tmpfile: tmpfile.write(data)
f.blob.download_to_file = lambda tmpfile, **kwargs: tmpfile.write(data)
self.assertEqual(f.read(num_bytes), data[0:num_bytes])

def test_open_read_nonexistent(self):
Expand Down

0 comments on commit 6e033f6

Please sign in to comment.