Allow tests to temporarily disable specific hash algorithms · Issue #136547 · python/cpython · GitHub

Feature or enhancement

Proposal:

This is feature I needed in order to test my fix for #136134. The idea is to simulate a disabled algorithm due to FIPS reasons on a machine that enables it. However, to that end, we need to mock multiple entry points. For instance, disabling MD5 means disabling both hashlib.md5 & co but also hmac.new(..., 'md5') & co.

I have a local branch with those changes that I will push tomorrow, but I needed an issue first. At the same time, it'll become useful for people who want to simulate FIPS-builds. Note that the support will not be universal and that tests using those helpers need to be written by people who know how the hash algorithm is used (in general, we use hashlib.new(NAME) and hmac.new(NAME) so the stdlib should avoid using explicit functions as they would not necessarily be mocked.

Has this already been discussed elsewhere?

This is a minor feature, which does not need previous discussion elsewhere

Links to previous discussion of this feature:

No response

Linked PRs

gh-136547: allow to temporarily disable hash algorithms in tests (#13…

pythongh-136547: allow to temporarily disable hash algorithms in tests (

There are issues with my approach when building with FIPS. I actually understood the reason so I'm reopening it for fixing this.

gh-136547: fix `hashlib_helper` for blocking and requesting digests (#…